Do AI Agents Need a Software License? What Happens When Your Agent Gets an Email Address

Do AI agents need their own software license?

The bill did not disappear. It moved to a person, or to a meter: a counter that charges for agent work in credits, outcomes, steps or units.

Microsoft anchors the cost to a licensed person; the other audited vendors count the work or the outcome.

Microsoft anchors the cost to a human. The other five count what the agent does, and Intercom and SAP also charge per-user fees for their human users.

Example (illustrative arithmetic from Microsoft’s list prices, not a quote).

A team has 100 licensed users on standalone Agent 365. At list price that is 100 × $15 = $1,500 per month, whether those users sponsor 5 agents or 500. Microsoft says one license covers all agents tied to a user, with no fixed cap on how many agents one licensed user can oversee.

Two limits apply. Microsoft requires prerequisite licenses such as Microsoft 365 E5, and standard usage limits may apply. Runtime is separate: Windows 365 for Agents costs $0.40 per VM per hour.

License rules still apply. Microsoft’s FAQ states two consequences:

• An agent tied to an unlicensed user is out of compliance, and its activity gets no Agent 365 protections.
• Pooling services to reduce the number of required licenses is not permitted.

So the test shifts from whether an agent needs a license to which person the vendor counts.

What does “AI agent license” mean?

“AI agent license” means three different things, depending on who asks. This guide covers the first.

Google describes its agent as one that can work autonomously to complete objectives you assign it. For the difference between that kind of agent and a chatbot, see TSL’s guide to AI agents versus chatbots.

For how “open” AI models differ from open-source software, see TSL’s explainer on open weights versus open source.

That rule meets a harder case when an agent gets its own mailbox, which Google’s coworker agents are designed to have.

What happens the day your AI agent gets its own email address?

The mailbox is where licensing enters. Microsoft’s documentation gives an agent two accounts, and only the second one holds a mailbox.

Microsoft also says agents that only emit telemetry and call tools usually do not need a user account. The page was updated August 13, 2026, so preview status may have changed since. For which agent features run in production today, see TSL’s guide to agentic AI in B2B SaaS.

Microsoft splits an agent into an identity and an optional user account, while Google gives coworker agents their own Workspace account.

Example.

In Google’s own illustration, a user describes a role such as events coordinator and Gemini creates the agent. Colleagues add it to a Chat space or @mention it.

When it edits a Doc, it appears under its own name in version history. That is what an agent identity means in practice: the work shows up under the agent’s name, so a person can tell what the agent did.

Google frames governance as four checks: who the agent is, what it may do, what it did, and what it must never touch. It says each agent’s identity is cryptographically attested, carries least-privilege permissions, and every action goes to an audit trail attributed to the agent rather than a person. Spend caps work differently: Google sets them per project, not per agent identity.

Why does an agent’s identity matter for licensing?

An agent’s identity matters for licensing because it creates a sponsor, and Microsoft’s licensing attaches to the people tied to the agent.

• Identity: each agent identity requires at least one sponsor, the business representative accountable for the agent. A sponsor can be a user or a group.
• License: Microsoft’s FAQ says the owner, sponsor or manager of an agent with its own access needs an Agent 365 license. Users who delegate their access to agents need one too.
• Reason: Microsoft says Agent 365 is licensed per user because every agent is associated with a person in some capacity.

So the identity gives the vendor a person to count. The mailbox adds a second question: which licenses the agent’s own account needs, which Microsoft’s identity page does not name.

Microsoft had already described that scenario in public by December 2025.

Why did Microsoft call AI agents “seat opportunities”?

The remark was a rebuttal. Karl Keirstead of UBS, who covers Microsoft, noted that investors in SaaS businesses worry about headcount cuts and asked Jha to comment on AI-induced seat pressure. Jha replied that he was not seeing AI drive Microsoft 365 seats down, and that AI was, if anything, an opportunity to drive seat growth.

What did Jha say AI agents would need?

Jha said AI agents would need seven things to work like users:

• an identity
• an entry in the address book
• a mailbox
• a computer to do their computation securely
• a way for colleagues to mention them
• a way to chat with colleagues
• a place in meetings

That list matches what Google’s coworker agent shipped on October 8: its own account and mailbox, a directory entry, and @mentions in Chat.

Jha also pointed to the far end of the agent range: digital workers that show up in the org chart, meeting rosters and channels. He called that the most immature end, and said 2026 would start to see it.

Why do seats matter to Microsoft 365?

Seats matter to Microsoft 365 because growth now comes mostly from revenue per user, not new enterprise seats.

