Skip to content
Talk to Us

Blocks.ai publishes this comparison and sells in this market. Every claim about another product links to a public source.

Cloudflare MCP server portals vs Microsoft Agent 365

Cloudflare MCP server portals

Cloudflare One feature that puts MCP servers behind one governed endpoint

Microsoft Agent 365

Microsoft 365 control plane to discover, manage, govern, and secure AI agents

Short answer

Cloudflare says its MCP server portals, part of Cloudflare One, put MCP servers behind one governed endpoint; Microsoft Agent 365 is a Microsoft 365 control plane for AI agents.⁠Source 1, Source 2, Source 3, Source 4 Portals govern the MCP servers and tools reached through them; Agent 365 keeps an agent registry, uses Entra agent identities, and is licensed per user.⁠Source 2, Source 3, Source 5, Source 6, Source 7

By Blocks.ai teamLast checked

Where each one sits

Six layers of running AI agents at a company, and what each product’s own public sources say it covers.

These aren’t the same kind of product

Where they overlap
Both control which tools agents can use and log that use: portals for tools reached through them, Agent 365 tenant-wide, with activity shown in Microsoft Purview.⁠Source 2, Source 4, Source 8, Source 9, Source 10
Where they differ
Agent 365 keeps a registry of agents and uses Microsoft Entra agent identities.⁠Source 5, Source 6 Portals register MCP servers; a registry of agents is not publicly documented.⁠Source 2
Running both
Neither vendor publicly documents using the two together. Microsoft says the Agent 365 SDK works with agents on Azure, AWS, Google Cloud, or on premises; portals accept remote MCP clients.⁠Source 2, Source 10
Public sources · checked 2 October 2026
  • Offered
  • Preview
  • Not included
  • Not publicly documented

Cloudflare MCP server portals

  • Build agents: Not publicly documented
  • Host and run agents: Not publicly documented
  • Identity and access: OfferedIdentity provider or service token⁠Source 2
  • Registry and governance: OfferedCentrally managed MCP servers⁠Source 2
  • Traffic between agents, tools, and models: OfferedProxy for MCP tool calls⁠Source 2
  • Agents across organizations: Not publicly documented

Microsoft Agent 365

  • Build agents: Not includedUse your chosen framework⁠Source 10
  • Host and run agents: Not includedYou host your agent⁠Source 11
  • Identity and access: OfferedEntra Agent ID⁠Source 6
  • Registry and governance: OfferedAgent registry in admin center⁠Source 5
  • Traffic between agents, tools, and models: PreviewTooling Gateway for MCP servers⁠Source 12
  • Agents across organizations: Not publicly documented

At a glance

TopicCloudflare MCP server portalsMicrosoft Agent 365
What it governsMCP servers and their tools, up to 80 servers per portal.⁠Source 2 A registry of agents is not publicly documented.Agents: one registry of Microsoft and non-Microsoft agents in the Microsoft 365 admin center, plus tenant-wide control of the tools agents can access.⁠Source 4, Source 5, Source 13
Agent identityThe user’s identity provider login through Cloudflare Access, or an Access service token for autonomous agents.⁠Source 2, Source 8Agent identities live in Microsoft Entra Agent ID; the inventory also lists agents without one.⁠Source 6, Source 13
Agents it works withMCP clients that support remote MCP servers, such as Claude Desktop and Windsurf, connect to the portal’s HTTPS URL.⁠Source 2Microsoft and third-party agents, wherever they run, such as Azure, AWS, Google Cloud, or on premises.⁠Source 4, Source 11 Premium capabilities may vary by agent type and platform.⁠Source 7
Pricing modelCloudflare says MCP server portals are available to all Cloudflare customers.⁠Source 14 A separate price for portals is not publicly documented.Lists at $15 per user per month, or in Microsoft 365 E7.⁠Source 7 Basic identity and inventory come with Microsoft Cloud subscriptions; enterprise customers need Microsoft 365 E5, or E3 with the Defender and Purview suites.⁠Source 7
Generally availableSince 24 September 2026, after an open beta announced in August 2025.⁠Source 14, Source 15Since 1 May 2026, for the Commercial segment.⁠Source 16

