Surya Agent Platform · Built on Microsoft
Your people. Your agents. A foundation ready for both.
A configured and operated Microsoft environment where your team can build, deploy and run AI agents. Surya establishes the identity, data access, environments and operating controls. You decide what your agents do.
For healthcare and manufacturing organizations, including their administrative and regulated operations, that want their own teams building agents on the Microsoft tools they already trust.
Your Microsoft tenant stays yours: your administrators keep ownership and can revoke Surya's access.
Your agents
Owned by you
Business agents and workflows
Surya Agent Platform
Operated by Surya
Microsoft agent foundation
- Identity and access
- Approved data and connections
- Build, test and live environments
- Release, telemetry and cost controls
In your Microsoft tenant · Copilot, Copilot Studio, Power Platform, Entra, SharePoint, Purview where licensed
Physical foundation
Optional for Agent Platform
Devices, sites and equipment
Or your existing equivalent environment
/ The stack
One stack.
Each one can be bought directly and works with what you already run.
Standby, Endpoint and Fabric together are Surya Foundation →/ Part one
Surya's IT agents: how Standby, Endpoint and Fabric are delivered
Inside each product, named IT agents take the routine work on the approved list and Surya engineers take the exceptions, around the clock. Each agent maps to the product you buy. The names are defaults; during setup we tune them with you: how they speak, what they are called, where they hand off to a person.
Choose the job you need done. Your quote identifies the Surya products, site equipment and permissions required to deliver it.
Get failed front-desk equipment replaced
June
The front desk
The check-in PC, the label printer, the exam-room workstation. When one goes, the replacement is in the locker and she tells the office manager which slot.
- Takes off your team:
- Chasing a replacement: dispatch, handover and the custody record.
- Alone:
- the swap, the return, the record.
- To a person:
- a device that plugs into a clinical instrument.
- What you buy:
- Surya Endpoint for the workstations in scope.
- Delivered through:
- Surya Endpoint, with Surya Standby included. Standby prepared recovery and Surya Control are included within the agreed workstation profile, not bought again.
Scope June →Before it starts
The workstation profile, sites and replacement stock are agreed in the quote. Where physical recovery is included, replacements are held in a Surya-operated smart locker.
Your named owner approves consequential changes. A device that plugs into a clinical instrument goes to a person.
Need only prepared replacements for the configurations you run today? Surya Standby can be bought on its own for that. It does not include the monitoring, identity or workstation operation.
Get new providers ready to work
Ana
Provider IT onboarding
A new provider starts; Ana has the device, the account, the right access to the right systems and the compliance posture ready on day one. When a provider leaves, access is gone the same day and she can prove it.
- Takes off your team:
- The device, account and access setup for each new provider, with access approved by your people.
- Alone:
- every joiner and leaver.
- To a person:
- an unconfirmed request.
- What you buy:
- Supported Surya Endpoint scope for provider joiners and leavers: devices, accounts and approved access, not professional credential verification.
- Delivered through:
- Surya Endpoint.
Scope Ana →Before it starts
Supported licenses, the role catalogue and access prerequisites are confirmed in the quote.
You approve access and consequential actions. An unconfirmed request waits for a person.
Keep clinics connected
Theo
The clinic network
Twelve clinics, one standard. Spare gateway and access points staged per clinic.
- Takes off your team:
- Watching clinic network health and opening the right fix.
- Alone:
- monitoring, configuration, spares.
- To a person:
- the physical swap.
- What you buy:
- Surya Fabric for the site network in scope.
- Delivered through:
- Surya Fabric, with Surya Standby included. Prepared network spares and Surya Control are included within its agreed scope, not bought again.
Scope Theo →Before it starts
Physical swap ownership and site readiness are agreed in the quote. Spares can sit in an existing secure room or cage with the agreed custody tracking.
A person does the physical swap. Theo stages the spare and confirms the network is back on standard.
Keep approved access current
Nora
The access keeper
Who can see patient data, from where, on what device. She holds the identity and access standard across every clinic and produces the evidence when the compliance question comes.
- Takes off your team:
- Routine access reviews and removals on the approved list; decisions stay with your people.
- Alone:
- the standard and the evidence.
- To a person:
- any change to who sees what, before it takes effect.
- What you buy:
- Supported Surya Endpoint scope for identity, access and its evidence.
- Delivered through:
- Surya Endpoint.
Scope Nora →Before it starts
Supported licenses, the role catalogue and access prerequisites are confirmed in the quote.
Any change to who sees what waits for your approval before it takes effect.
Keep routine IT moving after hours
Sam
The night shift
The on-call provider's laptop at 11pm, the front desk at 7am. Fixes what the approved list can fix and has the rest in front of a Surya engineer before the clinic opens.
- Takes off your team:
- Routine after-hours requests on the approved list, so on-call people take only exceptions.
- Alone:
- resets, slow-PC fixes, the known list.
- To a person:
- everything else, before opening.
- What you buy:
- Supported Surya Endpoint scope for after-hours requests.