So Microsoft 365 growth now leans mostly on revenue per user, and agents are the source of seat growth Jha pointed to.

Example (illustrative arithmetic, not a Microsoft price).

A company with 100 employees holds 100 seats. If it deploys 100 agents and each counted as a seat, its seat count would double without a single new hire. That is the logic of Jha’s remark.

The arithmetic behind a seat opportunity: 100 employees plus 100 agents counted as seats would be 200 seats (illustration only, not a Microsoft price).

Treat it as a forecast. It came in a conference Q&A, and the transcript contains no pricing announcement. On March 12, 2026, Jha told Microsoft staff he would retire, transition out on July 1 and stay in an advisory role.

The product Microsoft shipped answers differently: its licensing FAQ lists no per-agent charge.

Did Microsoft actually make agents buy a seat?

Microsoft shipped the opposite of a per-agent price. Jha’s December remark predicted agents as seats, and the product that followed licenses the people attached to them.

So a company pays for the people attached to its agents, not for the agents themselves. This covers the Agent 365 license only; the mailbox account from the previous section is a separate matter.

Agent 365 is licensed per user, and who needs the license depends on the access flow.

Who needs an Agent 365 license?

Two groups of people need an Agent 365 license, depending on how the agent gets access. Microsoft’s FAQ splits it by access flow:

Microsoft’s Learn page gives the plain-language test: nightly background processing usually runs as the agent itself, while a user-specific action in chat runs on behalf of the user. The FAQ names an agent called AskHR as its example of an own-access agent.

Why does Google’s answer look similar?

Google’s answer looks similar because a Google representative told Futurum the company does not intend to charge a per-seat license for coworker agents in Workspace. It said pricing details would come closer to wider availability. That is a statement of intent: Futurum notes Google did not disclose pricing or availability dates for most announcements.

Both vendors have left the meter open. Microsoft’s FAQ says Agent 365 has no consumption-based costs “yet,” and Google has said only that it will share pricing later.

If no agent buys a seat, the next question is which agent counts as its own user, and Microsoft’s own documents already draw that line.

Is your AI agent an extension of you, or its own user?

Lawyers at Proskauer say asking only whether an agent is a “user” collapses several questions: whether the agent may access the software, whose authority and permissions it uses, on whose behalf it acts, and how its activity is measured and priced.

The same lawyers list four ways a contract could treat an agent:

• an extension of a human user
• a separate licensed or authorized user
• a machine process
• a source of metered consumption

They add that the market is experimenting with different approaches, not converging on one. The vendor table in section 1 shows that split in practice: Microsoft anchors the license to a person, while Atlassian, Intercom, SAP, UiPath and Workday count the work.

What is the Agent Seat Test?

The Agent Seat Test is TSL’s three-question check for which clause of your contract to read for each agent. It is TSL’s framework, built from distinctions that Microsoft, Google, UiPath and Proskauer document. It is not a vendor rule.

A yes does not mean you owe a license. It tells you which clause to read. Run the test on each agent before a renewal, and save the three one-line answers with the contract.

The Agent Seat Test: three questions that point to the contract clause to read.

How to read it (TSL rule of thumb):

• 0 yes: treat the agent as an extension of a person, and confirm that person is licensed.
• 1 yes: read the vendor’s definition of “user” and its agent terms.
• 2 or 3 yes: review the contract as if the agent were its own user. Find its sponsor, the license behind its account, and the meter.

Why does the test ask three questions instead of one?

The test asks three questions because “is the agent a user?” hides three separate contract issues. Proskauer’s list of open questions maps onto them (TSL’s mapping, paraphrased):

The fourth issue Proskauer raises, how activity is measured and priced, is where the test points you next: the meter.

Vendors answer these three questions differently, and their own pages show how.

How do other vendors license AI agents?

TSL read each vendor’s own pricing, documentation or newsroom page on October 26, 2026. Secondary coverage was excluded, except one analyst report (Futurum) that quotes a Google representative.

*Disclosure: Anthropic makes Claude, an AI model TSL uses in its research workflow.

Salesforce and Atlassian also price some resolutions or conversations; the table counts each vendor’s primary unit. No audited page prices an agent as a seat. Microsoft says so outright, and Google and ServiceNow say nothing on the point.

The audit counts OpenAI and Anthropic with credits and units, so seven vendors sit in the middle row of the count table.

Twelve audited vendors, grouped by the unit that counts agent activity.

Why do buyers push back on agent pricing?