What each one is

Cloudflare MCP server portals

Cloudflare says MCP server portals are part of Cloudflare One, its SASE platform.⁠Source 1 A portal centralizes multiple MCP servers on one HTTP endpoint and proxies each tool call.⁠Source 2 Cloudflare Access policies decide who can connect to it, and Access logs each tool request.⁠Source 2

Microsoft Agent 365

Microsoft Agent 365 is a Microsoft 365 service that provides a centralized control plane to discover, manage, govern, and secure AI agents.⁠Source 4 Admins can work across its agent registry in the Microsoft 365 admin center, Microsoft Entra for agent identity, and Microsoft Purview.⁠Source 6, Source 16

The differences that matter

  1. What gets registered

    Cloudflare MCP server portals

    MCP servers and their tools: admins add servers to Access and choose which tools and prompt templates each portal exposes.⁠Source 2

    Microsoft Agent 365

    Agents: the registry lists Microsoft and non-Microsoft agents, and agent identities live in Microsoft Entra Agent ID.⁠Source 6, Source 13

    Agent 365 can also control which tools agents can access tenant-wide, and registering your own MCP servers with it is in preview.⁠Source 4, Source 12

  2. How agents are identified

    Cloudflare MCP server portals

    Through the user’s identity provider login in Cloudflare Access; autonomous agents can use an Access service token instead.⁠Source 2, Source 8

    Microsoft Agent 365

    Each agent identity is a Microsoft Entra service principal, managed with Conditional Access, permission grants, consent, and lifecycle operations.⁠Source 6

    Service token sessions can’t use per-user OAuth with upstream servers; the portal uses the admin credential for every upstream request they make.⁠Source 2

  3. Where policy is enforced

    Cloudflare MCP server portals

    At the portal, which attaches credentials and proxies each tool call; Access policies decide who can connect to it.⁠Source 2

    Microsoft Agent 365

    Through Microsoft 365 and Entra controls: organization-wide blocks, policy templates, and Conditional Access on agent identities.⁠Source 6, Source 17, Source 18

    Portals can reach MCP servers on a private network through Cloudflare Tunnel, with Gateway routing on.⁠Source 2, Source 19 Agent 365’s bring-your-own MCP servers, in preview, need a publicly accessible endpoint.⁠Source 12

For security teams

What a security review asks, answered from each vendor’s public documentation.

TopicCloudflare MCP server portalsMicrosoft Agent 365
Network exposureClients reach the portal’s HTTPS URL.⁠Source 2 Private servers join via outbound-only Cloudflare Tunnel, with Gateway routing on.⁠Source 2, Source 20Notifications (preview) need a messaging endpoint Agent 365 sends to.⁠Source 21 Agent 365’s private networking is not publicly documented.
IdentityAccess sign-in through your identity provider, or an Access service token for agents.⁠Source 2, Source 8 Independent MFA isn’t enforced for portal-authorized servers.⁠Source 2Agent identities are Microsoft Entra service principals, managed with Conditional Access and consent; the inventory also lists agents without one.⁠Source 6, Source 13
Access changes and revocationDeleting a service token revokes it.⁠Source 22 Blocked users can use a server’s direct URL; Cloudflare advises Access as OAuth provider.⁠Source 2Block agents organization-wide (Copilot Chat only for SharePoint and Foundry agents), or disable an Entra blueprint’s agents in one operation.⁠Source 6, Source 17
Audit trailAccess logs each request made with a portal’s tools.⁠Source 2 Logpush export to a SIEM is on Enterprise plans only.⁠Source 2Purview audit logs of agent activities need E7 or an Agent 365 license.⁠Source 4 Observability data is kept 30 days.⁠Source 9
ComplianceSuper Administrators can get Cloudflare’s PCI, SOC 2, and ISO documents.⁠Source 23 Their scope for portals is not publicly documented.Microsoft says it meets FedRAMP High controls its assessor reviewed, with authorization pending (announced).⁠Source 4 Not yet a Core Online Service.⁠Source 9

Full comparison

18 criteria in five groups. Every cell links to its source, or says no public source answers it.

