Gokan's Studio

An interview with Frane Borozan — Microsoft MVP, Co-Founder & President of Syskit

I have been chasing this interview for months. Every time Frane Borozan and I ended up in the same city — Sarajevo, Orlando, a booth somewhere between sessions — the conversation drifted back to the same thing: agents are multiplying inside Microsoft 365 faster than anyone can govern them, and nobody has a single place to look. So I finally sat him down for an hour, recorded the whole thing, and what came out is one of the more useful hours I have spent this year. Frane is a Microsoft MVP for M365 Copilot and Microsoft 365, and the co-founder and president of Syskit. He has also just built something I think a lot of you are going to want: a completely free, read-only, nothing-stored-in-the-backend agent registry — built by the community, shaped by community feedback, and given away for the community.

1 – So, what is Agent 365 — and where does it fall short?

Microsoft made Agent 365 generally available at the start of May, and Frane sees the logic behind it. “I believe the way Microsoft is going — that agents are the next big thing after Copilot — is the right way,” he told me. Clients are reporting exactly that, and it was only natural that Microsoft would ship a first-party solution to manage “all this mess that’s going on with the agents.” His verdict on today’s product is measured: it is a good start. “Agent 365, for me, is mostly a basic solution today. I believe in a year, year and a half, it will look completely different.”

But we spent a good chunk of the hour on the gaps, because that is the whole reason his tool exists. When I asked Frane for the three things he’d fix if he ran the Agent 365 product group, the answer was blunt: it’s an inventory, not governance. “Today you can block an agent, you can see if it’s ownerless — and that’s mostly it. For me, governance is control and management. They’ve done a good inventory. They need to invest much more on the control side.”

The second gap is one that drives me personally up the wall: there is no single source of truth. Agent 365 gives you one number. Purview and DSPM give you another. Teams shows you a different list. Defender shows you yet another, and SharePoint Advanced Management only surfaces agents from the last 28 days. “Microsoft has multiple admin centers for agents, and every admin center supports different agents,” Frane said. “People are confused. They see a lot of different agents and they’re not sure where to focus. Where is the single point of truth?”

And the third — the one that becomes the beating heart of his tool — is intelligence. “In large companies I’ve seen 5,000 agents in one tenant. You give me 5,000 agents, but where should I look? Show me the risky ones — the ones doing autonomous things, potentially risky operations — so I can check 20 agents, not 5,000. Everyone knows I’m not going to review 5,000 agents. That’s impossible.”

My own pet peeve made it in too: today, open an agent in Agent 365 and half the panels are just a link back to Purview. I don’t want to pay a per-user, per-month license for a hyperlink. Read the data into the experience; don’t bounce me to another admin center. As Frane put it, that frustration is “exactly the idea that gave me the Agent Registry.”

2 – Enter Agent Registry: agent365registry.syskit.com

Frane started digging into agents back in February. The trigger, he admits, was a half-joke I made in Sarajevo about getting a few MVPs together to write a book about Agent 365 — which we then actually did, the Dawn of the Agent 365 whitepaper.

That pushed him to look at Agent 365 programmatically. Around March he discovered the Agent 365 API, and built a first version of a tool on top of it: pull the full inventory, plus basic actions like block, delete, or change owner.

Then Microsoft moved the goalposts. “One day before the launch, they tied that API behind the paywall,” Frane said. “You needed a license to use it — and if you need a license, a free tool makes no sense. You’d just buy Agent 365 for everyone and use that instead.” So he threw the approach out and started again, this time asking a harder question: can I recreate all of this from the free Graph and SDK APIs? He spent roughly two and a half months of his own free time proving that he could. “I wanted the community to have something, if for whatever reason they can’t use Agent 365.”

The result is agent365registry.syskit.com — a tool that runs entirely in your browser, needs no license, no seat count, and no install. Syskit sponsors the Azure resources behind it, but there is no product to buy. “I decided I want to return something to the community,” Frane said. “I travel, I do sessions — but this was something I wanted to give back, and get feedback on.”

3 – One grid for every agent — ranked by risk

The first thing Frane cared about was coverage. Not a Copilot Studio view or a SharePoint view or a Foundry view — one interface for all of it. Today Agent Registry inventories agents across Microsoft Teams, Copilot Studio, M365 Copilot Agent Builder, Azure AI Foundry, SharePoint, Entra agent identities and Security Copilot — the single point of truth Agent 365 doesn’t yet give you.

But coverage without triage is just a longer list. This is where the tool earns its keep. Every agent is scored 0 to 100 and bucketed Low / Medium / High / Very High, so the agents that can actually harm your environment float to the top. “I have 250 agents in this tenant, but I want you to focus on maybe 90,” Frane demonstrated. “Don’t review 5,000 agents. Start with the ones that matter.”