Buyers push back because several vendors stack a seat or plan fee on top of a meter. The audit shows six that do: Salesforce, OpenAI Business, Intercom, SAP, Anthropic and HubSpot.

Salesforce’s $5 user license, for example, requires Flex Credits to run. Anthropic’s seat fee includes no usage at all.

Gartner’s George Brocklehurst says agentic systems break the link between user growth and revenue growth for many vendors. So vendors have a reason to price agents as seats or meters, and buyers have a reason to ask which one they are paying. For TSL’s earlier takes on that debate, see Is SaaS dead? and the RenaiSaaS story.

Proskauer’s lawyers list what customers should ask for:

• confirmation that an agent acting only for a licensed user needs no extra seat
• caps or predictable pricing for agent usage
• clarity on whether seat and consumption charges apply cumulatively
• cure and true-up mechanisms before breach or termination
• transparency into how the vendor measures agent activity

Halfway point: the first six sections cover what vendors publish; sections 7 to 12 cover what a contract can do with it.

Vendors that count the work, not the seat, still carry older clauses that can trigger fees without a seat.

Why can an AI agent trigger license fees even without a seat?

The Diageo agreement did not define “use” or “access.” The judge read “use” as applying or manipulating the software, and “access” as gaining visibility of it or a connection to it.

SAP claimed £54,503,578 in additional fees. The court decided liability only and left the amount for a later hearing. So one undefined word in a 2004 contract exposed a 2012 integration to a claim above £54 million.

In SAP v Diageo, Salesforce-based apps reached SAP software through an integration engine; an AI agent could sit in the same place (TSL illustration).

How does multiplexing differ from an AI agent?

Multiplexing differs from an AI agent because an agent can fill three different roles, per Proskauer. It can act as:

• its own non-human principal
• a delegate of a licensed user
• a stand-in for several users at once

Those roles are the Agent Seat Test’s Identity and Audience questions, applied to a contract. Microsoft’s page adds that multiplexing applies only to access-based licensing, so metered and core-based models avoid it. If a vendor meters usage, the question moves to the meter, covered in section 9.

Example (TSL’s illustration, not a ruling).

An agent in a CRM reads order history from a licensed ERP for ten account managers. In Diageo, the court treated customers behind an interface as indirect users because the agreement licensed use or access by named individuals. Whether the same reasoning reaches an agent turns on each contract’s words, which is Proskauer’s point.

What does the RPA precedent show?

The RPA precedent shows vendors responding by counting output instead of users. SAP’s deck says Digital Access counts documents created through indirect access. Reads, updates and deletes are not counted.

SAP says this removes the need to count “users” and addresses concerns about devices and bots. The deck also says indirect access is growing because of devices, machine learning and AI.

Where an RPA bot or device uses SAP through another properly licensed SAP application, SAP’s deck says no additional ERP license is needed, provided the ERP is otherwise licensed. UiPath makes the same split from its side: an agent consumes no unattended-robot license.

These clauses apply when an agent touches software you license. The next risk is an agent using your login on software you do not.

Can your AI agent use your login on someone else’s software?

The Ninth Circuit’s ruling is narrower than the headlines. On August 4, 2026, Judge Milan D. Smith Jr., with Judges Tung and Hinderaker, vacated the preliminary injunction that had barred Perplexity’s Comet agent from Amazon.

The court held Amazon unlikely to succeed on the “access” prong of the federal Computer Fraud and Abuse Act (CFAA) and California’s parallel statute. Amazon petitioned for rehearing en banc on August 18, and the court denied it on September 10.

What did the Ninth Circuit decide, and what did it leave open?

The court decided who “accesses” Amazon when a user directs an AI agent, and it left the rest open. Jones Day reports the reasoning:

• The user directs the agent through their own browser.
• The agent sends screenshots to Perplexity’s servers and receives navigation instructions back.
• Perplexity’s servers never communicate directly with Amazon’s.
• The CFAA’s “whoever … accesses” wording contemplates a person, not a tool.

Jones Day calls it the first appellate decision on how computer-access statutes apply to agentic AI, and says the court limited its holding to the current record. Bloomberg Law reports the court stressed that its opinion did not “establish a new legal regime governing agentic AI.”

Ballard Spahr adds that the court left room for retailers to enforce their own website terms and pursue contract and tort claims. So the ruling answers a computer-fraud question and leaves the contract question to the platform.

The Comet and Muse patterns: a court looked at who accesses, while Amazon relied on its terms.

How do platforms respond to agents using a login?