Cloudflare MCP server portals and Microsoft Agent 365 compared on 18 criteria
Cloudflare MCP server portalsMicrosoft Agent 365
What it is
What it is and who it’s forCloudflare says portals are part of Cloudflare One, its SASE platform.⁠Source 1 A portal puts multiple MCP servers behind one HTTP endpoint, governed through Access.⁠Source 2, Source 3A Microsoft 365 service that provides a centralized control plane to discover, manage, govern, and secure AI agents, for IT and security leaders.⁠Source 4, Source 24
MaturityGA since 24 September 2026, after an open beta announced 26 August 2025.⁠Source 14, Source 15 Previously called Agents Gateway in some contexts.⁠Source 2Generally available since 1 May 2026 for the Commercial segment.⁠Source 16 Registry sync and multi-tenant management are in preview.⁠Source 25, Source 26
Control
Agent registry and discoveryAdmins add third-party and internal MCP servers to Cloudflare Access, up to 80 per portal.⁠Source 2, Source 3 A registry of agents is not publicly documented.Agent registry in the Microsoft 365 admin center: one inventory of Microsoft and non-Microsoft agents, including agents without an Entra agent identity.⁠Source 5, Source 13
Identity and access controlSign-in through Access with an identity provider, or an Access service token for agents.⁠Source 2, Source 8 Policies can match emails, groups, country, and device posture.⁠Source 2Agent identities live in Microsoft Entra Agent ID, managed with Conditional Access, permission grants, and consent.⁠Source 6 The inventory also lists agents without one.⁠Source 13
Ownership, policy, and revocationAdmins pick each portal’s tools and prompt templates; turned-off tools can’t be called through it.⁠Source 2 Only users an Allow policy matches see a server in a portal.⁠Source 2A required sponsor per Entra agent identity, organization-wide block, 30-day soft delete, and new owners for shared Agent Builder and Copilot Studio agents.⁠Source 6, Source 17
Audit log and observabilityAccess logs each tool request, viewable per portal or per server.⁠Source 2 Logpush exports, on Enterprise plans only, record the user’s email and tool called.⁠Source 2, Source 27Purview audit logs and eDiscovery of agent activities need E7 or Agent 365; not in GCC.⁠Source 4 Observability data appears in Defender and Purview, kept 30 days.⁠Source 9, Source 10
Connection
How agents connectMCP clients connect to the portal’s HTTPS URL, and it proxies each tool call.⁠Source 2 Private servers join via Cloudflare Tunnel, with Gateway routing on.⁠Source 2, Source 19The SDK works with agents on Azure, AWS, Google Cloud, or on premises.⁠Source 10 Notifications, in preview, need a messaging endpoint URL that Agent 365 sends to.⁠Source 21
Agents across organizationsCloudflare One can use several identity providers at once, for partners or contractors.⁠Source 28 Federating other organizations’ agents is not publicly documented.Partners’ published agents can join a tenant.⁠Source 6, Source 29 Agents in Microsoft’s separate Foundry and Copilot Studio can call A2A agents; Foundry’s can take A2A calls.⁠Source 30, Source 31, Source 32
Protocol supportStateless MCP 2026-07-28 and earlier 2025 Streamable HTTP clients and servers; upstream over Streamable HTTP or SSE.⁠Source 2 A2A support: not publicly documented.Tenant-wide tool control; your own MCP servers in preview.⁠Source 4, Source 12 A2A is documented for Microsoft’s separate Foundry and Copilot Studio, not Agent 365.⁠Source 30, Source 31
