Surya Agent Platform · Built on Microsoft
Your people. Your agents. A foundation ready for both.
Put your business knowledge to work through agents on a secure, operated Microsoft foundation. Surya establishes identity, approved data access, environments and controls. Your people build the functions, or Surya builds them with you, or any split in between. The business decisions stay yours.
For healthcare and manufacturing organizations, including their administrative and regulated operations, that want agents for their own functions, built by their people, by Surya with them, or any split in between, on the Microsoft tools they already trust.
Your Microsoft tenant stays yours: your administrators keep ownership and can revoke Surya's access.
Your agents
Owned by you
Business agents and workflows
Surya Agent Platform
Operated by Surya
Microsoft agent foundation
- Identity and access
- Approved data and connections
- Build, test and live environments
- Release, telemetry and cost controls
In your Microsoft tenant · Copilot, Copilot Studio, Power Platform, Entra, SharePoint, Purview where licensed
Physical foundation
Optional for Agent Platform
Devices, sites and equipment
Or your existing equivalent environment
/ The stack
One stack.
Each one can be bought directly and works with what you already run.
Standby, Endpoint and Fabric together are Surya Foundation →/ Part one
Meet your operating team.
Inside each product, named agents take the routine work on the approved list and Surya engineers take the exceptions, around the clock. Beside them are the functions you build for your own business, on the same floor. The names are defaults; during setup we tune them with you: how they speak, what they are called, where they hand off to a person.
Choose the job you need done. Your quote identifies the Surya products, site equipment and permissions required to deliver it.
Get failed equipment replaced
Mara
The swap
Watches every workstation, line PC and edge box across your plants. When one is failing she has the replacement already in the locker and tells the line lead which slot to open. She does the swap paperwork, the return and the custody record.
- Takes off your team:
- Chasing a replacement: dispatch, handover and the custody record.
- Alone:
- the whole swap.
- To a person:
- anything that needs hands on the line.
- What you buy:
- Surya Endpoint for the workstations in scope.
- Delivered through:
- Surya Endpoint, with Surya Standby included. Standby prepared recovery and Surya Control are included within the agreed workstation profile, not bought again.
Scope Mara →Before it starts
The workstation profile, sites and replacement stock are agreed in the quote. Where physical recovery is included, replacements are held in a Surya-operated smart locker.
Your named owner approves consequential changes. Anything that needs hands on the line goes to a person.
Need only prepared replacements for the configurations you run today? Surya Standby can be bought on its own for that. It does not include the monitoring, identity or workstation operation.
Get people ready to work
Dale
The door
HR says someone starts Monday; Dale has the laptop built to the plant standard, the account live, and the badge scoped before Friday. When someone leaves he collects, revokes and closes it out the same day.
- Takes off your team:
- The setup steps for each new starter and leaver, with access approved by your people.
- Alone:
- every joiner and leaver.
- To a person:
- a manager who has not confirmed the request.
- What you buy:
- Supported Surya Endpoint scope for joiners and leavers.
- Delivered through:
- Surya Endpoint.
Scope Dale →Before it starts
Supported licenses, the role catalogue and access prerequisites are confirmed in the quote.
You approve access and consequential actions. An unconfirmed request waits for a person.
Keep sites connected
Ruth
The network
Holds the standard on the switches, access points and firewall at each plant. When a switch dies the spare is already on the shelf at that site; she stages it, a technician swaps it, she confirms it is back on standard.
- Takes off your team:
- Watching site network health and opening the right fix.
- Alone:
- monitoring, configuration, spares.
- To a person:
- the physical swap.
- What you buy:
- Surya Fabric for the site network in scope.
- Delivered through:
- Surya Fabric, with Surya Standby included. Prepared network spares and Surya Control are included within its agreed scope, not bought again.
Scope Ruth →Before it starts
Physical swap ownership and site readiness are agreed in the quote. Spares can sit in an existing secure room or cage with the agreed custody tracking.
A person does the physical swap. Ruth stages the spare and confirms the network is back on standard.
Control access to the production network
Sol
The floor boundary
Sees what is on the OT network and makes sure nothing from the office side reaches the PLCs and HMIs. Produces the inventory of controllers and the evidence an auditor asks for.
- Takes off your team:
- Routine checks on production network access requests; your plant team approves every change.
- Alone:
- visibility and the report.
- To a person:
- anything that would touch a controller.
- What you buy:
- Surya Fabric with the purchased OT and CPS scope.
- Delivered through:
- Surya Fabric with OT and CPS security. Enforcement applies on the network Surya operates.
Scope Sol →Before it starts
Sites and OT scope are confirmed in the quote.