- Delivered through:
- Surya Endpoint.
Scope Sam →Before it starts
Supported licenses, the role catalogue and access prerequisites are confirmed in the quote.
Night work is limited to approved operations. Everything else goes to a Surya engineer and your named owner.
One intake conversation sets how they speak. A plant talks in shifts and lines. A clinic talks in rooms and providers and never names a patient. That tuning is done with you, not handed to you.
Every one of them runs under identities in your own Microsoft 365 tenant that your administrator can see, audit and revoke, and under Surya Control: routine work on the approved list, consequential changes only with your named owner.
Hires that share a product share one purchase, and recovery already included in Endpoint or Fabric scope is not a second purchase. Choosing hires is an enquiry, not an order: qualification confirms the supported scope.
Surya Agent Platform is bought on its own for the business agents your team builds. It does not require Surya Endpoint, Fabric, Standby, a locker or Surya Control.
What stands behind them.
An agent that can only send a message is a chatbot. These agents finish the job because Surya's people stand behind every one of them and, where it is in scope, three physical things do too.
01
Surya engineers on shift 24/7.
Engineers on shift around the clock, 365 days a year, take what an agent should not. Each agent hands off to a person at the points shown on its card.
How it works →02
The supply chain at the Surya RTP Distribution Center.
Your replacement devices and site equipment are built to your standard, stocked, shipped and replenished from one building in Research Triangle Park. When Mara says the replacement is ready, it is because a person at RTP already built it and put it on a truck.
How it works →03
Prepared replacements at your sites.
Where Standby covers workstation recovery, replacements are held in a Surya-operated smart locker, every slot tracked. Qualified network and site spares can sit in an existing secure room or cage with the agreed custody tracking. A network-only scope, an Endpoint profile without physical recovery and Agent Platform alone need no locker.
How it works →04
Dedicated agentic compute at RTP.
Your hires run on hardware assigned to your organization alone, in the Surya RTP Distribution Center. Not shared with another customer. Every action logged off the hardware within seconds. Switched off from your own tenant, by you.
How it works →
The agents are how the work gets done. Surya's people, the building, the prepared replacements and the hardware are why it gets finished.
/ Part two
Your own agents
Bought on its own, Surya Agent Platform is the Microsoft foundation for your own agents. Surya sets up the harness in your own Microsoft 365 tenant and governs it: identities, access, the approval path before an agent reaches users, lifecycle and evidence. Your team builds its agents in Microsoft's own tools.
Surya does not build business agents for customers and does not sell consulting hours for it.
Surya Agent Platform is bought on its own for the business agents your team builds. It does not require Surya Endpoint, Fabric, Standby, a locker or Surya Control.
The ones you build.
These are the employees you build on the Surya platform. You know how to treat patients. You know how to ship product. You know what a good day on the floor looks like and what gets in its way. That is what it takes to build an agent that actually helps. The platform gives you the identities, the boundaries and the approval path. Your first one gets built with Surya in the room. After that, you build the rest.
Shift handover
Reads the shift log and the line's open issues and writes the handover note for the incoming supervisor before the shift starts.
Reaches: Your shift logs and Teams.
Built by your team. Rails by Surya.
Maintenance request
Takes an operator's message, opens the work order in your maintenance system, and follows it until it is closed.
Reaches: Your maintenance system and Teams.
Built by your team. Rails by Surya.
Quality hold
When a hold is placed, pulls the batch record, notifies the people on the hold list and drafts the disposition packet for a person to sign.
Reaches: Your quality system and SharePoint.
Built by your team. Rails by Surya.
Supplier documents
Chases certificates of analysis and safety data sheets from suppliers and files them where the auditor looks.
Reaches: Your email and SharePoint.
Built by your team. Rails by Surya.
- An identity in your own tenant that your administrator can see and switch off.
- A boundary set before it runs: what it can reach, and what it cannot.
- An approval path before it reaches your staff, and for anything consequential after.
- A record of what it did, available to you.
Everything these agents touch stays in your tenant. Surya sets the rails and holds them. Your team decides what the agents do, because your team knows the business.
/ The product
What you are buying
A configured environment in your own Microsoft tenant, with Surya responsible for operating the agreed platform baseline.
A configured environment
Identity, permissions, approved knowledge, connections and separated build, test and live environments, set up to a written baseline in your tenant.
An operating responsibility
Surya keeps the contracted baseline working: access reviews, platform changes, available telemetry, capacity and spend visibility, and escalation to Microsoft.
A team ready to build
Your administrators and makers are onboarded with runbooks and a validated reference scenario, so they can build the agents your business needs.
/ What's included
Six workstreams. Each with outputs you can check.
Quantities and entitlements for each workstream are set in your written schedule before work starts.
01
Supported environment and licensing baseline
We inventory your tenant and licenses, confirm a supported Microsoft commercial-cloud profile and agree which Microsoft 365 Copilot, Copilot Studio and Power Platform capabilities are in scope.