Frameworks, models, and clouds supportedWorks with MCP clients that support remote servers.⁠Source 2 Stdio-only servers can’t be added, and some servers reject proxy-based clients like portals.⁠Source 2Microsoft and third-party agents.⁠Source 4 SDK docs name frameworks such as LangChain, CrewAI, and the OpenAI Agents SDK, and agents keep their own host.⁠Source 11, Source 25
Operations
Deployment options and data residencyA portal’s hostname is a proxied CNAME record pointing to gateway.agents.cloudflare.com.⁠Source 2 Self-hosting a portal is not publicly documented.Honors the EU Data Boundary; the observability service stores customer content in the tenant’s default geography.⁠Source 9 Self-hosting it is not publicly documented.
Compliance attestationsCompany-wide, Super Administrators can get PCI, SOC 2, ISO, and other documents in the dashboard.⁠Source 23 Portal-specific scope is not publicly documented.Microsoft says Agent 365 meets all FedRAMP High controls its assessor reviewed, with authorization pending (announced).⁠Source 4 Not yet a Core Online Service.⁠Source 9
Support and SLASupport options vary by Zero Trust plan; professional services are Contract add-ons.⁠Source 33 Cloudflare advertises SLAs for paid Zero Trust plans with 100% uptime.⁠Source 33No specific SLA for the Frontier preview program.⁠Source 34 An SLA or support plan specific to the generally available service is not publicly documented.
Time and effort to get runningNeeds a domain on Cloudflare and an identity provider in Zero Trust.⁠Source 2 Then add MCP servers, create a portal with tools and policies, and connect clients.⁠Source 2Enterprise customers need Microsoft 365 E5, or E3 with Defender Suite and Purview Suite, and at least one user with an Agent 365 license.⁠Source 7, Source 16
Pricing model and public pricesCloudflare says MCP server portals are available to all Cloudflare customers.⁠Source 14 A separate price for portals is not publicly documented.Per user, not per agent: lists at $15 a month standalone, or in Microsoft 365 E7.⁠Source 7 Microsoft Cloud subscribers get foundational capabilities at no extra cost.⁠Source 7
Building
Agent building toolsSeparately from portals, Cloudflare’s Agents docs cover building and hosting agents on Cloudflare, and remote MCP servers can be built on Workers.⁠Source 3, Source 35Microsoft says the Agent 365 SDK isn’t an agent-building framework.⁠Source 10 For low-code building, the docs point to Microsoft’s separate Copilot Studio.⁠Source 36
Model accessNot publicly documented for portals. Cloudflare says its separate AI Gateway manages model traffic across AI providers.⁠Source 37Microsoft says the SDK doesn’t call or select models; the agent keeps making its own model calls.⁠Source 10, Source 11
Integrations and ecosystemPortals can be managed with Terraform.⁠Source 2 On Enterprise plans, Logpush can send logs to storage or SIEM tools.⁠Source 2 An MCP server marketplace: not publicly documented.Microsoft says it launched with partner agents and agents built on partner agent factories.⁠Source 29, Source 38 Work IQ MCP tools for Mail, Teams, and more are in preview.⁠Source 39