Platforms respond through terms, blocks and sanctioned routes. Three of the four below tell agents to come through a controlled path:

Amazon’s spokesperson said third-party apps that make purchases for customers on other businesses’ sites should operate openly and respect those businesses’ decisions about participating. Amazon prohibits other companies from deploying automated shopping tools on its site, per the same report.

Slack’s terms add that a real-time search app’s use must be transparent to and reasonably expected by users, and that background scraping unrelated to user queries is prohibited. Workday’s tools run over the Model Context Protocol, and its Agent-Ready Tools for Data are in Early Access.

Example (TSL’s illustration, not a ruling).

Suppose an agent in your own browser reorders supplies from your own account. That is the Comet pattern, where the court looked at who accesses. Now suppose a third-party agent shops that same site for many customers.

That is closer to the Muse pattern, where the platform blocked the agent under its terms. The Agent Seat Test fits both: Identity (your delegated login) and Audience (one user or many) decide which clause to read.

Access rules decide whether an agent may run. The next question is what it costs once it does.

What does an AI agent really cost once it is running?

The same agent can appear on three invoices. Microsoft calls Agent 365 the control plane for managing AI agents.

Here, the control plane is the layer that registers, secures and governs agents. The work plane is the layer where agents do billable work. “Control plane” is Microsoft’s term; “work plane” is TSL’s.

For why vendors price this way, see TSL’s explainer on how AI companies decide pricing.

Bring-your-own-model setups, including Azure Foundry models, are billed separately from Copilot Credits.

There is one exception, and it follows the Agent Seat Test’s Identity question. Employee-facing agent usage is included when the user holds Microsoft 365 Copilot ($30 per user per month) and the agent operates under that user’s authenticated identity, within fair-usage limits. Microsoft’s billing rates page says Computer-Using Agents are not included.

What drives the work-plane bill?

Design and traffic drive the work-plane bill, according to Microsoft. Credits per feature:

• classic answer: 1
• generative answer: 2
• agent action: 5
• tenant graph grounding: 10
• agent flow actions: 13 per 100 actions

Example (Microsoft’s own billing examples; monthly figure is TSL arithmetic).

A website support agent averages four classic and two generative answers per customer, for 900 customers a day. That is [(4×1)+(2×2)] × 900 = 7,200 credits a day, about 216,000 over 30 days, or roughly $2,160 at $0.01 per credit.

Microsoft’s order-processing example, with four agent-action calls, is estimated at 20 credits a day. Microsoft’s two daily estimates sit 360 times apart on the same platform.

To forecast before you commit, see TSL’s framework for estimating what agentic AI costs.

One agent can appear on three Microsoft bills: governance, work and runtime.

What does the meter’s fine print say?

The fine print decides what happens at the limit and what happens to unused balance:

Three patterns show up:

• Balances expire on different clocks: monthly at Microsoft, per term at Salesforce, and 12 months at OpenAI Business and Atlassian.
• The limit behaves differently: disable, pause, stop organization-wide, bill on, or reconcile.
• Microsoft’s pay-as-you-go meter exists to avoid interruption.

Watch the denominator too. Microsoft’s AI-tool rates are per 10 responses, and its content-processing rate is per page. For the habits that keep a variable bill in check, see TSL’s guide to AI FinOps.

Which meters charge only for results?

Result-based meters charge when an agent completes the task. HubSpot says customers pay only when an agent completes its assigned task, at 50 credits per resolved conversation.

Workday meters most usage when a task completes in production and counts non-production tests in aggregate. TSL’s analysis of HubSpot’s $0.50 bet covers what that shift means for seat pricing.

Ask each vendor how it defines “resolved” or “completed,” because the vendor sets that definition.

Once the meter runs, the next question is who is responsible when the agent makes a mistake.

Who is responsible when an AI agent with its own identity makes a mistake?

An identity makes an agent traceable, not liable. Google’s post says every action goes to an audit trail attributed to the agent rather than a person.

Attribution answers “what acted,” and the vendors then name a human for “who answers.” For the wider governance picture, see TSL’s analysis of the AI agent governance gap.

Example (from Workday’s own description).

An autonomous agent tries an action that exceeds a spending limit or a regional policy rule. The platform routes the request to a human approval workflow or rolls the transaction back, and the log shows which agent identity acted. The person who delegated authority and the approver are the humans in that chain.

Responsibility settles on the sponsor, deployer and provider, not on the agent.

What does the EU AI Act say about agent responsibility?

The EU AI Act assigns duties to providers and deployers, and the dates matter. The Commission’s AI Act timeline, updated for the Digital Omnibus on AI, sets these milestones:

The amending regulation is Regulation (EU) 2026/1744 of July 8, 2026. EUR-Lex lists it as published July 24, 2026 and in force July 27, 2026.