Your plant team keeps production controls and control logic. Anything that would touch a controller goes to a person.
Claroty OT and CPS visibility, licensing and deployment can instead be bought on its own as a separate purchase.
Keep routine IT moving after hours
Wes
The night shift
Takes every after-hours message in Teams, fixes what the approved list can fix, and has the rest in front of a Surya engineer before first shift.
- Takes off your team:
- Routine after-hours requests on the approved list, so on-call people take only exceptions.
- Alone:
- resets, slow-PC fixes, the known list.
- To a person:
- everything else, by 6am.
- What you buy:
- Supported Surya Endpoint scope for after-hours requests.
- Delivered through:
- Surya Endpoint.
Scope Wes →Before it starts
Supported licenses, the role catalogue and access prerequisites are confirmed in the quote.
Night work is limited to approved operations. Everything else goes to a Surya engineer and your named owner.
Built with you
Shift handover
Reads the shift log and each line's open issues before the shift turns over. It writes the handover note and puts it in front of the incoming supervisor in Teams, so nobody starts the shift guessing.
- Takes off your team:
- Writing the handover note at the end of every shift.
- Alone:
- reading the log and drafting the note.
- To a person:
- the outgoing supervisor, who checks and sends it.
- What you buy:
- Surya Agent Platform
- Before it starts:
- Your systems, permissions and approvals are confirmed in the quote.
You build this one
Maintenance request
Takes an operator's message in Teams, opens the work order in your maintenance system and follows it until it is closed. When a request sits too long, it tells the maintenance lead.
- Takes off your team:
- Retyping requests into work orders and chasing them.
- Alone:
- opening and tracking the work order.
- To a person:
- setting priority and doing the repair.
- What you buy:
- Surya Agent Platform
- Before it starts:
- Your systems, permissions and approvals are confirmed in the quote.
You build this one
Quality hold
Watches for a hold being placed. It pulls the batch record, tells the people on the hold list and drafts the disposition packet in SharePoint.
- Takes off your team:
- Gathering the paperwork for every hold.
- Alone:
- the pull, the notices, the draft.
- To a person:
- the disposition, which a person signs.
- What you buy:
- Surya Agent Platform
- Before it starts:
- Your systems, permissions and approvals are confirmed in the quote.
You build this one
Supplier documents
Watches which certificates of analysis and safety data sheets are missing or due. It chases suppliers by email and files what comes back where the auditor looks.
- Takes off your team:
- Chasing supplier paperwork before an audit.
- Alone:
- the chasing and the filing.
- To a person:
- a supplier who does not answer, or a document that does not match.
- What you buy:
- Surya Agent Platform
- Before it starts:
- Your systems, permissions and approvals are confirmed in the quote.
One intake conversation sets how they speak. A plant talks in shifts and lines. A clinic talks in rooms and providers and never names a patient. That tuning is done with you, not handed to you.
Every agent on this roster, Surya's hires and the functions you build alike, runs under identities in your own Microsoft 365 tenant that your administrator can see, audit and revoke, and under Surya Control: routine work on the approved list, consequential changes only with your named owner.
Hires that share a product share one purchase, and recovery already included in Endpoint or Fabric scope is not a second purchase. Choosing hires is an enquiry, not an order: qualification confirms the supported scope.
Surya Agent Platform can be bought on its own. Every agent on it, Surya's and yours, runs under identities in your own Microsoft 365 tenant that your administrator can see, audit and revoke, and under Surya Control.
What stands behind them.
An agent that can only send a message is a chatbot. These agents finish the job because Surya's people stand behind every one of them and, where it is in scope, three physical things do too.
01
Surya engineers on shift 24/7.
Engineers on shift around the clock, 365 days a year, take what an agent should not. Each agent hands off to a person at the points shown on its card.
How it works →02
The supply chain at the Surya RTP Distribution Center.
Your replacement devices and site equipment are built to your standard, stocked, shipped and replenished from one building in Research Triangle Park. When Mara says the replacement is ready, it is because a person at RTP already built it and put it on a truck.
How it works →03
Prepared replacements at your sites.
Where Standby covers workstation recovery, replacements are held in a Surya-operated smart locker, every slot tracked. Qualified network and site spares can sit in an existing secure room or cage with the agreed custody tracking. A network-only scope, an Endpoint profile without physical recovery and Agent Platform alone need no locker.
How it works →04
Dedicated agentic compute at RTP.
Your hires run on hardware assigned to your organization alone, in the Surya RTP Distribution Center. Not shared with another customer. Every action logged off the hardware within seconds. Switched off from your own tenant, by you.