Which to choose

Choose Cloudflare MCP server portals if

  • You use Cloudflare One, which Cloudflare says includes portals, and want many MCP servers behind one endpoint for clients like Claude Desktop.⁠Source 1, Source 2
  • You want Access policies on portal use, matching emails, groups, country, and device posture, plus per-portal control of which tools appear.⁠Source 2
  • Your MCP servers sit on a private network: portals reach them through Cloudflare Tunnel or another connector, with Gateway routing on.⁠Source 2, Source 19
  • You want each tool request logged, viewable per portal or per server, and exportable to a SIEM on Enterprise plans.⁠Source 2

Choose Microsoft Agent 365 if

  • You build agents in Microsoft’s separate Copilot Studio or Foundry, which Microsoft says can provide built-in Agent 365 integration for some scenarios.⁠Source 25, Source 40
  • You want one registry of your Microsoft and non-Microsoft agents, with a required sponsor for each Entra agent identity.⁠Source 6, Source 13
  • You want agent identities in Entra, managed with the same Conditional Access, consent, and lifecycle controls as the rest of your tenant.⁠Source 6
  • You want activity from supported agents to show up in Defender, Purview, and the Microsoft 365 admin center.⁠Source 9, Source 10

Questions buyers ask

Does either one keep a registry of agents?

Agent 365 does: its registry in the Microsoft 365 admin center lists Microsoft and non-Microsoft agents, including agents without an Entra agent identity.⁠Source 5, Source 13 Portals list MCP servers and their tools; a registry of agents is not publicly documented.⁠Source 2

Do they support MCP and A2A?

Portals support MCP, including stateless MCP 2026-07-28; A2A support is not publicly documented.⁠Source 2 Agent 365 can control tool access tenant-wide, including Microsoft MCP servers; registering your own is in preview.⁠Source 4, Source 12 A2A is documented for Microsoft’s separate Foundry and Copilot Studio, not Agent 365 itself.⁠Source 30, Source 31

Which identity providers do they work with?

Portals sign users in through Cloudflare Access; Cloudflare One supports all SAML and OIDC providers and most OAuth providers, several at once.⁠Source 2, Source 28 Agent 365 agent identities live in Entra; agents can authenticate users with Entra ID, which can federate to another provider.⁠Source 6, Source 41

How is each one priced?

Cloudflare says MCP server portals are available to all Cloudflare customers.⁠Source 14 A separate price for portals is not publicly documented. Agent 365 is licensed per user, listing at $15 a month standalone, or comes in Microsoft 365 E7.⁠Source 7

How we compare

Read the full method

Every claim on this page links to a public source. Where none answers a question, the page says so.

We re-check every fact at least every 90 days. This page was last checked .

Something wrong or out of date? Tell us and we’ll correct it.

Sources

46 public sources, each with the date we checked it. Every one opens in a new tab.

  1. Source 1: Securing the AI Revolution: Introducing Cloudflare MCP Server Portals Cloudflare · checked Back:abcd

  2. Source 2: MCP server portals · Cloudflare One docs Cloudflare · checked Back:abcdefghijklmnopqrstuvwxyz27282930313233343536373839404142434445464748495051

  3. Source 3: MCP governance · Cloudflare Agents docs Cloudflare · checked Back:abcde

  4. Source 4: Microsoft Agent 365 - Service Descriptions | Microsoft Learn Microsoft · checked Back:abcdefghijklmn

  5. Source 5: Agent Registry in Microsoft 365 admin center - Microsoft 365 admin | Microsoft Learn Microsoft · checked Back:abcdef

  6. Source 6: Agent 365 identity | Microsoft Learn Microsoft · checked Back:abcdefghijklmnop

  7. Source 7: Licensing Documents Microsoft · checked Back:abcdefgh

  8. Source 8: Service token support for MCP server portals · Changelog Cloudflare · checked Back:abcde

  9. Source 9: Data handling, data residency, and compliance in Agent 365 observability | Microsoft Learn Microsoft · checked Back:abcdefg

  10. Source 10: Agent 365 SDK frequently asked questions | Microsoft Learn Microsoft · checked Back:abcdefgh

  11. Source 11: Microsoft Agent 365 SDK overview | Microsoft Learn Microsoft · checked Back:abcd

  12. Source 12: Bring your own (BYO) MCP server in Microsoft 365 admin center - Microsoft 365 admin | Microsoft Learn Microsoft · checked Back:abcde

