news • June 9, 2026 • 2 min read
KPMG will use Microsoft Agent 365 to manage, monitor and secure AI agents across its 138-country network and roll Microsoft 365 Copilot out to its entire 276,000-person workforce. The signal for operators: the enterprise agent conversation has moved from 'can it work' to 'can you govern it.'
Source: Microsoft Source
On June 9, Microsoft and KPMG announced an expanded global agreement: KPMG will adopt Microsoft Agent 365 to manage, monitor, and secure AI agents across its global network, and deploy Microsoft 365 Copilot to its entire workforce of more than 276,000 professionals across 138 countries. Agent 365 is Microsoft's control plane for agents — centralized registration, visibility, lifecycle management, and governance for agents "operating across systems, data and business processes." KPMG is wiring it into Workbench, its agent-coordination platform built on Azure AI Foundry. "This requires strong foundations in governance, visibility and accountability," said Lisa Heneghan, KPMG's global chief digital officer, calling it "a key step in embedding responsible AI." The deal names client proof points, too: Integra LifeSciences described embedding Copilot into Global Supply Chain, Regulatory Affairs, and Medical Affairs under a "responsible, secure, and compliant" operating model.
For operators, the interesting move is what Microsoft is selling: not another agent, but the registry and guardrails for the agents you already have. That is a tell. The first wave of enterprise AI produced "shadow agents" — useful automations spun up in a business unit with no inventory, no owner, and no audit trail. The second wave is governance: who can deploy an agent, what data it may touch, how its actions are logged, and who is accountable when it acts. A supply chain or finance team should read the KPMG deal less as a Microsoft endorsement and more as a checklist — before scaling agents into planning or procurement, can you enumerate every agent running against your system of record, revoke one in minutes, and prove what it did? The trade-off is concentration: putting identity, governance, and the productivity layer on one vendor is convenient and sticky in equal measure. But the underlying discipline — treat agents as named, governed actors, not loose scripts — is correct regardless of whose control plane you buy, and it is the part you should insist on owning the policy for.