And here is the part I loved most. When I asked whether the risk scoring was AI-driven, Frane was quick to correct me. “No — this is the feedback I got from real people. MVPs, clients. These are the things that are really important to them. It’s not AI; these are real risks.” The score is calculated from an agent’s actual properties — write-capable tools, external HTTP calls, autonomous orchestration, publishing to public channels — weighted alongside identity and lifecycle signals like orphaned owners, dormant service principals, over-privilege, or an environment with no DLP policy. Open any agent and it tells you, in plain language, exactly why it scored the way it did.

This is the “by the community, for the community” idea made literal. When Frane demoed version 0.5, it didn’t even cover Agent Builder — until Marco Rocca told him, in Slovenia, that Agent Builder agents were the most important ones in his organization. So Frane went and built it. The feature set isn’t a roadmap dreamed up in a vacuum; it is a running list of what actual admins and MVPs have asked for.

4 – Read-only by design, and nothing is stored

For a tool that reaches into your tenant, this is the part that matters most — and it is where Frane was most transparent. Agent Registry is delegated and read-only. You create a single app registration in Entra (or run the in-browser admin-consent flow), and the app acts as you, forwarding your token to Microsoft directly. It never holds standalone application rights.

The permissions list is long, but as I noted during the demo, it’s “read, read, read, read.” There is exactly one exception, and Frane flagged it himself: reading who an Agent Builder agent is shared with requires the CopilotStudio.MinimalBot.ReadWrite scope, because Microsoft gates that share-read behind a write-capable scope and offers no read-only variant. “It will not write anything — that’s just the limitation of the endpoint today.” This is my open plea to Microsoft: give us a read-only variant so this can be a 100% read tool. Delete actions, meanwhile, live behind separate, opt-in, admin-consented scopes — never part of the default consent.

Now the headline. “This is a stateless application. There is no backend database. When I close the browser tab, it disappears — it lives only inside your browser. I’m not capturing any data.” Whatever the tool extracts from your tenant stays in your browser session. The only thing collected is anonymous product analytics — pageviews and clicks via PostHog — so Frane can see which parts of a free project people actually use. “No text, no PII, no tokens, no tenant data. Everything is anonymous. I could see someone logged in from Turkey — probably you — and that’s it.” It was me.

There’s even a nice touch for the review workflow: mark an agent as “reviewed” and that flag persists in a browser cookie, so you can work through a long list across sessions — without a single byte leaving your machine. And because everything is transparent, when you’re done you can simply delete the app registration and the access is gone. No one connects again.

5 – Exports, cost visibility, and agents beyond Microsoft

Because the tool is stateless, Frane added exports so you can actually do something with a snapshot. One click gives you a PDF or a full Excel export — every field you see on screen lands in the spreadsheet, ready to hand to a colleague, a consultant, or your boss before you go deleting anything. “It’s a state of your tenant that you can share with the team.”

A cost-and-billing view, released just before we spoke, answers a question Frane kept hearing from clients: we have a lot of agents, but which users, environments and agents are actually spending the money? It surfaces exact Copilot credits per agent and per user, plus messages and sessions from transcripts — pulled with your normal sign-in. A companion users view shows who is creating and consuming agents across the tenant.

And the inventory now reaches outside Microsoft 365. Through the SDK you can optionally connect Amazon Bedrock, Google Vertex AI, Salesforce Agentforce, Databricks Genie and ServiceNow, and pull their agents into the same risk-scored grid — read-only, credentials living only in your browser session. “This is really useful for consultants,” Frane noted. “They can walk into a client tenant, get all this data, and hand back a report.” Your Microsoft 365 inventory works fully whether or not you connect any of them.

6 – How to try it — including a no-login demo

If you’re not ready to point it at a live tenant, don’t. Frane’s closing ask was that I make sure to mention the demo mode: open agent365registry.syskit.com and you get a full showcase of what the tool surfaces — sample agents across every source, risk scores, detail panels — with no sign-in and nothing leaving your browser. When you’re ready, sign in with Microsoft and see your own tenant.

Three steps to real data: register a single-page app in Entra (or run the in-browser Grant Admin Consent flow), sign in with Microsoft, and watch the inventory, risk scores and audit populate across every source. That’s it. No agents to install, no database to host.

7 – Why this matters

Shadow agents are the new shadow IT. Makers are spinning up Copilot Studio bots, Agent Builder agents, Foundry assistants and SharePoint agents faster than IT can track them — and the native tooling, for now, gives you an inventory that’s fragmented across a half-dozen admin centers and no easy way to tell the dangerous agents from the harmless ones. What Frane has built fills exactly that gap, and he’s done it in the open: read-only by default, nothing stored, transparent about every permission and every click he logs.

“If you and your readers believe this is useful, give me feedback — what you like, what you don’t,” Frane said as we wrapped. “I’ll build it completely based on feedback.” That’s the whole ethos in one sentence. Built by an MVP, funded by Syskit, shaped by the community — and free for all of us. Go try it, and tell him what to build next.

The tool: agent365registry.syskit.com

Contact Frane: agent365registry@syskit.com  ·  LinkedIn

Disclaimer: Tomislav Karafilov feedback for the cost and billing feature