  13. Source 13: Agent Registry convergence with Microsoft Agent 365 | Microsoft Learn Microsoft · checked Back:abcdefgh

  14. Source 14: MCP server portals are now generally available · Changelog Cloudflare · checked Back:abcde

  15. Source 15: MCP server portals · Changelog Cloudflare · checked Back:ab

  16. Source 16: Microsoft Agent 365 overview | Microsoft Learn Microsoft · checked Back:abcd

  17. Source 17: Governance and Lifecycle actions for agents available in Microsoft 365 admin center - Microsoft 365 admin | Microsoft Learn Microsoft · checked Back:abc

  18. Source 18: Policy templates | Microsoft Learn Microsoft · checked Back to text

  19. Source 19: Private MCP server support for MCP server portals · Changelog Cloudflare · checked Back:abc

  20. Source 20: Cloudflare Tunnel · Cloudflare One docs Cloudflare · checked Back to text

  21. Source 21: Agent Messaging Endpoint | Microsoft Learn Microsoft · checked Back:ab

  22. Source 22: Service tokens · Cloudflare One docs Cloudflare · checked Back to text

  23. Source 23: Compliance documentation · Cloudflare Fundamentals docs Cloudflare · checked Back:ab

  24. Source 24: Microsoft Agent 365: The Control Plane for Agents Microsoft · checked Back to text

  25. Source 25: Choose an Agent 365 Integration Option | Microsoft Learn Microsoft · checked Back:abc

  26. Source 26: Manage agents across multiple tenants in the Microsoft 365 admin center - Microsoft 365 admin | Microsoft Learn Microsoft · checked Back to text

  27. Source 27: MCP Portal Logs · Cloudflare Logs docs Cloudflare · checked Back to text

  28. Source 28: Identity providers · Cloudflare One docs Cloudflare · checked Back:ab

  29. Source 29: Ecosystem partner agents available in Agent 365 | Microsoft Learn Microsoft · checked Back:ab

  30. Source 30: Connect to an agent over the Agent2Agent (A2A) protocol - Microsoft Copilot Studio | Microsoft Learn Microsoft · checked Back:abc

  31. Source 31: Connect to an A2A agent endpoint from Foundry Agent Service - Microsoft Foundry | Microsoft Learn Microsoft · checked Back:abc

  32. Source 32: Enable incoming A2A on a Foundry agent - Microsoft Foundry | Microsoft Learn Microsoft · checked Back to text

  33. Source 33: Cloudflare Access | Zero Trust Network Access (ZTNA) Cloudflare · checked Back:ab

  34. Source 34: Preview Agent 365 features through the Frontier program | Microsoft Learn Microsoft · checked Back to text

  35. Source 35: Build Agents on Cloudflare · Cloudflare Agents docs Cloudflare · checked Back to text

  36. Source 36: Get started with Microsoft Agent 365 | Microsoft Learn Microsoft · checked Back to text

  37. Source 37: AI Security | Cloudflare Cloudflare · checked Back to text

  38. Source 38: Microsoft Agent 365, now generally available, expands capabilities and integrations | Microsoft Security Blog Microsoft · checked Back to text

  39. Source 39: Connect existing agents to Microsoft Agent 365 | Microsoft Learn Microsoft · checked Back to text

  40. Source 40: What is Microsoft Foundry? - Microsoft Foundry | Microsoft Learn Microsoft · checked Back to text

  41. Source 41: Integrate Microsoft Entra Agent ID with third-party identity providers | Microsoft Learn Microsoft · checked Back to text

  42. Source 42: Your company's private network Blocks.ai · checked Back to text

  43. Source 43: Network requirements Blocks.ai · checked Back to text

  44. Source 44: Solutions: Agent sprawl Blocks.ai · checked Back to text

  45. Source 45: Solutions: Partner networks Blocks.ai · checked Back to text

  46. Source 46: Pricing Blocks.ai · checked Back to text