Microsoft Agent 365 Active Users Export: Enable Agent Usage Reporting for Licensing & Governance (MC1462914)

MC1462914 confirms Microsoft is shipping a new Active Users export inside Microsoft Agent 365 — a read-only, 30-day rolling CSV report showing which users interacted with which registered AI agents in your tenant. This is a licensing/adoption visibility tool, not a security audit log, but it exports UPNs, which means your DLP and retention policies need to catch up before someone downloads it and drops it into a random SharePoint site.

What's Changing

Per MC1462914, Microsoft is enabling a new export option under Microsoft 365 admin center > Agents > All Agents > Export called Active Users. It generates a CSV snapshot covering the trailing 30 days, with four columns: User Principal Name (UPN), Total Agents Used, Total Sessions, and Last Activity Date. Microsoft's own framing: this is about identifying "individuals responsible for agent licensing decisions" and giving admins adoption visibility — not a compliance or eDiscovery tool, despite the personal data it contains.

Rollout start is 2026-08-27T22:03:31Z, with GA targeted for late August 2026, Worldwide — no Targeted Release ring, no preview phase, direct to GA. That compressed window (rollout and completion in the same few days) is unusual and worth flagging: expect possible slippage into early September if your tenant hasn't seen the Agents export option yet.

Who's Affected & When

Any tenant with Microsoft Agent 365 provisioned — this is not a standalone SKU add-on for the export itself, it rides on existing Agent 365 entitlement. Microsoft's exact wording: the feature "will be enabled by default for AI Admins and Global Admins who already have access to Agent 365." There's no opt-in, no admin toggle, no per-role scoping mechanism mentioned. If your tenant has Agent 365 and you hold either role, you get this on rollout — full stop.

Rollout began 2026-08-27 and GA completion is targeted for late August 2026, Worldwide, with no Targeted Release ring preceding it. Given the article date of August 30, 2026, most tenants should already be seeing this or will within days — but a same-week rollout-to-GA claim from Microsoft is aggressive, so don't be surprised if some tenants lag into the first week of September.

What This Means for Your Environment

If you're running Agent 365 today, two admin populations (AI Admin, Global Admin) can now pull UPN-level usage data with zero approval workflow, zero DLP applied at export time, and zero retention default. That's your gap to close, not Microsoft's.

Also confirm your Agent 365 Registry is accurate. Any agent not registered in the Registry is invisible to this report — shadow agents, test deployments, or anything provisioned outside the sanctioned pipeline won't show up in Total Agents Used or Total Sessions counts. That's a governance blind spot, not a bug, and it means this export cannot be your sole source of truth for "what AI agents exist in my tenant."

Action Items

• Confirm Agent 365 is provisioned in your tenant and identify every account holding AI Admin or Global Admin — both get this export capability by default with no opt-out.
• Run an RBAC audit (script below) to produce a current list of eligible exporters for your governance file.
• Stand up a Purview DLP policy targeting the export CSV pattern (UPN column) before your first real download — don't wait for an incident.
• Designate a single, compliant SharePoint/OneDrive location with a retention label for archived exports; do not let individual admins save CSVs to local drives or personal OneDrive.
• Validate your Agent 365 Registry completeness — unregistered/shadow agents won't appear in usage data, so reconcile against your actual agent inventory separately.
• Brief whoever owns licensing/adoption reporting that this is 30-day rolling only — build an archival cadence now if you need trend data beyond one month.
• Do not treat this as an audit log or compliance control — pair it with existing Agent 365 governance features for actual enforcement (disable/revoke).
• Monitor Microsoft Learn / Graph API reference for a future /reports/agent365ActiveUsers-style endpoint before building automation assumptions into production tooling.

RBAC Audit & Archival Foundation (PowerShell)

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Identity.DirectoryManagement
# Purpose: Identify AI Admin and Global Admin role holders eligible to perform the
# Agent 365 Active Users export (MC1462914). No Agent 365 export API exists at GA.

[CmdletBinding()]
param(
    [string]$OutputPath = "C:\Reports\Agent365_ExportEligibleAdmins.csv"
)

try {
    Connect-MgGraph -Scopes "RoleManagement.Read.Directory","User.Read.All" -NoWelcome

    # Role template IDs: Global Administrator is fixed; AI Admin role name may vary
    # slightly by tenant localization -- match by DisplayName substring "AI Admin"
    $targetRoleNames = @("Global Administrator", "AI Admin")

    $eligibleAdmins = foreach ($roleName in $targetRoleNames) {
        $role = Get-MgDirectoryRole -Filter "displayName eq '$roleName'" -ErrorAction SilentlyContinue

        if (-not $role) {
            Write-Warning "Role '$roleName' not activated in this tenant or naming differs. Skipping."
            continue
        }

        $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id -All

        foreach ($member in $members) {
            $user = Get-MgUser -UserId $member.Id -Property Id,DisplayName,UserPrincipalName,AccountEnabled -ErrorAction SilentlyContinue
            if ($user) {
                [PSCustomObject]@{
                    RoleName          = $roleName
                    DisplayName       = $user.DisplayName
                    UserPrincipalName = $user.UserPrincipalName
                    AccountEnabled    = $user.AccountEnabled
                    AuditTimestampUtc = (Get-Date).ToUniversalTime().ToString("o")
                }
            }
        }
    }

    if (-not $eligibleAdmins) {
        Write-Warning "No eligible role holders found. Verify Agent 365 provisioning and role assignments."
        exit 1
    }

    $eligibleAdmins | Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8
    Write-Host "Eligible admin audit written to $OutputPath ($($eligibleAdmins.Count) records)."
    exit 0
}
catch {
    Write-Error "RBAC audit failed: $($_.Exception.Message)"
    exit 1
}
finally {
    Disconnect-MgGraph | Out-Null
}

# Purpose: Import a manually downloaded Agent 365 Active Users export CSV,
# validate schema, mask UPNs for non-compliance-officer consumption, and
# archive to a retention-labeled SharePoint/OneDrive library.
# NOTE: There is no scheduled/automated trigger for the export itself --
# this script assumes a human already clicked Export in the admin center.

[CmdletBinding()]
param(
    [Parameter(Mandatory)][string]$SourceCsvPath,
    [Parameter(Mandatory)][string]$ArchiveSitePath,   # e.g. SharePoint document library sync path
    [switch]$MaskUpnForGeneralDistribution
)

$expectedColumns = @("UserPrincipalName","TotalAgentsUsed","TotalSessions","LastActivityDate")

function Convert-ToTokenizedUpn {
    param([string]$Upn)
    $hash = [System.Security.Cryptography.SHA256]::Create()
    $bytes = [System.Text.Encoding]::UTF8.GetBytes($Upn.ToLowerInvariant())
    $hashBytes = $hash.ComputeHash($bytes)
    $token = [BitConverter]::ToString($hashBytes).Replace("-","").Substring(0,16)
    return "user-$token"
}

try {
    if (-not (Test-Path $SourceCsvPath)) {
        throw "Source CSV not