How it works →
The agents are how the work gets done. Surya's people, the building, the prepared replacements and the hardware are why it gets finished.
/ Part two
Your own agents
Bought on its own, Surya Agent Platform is the Microsoft foundation for your own agents. Surya sets up the harness in your own Microsoft 365 tenant and governs it: identities, access, the approval path before an agent reaches users, lifecycle and evidence. Your people build the functions in Microsoft's own tools, or Surya builds them with you, or any split in between.
Who builds a function is open. The business decisions stay yours either way.
Surya Agent Platform can be bought on its own. Every agent on it, Surya's and yours, runs under identities in your own Microsoft 365 tenant that your administrator can see, audit and revoke, and under Surya Control.
/ The product
What you are buying
A configured environment in your own Microsoft tenant, with Surya responsible for operating the agreed platform baseline.
A configured environment
Identity, permissions, approved knowledge, connections and separated build, test and live environments, set up to a written baseline in your tenant.
An operating responsibility
Surya keeps the contracted baseline working: access reviews, platform changes, available telemetry, capacity and spend visibility, and escalation to Microsoft.
A team ready to build
Your administrators and makers are onboarded with runbooks and a validated reference scenario, so they can build the agents your business needs.
/ What's included
Six workstreams. Each with outputs you can check.
Quantities and entitlements for each workstream are set in your written schedule before work starts.
01
Supported environment and licensing baseline
We inventory your tenant and licenses, confirm a supported Microsoft commercial-cloud profile and agree which Microsoft 365 Copilot, Copilot Studio and Power Platform capabilities are in scope.
You receive
- Tenant and license inventory
- Agreed capability list
- Roles, capacity and billing ownership recorded
- Your tenant ownership and admin revocation confirmed
02
Identity and permissions
Maker, operator and user groups, approved admin access and agent or connection identities using supported options, all on least privilege.
You receive
- Group and role design you approve
- Approved admin access
- Agent and connection identities
- Tested access denial
03
Data and connection readiness
Named, approved SharePoint and Teams knowledge locations and supported connectors, with scoped permission and oversharing corrections for those locations.
You receive
- Named knowledge locations and connectors
- Scoped permission corrections
- A named data owner for each location
- Retention and data-policy controls where licensed
Scoped to the named locations. Not estate-wide cleanup, file migration or content curation.
04
Build, test and live foundation
Separated development, test and production environments for the supported workloads, with a solution and configuration lifecycle and clear release ownership.
You receive
- Dev, test and production environments
- Solution and configuration lifecycle
- Documented release approvals
- Repeatable configuration record
Promotion support varies by agent type and Microsoft capability; it is recorded for each workload.
05
Operability
An inventory of in-scope agents and their owners, the Microsoft platform telemetry and alerts available for them, and a defined path for incidents and vendor escalation.
You receive
- Agent and owner inventory
- Available telemetry and agreed alerts
- Capacity and spend visibility
- Incident, vendor escalation and change review
Spend alerts are not a hard spending cap, and custom agents expose only the telemetry they emit.
06
Team enablement and acceptance
Bounded onboarding sessions for your administrators and makers, runbooks and knowledge handover, plus a repeatable validation agent run in test.
You receive
- Admin and maker onboarding sessions
- Runbooks and knowledge handover
- Validation agent in a non-production environment
- Acceptance evidence pack
The validation agent proves the platform. It is not your business workflow or a library of prebuilt production agents.
/ Built on Microsoft
The Microsoft stack, and what each part does here.
Azure services and custom engineering are available only through separately validated scope. Copilot and agent capabilities need the appropriate Microsoft licenses or capacity; an existing Microsoft 365 plan does not include all of them, and feature and connector availability varies by cloud.
- Microsoft 365 Copilot
- The licensed employee experience for people who have it.
- Copilot Studio and Power Platform
- Where supported agents and automation are built, by your people or by Surya with you.
- Microsoft Entra
- Who and what can access each agent, connection and environment.
- SharePoint
- The approved knowledge your agents may use.
- Microsoft Purview
- Retention, labeling and data-policy controls, where licensed.
/ From first year to ongoing operation
Establish it in year one. Keep it ready as you grow.
Two defined phases for the same agreed footprint. Both scopes and fees are agreed in writing before work starts.
Year one
Establishment and enablement
A 12-month phase that establishes the foundation, readies permissions and data, enables your team and stabilizes operation.
- The six workstreams delivered to the written schedule
- Onboarding sessions and runbooks
- Validation agent and acceptance evidence
- Monthly platform review
- Operation of the baseline from the day it goes live
Ongoing
Steady-state platform operation
A separately defined phase, at a lower fee, that keeps the same footprint current and ready as Microsoft and your team move forward.