Two articles bear on agents:

• Article 26 (deployers of high-risk systems, from Dec 2, 2027). Deployers must assign human oversight to natural persons with competence, training and authority. They monitor operation, keep logs for at least six months, and where they see a risk they inform the provider and the authority and suspend use. A serious incident must be reported immediately.
• Article 50(1) (providers, since Aug 2, 2026). Providers must design systems intended to interact directly with people so those people are told they are dealing with AI, unless that is obvious. The notice is due at the latest at first interaction.

TSL’s reading: an agent that writes to people from its own mailbox is the obvious case to check against Article 50(1). Whether a given agent is “intended to interact directly” with people is a classification question for its provider. For the compliance side, see TSL’s guide to enterprise SaaS AI compliance.

Who pays when an agent’s software is defective?

The new EU Product Liability Directive, Directive (EU) 2024/2853, applies to products placed on the Union market or put into service after December 9, 2026. It covers software, including AI systems. That regime sits on the vendor side, and your contract still decides how loss moves between you and your vendor.

For documented cases of AI systems acting outside their limits, see TSL’s roundup, AI went rogue 6 times.

Responsibility settles on people, so the practical question is what your contracts say before the next renewal.

What should you check in your contracts before your next renewal?

Proskauer’s lawyers warn that many agreements negotiated before agents became common define “user” and related metrics mainly for humans. So start with the wording, not the price list.

The 12-point checklist: run the Agent Seat Test first, then read the matching rows.

How does the Agent Seat Test map to the checklist?

The Agent Seat Test tells you which rows to read first for each agent (TSL’s mapping):

Example (hypothetical).

A team agent has its own mailbox, runs on a schedule and answers colleagues across two departments. It scores yes on all three questions, so rows 1 to 5, 8, 10, 11 and 12 all apply.

How do you start the review?

Start with the agents, then the contract:

1. Inventory every agent, including ones people connected themselves. TSL’s guide to auditing your SaaS stack for shadow AI shows how.
2. Run the Agent Seat Test on each one and write three one-line answers.
3. Read the matching rows against each vendor’s agreement and order form.
4. Ask for written answers. Proskauer advises that customers and providers address agent access expressly in the agreement, so surprises don’t become compliance events or unbudgeted fees.

Atlassian’s metering is one example of why timing matters: most meters bill from December 3, 2026.

What should a SaaS founder check when pricing agents?

A founder who sells software should check the provider-side list from Proskauer:

• whether each agent or service identity requires authorization
• limits on the number of agents associated with one human user
• usage by agents serving multiple users or external customers
• metering of API calls, transactions, tokens, workflows or completed outcomes
• audit rights covering non-human identities and automated access
• true-up mechanisms when agent usage raises consumption while human seats shrink

The audit in section 6 shows the range of answers vendors chose. For methods, see TSL’s guide to pricing research for SaaS founders.

Vendors are already changing how they count agents, so the last section looks at where that is heading.

Where is AI agent licensing heading next?

The direction comes from the vendors themselves. Workday’s blog says the traditional per-seat model is shifting toward a hybrid driven by consumption and outcomes.

Gartner says agentic systems break the link between user growth and revenue growth for many vendors. Proskauer adds that the market is experimenting with several approaches and has not converged on one.

Dated moves in AI agent licensing, with open pricing questions still ahead.

Six questions stay open in the sources reviewed:

What should you watch?

Watch for three kinds of signal, none of them predictions:

• Vendor documents. Published agent definitions, caps and meters from vendors that haven’t set them (Microsoft, Google, ServiceNow). Each is a new row for the checklist in section 11.
• Courts. A decision on a different factual record, or on a platform’s terms of service, since the Ninth Circuit left both open.
• EU milestones. The December 2026 and 2027 dates above, the Commission’s high-risk classification guidelines, and the first claims under the Product Liability Directive after December 9, 2026.

The Agent Seat Test stays useful through all of it, because identity, initiative and audience are the questions vendors, courts and regulators keep returning to.

The questions below cover the points readers ask most.

So, do AI agents need their own software license?

Not usually, in the documents audited. Microsoft licenses the person tied to an agent, and nine of twelve audited vendors meter the work or the outcome.

The exposure sits in contract words: use, access, sharing, meters and limits. Run the Agent Seat Test on each agent, read the twelve checklist rows against your agreements, and get written answers before renewal.

Read more in AI & Automation.