- Configuration and change control for the baseline
- Access and permission reviews
- Platform incident handling and Microsoft escalation
- Capacity and spend oversight
- Quarterly owner review
The move to ongoing operation follows agreed acceptance and stabilization. If prerequisites are delayed, we replan together; there is no automatic extension or extra charge unless both sides agree.
Microsoft licenses, usage and credits, third-party products and any expansion are itemized separately. Pricing is set in your written proposal.
/ Responsibilities
Who owns what.
Microsoft
The software, cloud services, models and product capabilities, under your Microsoft agreements.
Surya
Configures and operates the contracted baseline: identity, approved data and connections, environments, release process, available telemetry and spend visibility. Supports faults in that foundation.
Your organization
Your agents and the workflows they run, business logic, prompts and content quality, decisions and approvals - built by your team or a workflow builder you choose. Agent behavior and custom code stay with their owner.
/ Illustrative examples
Examples of agents your team could build.
These are illustrations of customer-built agents, not features Surya ships. People stay in charge of clinical, regulatory and production decisions.
Example
Approved-policy assistant
Answers staff questions from approved policies and procedures, citing the source.
Example
Internal request triage
Sorts routine service and facilities requests and routes them to the right team.
Example
Operational document drafting
Drafts and summarizes shift notes, meeting records and operating documents for a person to finish.
Example
Quality and admin preparation
Gathers the material for quality or administrative work so a person can review and decide.
/ Physical businesses
Connected to how your sites actually run.
Agents are only as useful as the devices, access and sites they reach. Surya Endpoint, Surya Fabric and Surya Standby can supply that physical foundation, each bought on its own. If an equivalent environment already exists, Agent Platform works with it. Nothing is bundled, and no other purchase is required.
Agent Platform on its own does not include equipment logistics, lockers or network rebuilds. Surya Foundation remains Endpoint, Fabric and Standby, and is what the agents stand on; the platform is bought on its own or alongside it.
/ Acceptance
Know when your foundation is ready.
Acceptance is a set of checks we run with you, recorded in the handover pack.
- Owners recorded for the platform, each environment and each knowledge location
- Access granted and denied as designed, with tested denial
- Approved knowledge connected and reachable only by the right people
- Validation agent running in test
- Controlled release and disable demonstrated where the capability supports it
- Telemetry and cost review completed
- Runbooks handed over
- Exception list signed by both sides
/ Questions
Agent Platform questions
What is included?
Six workstreams to a written schedule: environment and licensing baseline, identity and permissions, data and connection readiness, build-test-live environments, operability, and team enablement with acceptance. Counts and entitlements are set in the schedule before work starts.
We already have a Microsoft tenant and an IT team. Does that work?
Yes. Agent Platform is built in your existing tenant, which you keep. We agree roles with your team, and your administrators keep ownership and can revoke Surya's access.
Does Surya build our agents?
It can. Your people build the functions, or Surya builds them with you, or any split in between, agreed in the quote. Surya establishes and operates the foundation, enables your makers and provides a validation agent to prove the platform. The business logic, decisions and approvals stay yours.
Will Microsoft charge extra?
Usually, yes. Copilot licenses, Copilot Studio capacity or credits and other Microsoft usage are billed under your Microsoft agreements or itemized separately in your quote. We confirm billing ownership during the baseline workstream.
How does the first year lead to ongoing operation?
Year one establishes, enables and stabilizes the platform. After agreed acceptance and stabilization, a separately defined, lower-fee ongoing phase keeps the same footprint operated. Both are agreed before work starts.
How is this different from Surya Endpoint and agent operations?
Surya Endpoint operates your workstations, identity lifecycle and device access. Agent operations describes how Surya runs its own products with AI and people. Agent Platform is the environment where the functions your business runs on are built and run.
Can we rename the agents?
Yes. The names are defaults. During setup we work with you to tune each one to your organization's culture: the name, how it speaks, and where it hands off to a person.
Can an agent change something in our environment on its own?
Routine work on the approved list, yes. Privilege grants, destructive actions and broad policy changes wait for your named owner. Anything unknown stops and raises an exception.
Which Microsoft clouds are supported?
The standard offer uses a supported Microsoft commercial-cloud profile. Government clouds and specific features or connectors are qualified separately, because availability differs by cloud.
Defense suppliers: cloud, data and feature eligibility are qualified separately for each enquiry.
Start with the foundation. Build what your business needs.
Tell us about your Microsoft tenant, the teams who would build agents and what you want them to work on. Surya returns a supported first scope, prerequisites, who owns what and written commercial next steps.