You receive
- Tenant and license inventory
- Agreed capability list
- Roles, capacity and billing ownership recorded
- Your tenant ownership and admin revocation confirmed
02
Identity and permissions
Maker, operator and user groups, approved admin access and agent or connection identities using supported options, all on least privilege.
You receive
- Group and role design you approve
- Approved admin access
- Agent and connection identities
- Tested access denial
03
Data and connection readiness
Named, approved SharePoint and Teams knowledge locations and supported connectors, with scoped permission and oversharing corrections for those locations.
You receive
- Named knowledge locations and connectors
- Scoped permission corrections
- A named data owner for each location
- Retention and data-policy controls where licensed
Scoped to the named locations. Not estate-wide cleanup, file migration or content curation.
04
Build, test and live foundation
Separated development, test and production environments for the supported workloads, with a solution and configuration lifecycle and clear release ownership.
You receive
- Dev, test and production environments
- Solution and configuration lifecycle
- Documented release approvals
- Repeatable configuration record
Promotion support varies by agent type and Microsoft capability; it is recorded for each workload.
05
Operability
An inventory of in-scope agents and their owners, the Microsoft platform telemetry and alerts available for them, and a defined path for incidents and vendor escalation.
You receive
- Agent and owner inventory
- Available telemetry and agreed alerts
- Capacity and spend visibility
- Incident, vendor escalation and change review
Spend alerts are not a hard spending cap, and custom agents expose only the telemetry they emit.
06
Team enablement and acceptance
Bounded onboarding sessions for your administrators and makers, runbooks and knowledge handover, plus a repeatable validation agent run in test.
You receive
- Admin and maker onboarding sessions
- Runbooks and knowledge handover
- Validation agent in a non-production environment
- Acceptance evidence pack
The validation agent proves the platform. It is not your business workflow or a library of prebuilt production agents.
/ Built on Microsoft
The Microsoft stack, and what each part does here.
Azure services and custom engineering are available only through separately validated scope. Copilot and agent capabilities need the appropriate Microsoft licenses or capacity; an existing Microsoft 365 plan does not include all of them, and feature and connector availability varies by cloud.
- Microsoft 365 Copilot
- The licensed employee experience for people who have it.
- Copilot Studio and Power Platform
- Where your team builds supported agents and automation.
- Microsoft Entra
- Who and what can access each agent, connection and environment.
- SharePoint
- The approved knowledge your agents may use.
- Microsoft Purview
- Retention, labeling and data-policy controls, where licensed.
/ From first year to ongoing operation
Establish it in year one. Keep it ready as you grow.
Two defined phases for the same agreed footprint. Both scopes and fees are agreed in writing before work starts.
Year one
Establishment and enablement
A 12-month phase that establishes the foundation, readies permissions and data, enables your team and stabilizes operation.
- The six workstreams delivered to the written schedule
- Onboarding sessions and runbooks
- Validation agent and acceptance evidence
- Monthly platform review
- Operation of the baseline from the day it goes live
Ongoing
Steady-state platform operation
A separately defined phase, at a lower fee, that keeps the same footprint current and ready as Microsoft and your team move forward.
- Configuration and change control for the baseline
- Access and permission reviews
- Platform incident handling and Microsoft escalation
- Capacity and spend oversight
- Quarterly owner review
The move to ongoing operation follows agreed acceptance and stabilization. If prerequisites are delayed, we replan together; there is no automatic extension or extra charge unless both sides agree.
Microsoft licenses, usage and credits, third-party products and any expansion are itemized separately. Pricing is set in your written proposal.
/ Responsibilities
Who owns what.
Microsoft
The software, cloud services, models and product capabilities, under your Microsoft agreements.
Surya
Configures and operates the contracted baseline: identity, approved data and connections, environments, release process, available telemetry and spend visibility. Supports faults in that foundation.
Your organization
Your agents and the workflows they run, business logic, prompts and content quality, decisions and approvals - built by your team or a workflow builder you choose. Agent behavior and custom code stay with their owner.
/ Illustrative examples
Examples of agents your team could build.
These are illustrations of customer-built agents, not features Surya ships. People stay in charge of clinical, regulatory and production decisions.
Example
Approved-policy assistant
Answers staff questions from approved policies and procedures, citing the source.
Example
Internal request triage
Sorts routine service and facilities requests and routes them to the right team.
Example
Operational document drafting
Drafts and summarizes shift notes, meeting records and operating documents for a person to finish.
Example
Quality and admin preparation
Gathers the material for quality or administrative work so a person can review and decide.
/ Physical businesses
Connected to how your sites actually run.
Agents are only as useful as the devices, access and sites they reach. Surya Endpoint, Surya Fabric and Surya Standby can supply that physical foundation, each bought on its own. If an equivalent environment already exists, Agent Platform works with it. Nothing is bundled, and no other purchase is required.
Agent Platform on its own does not include equipment logistics, lockers, network rebuilds or Surya Control. Surya Foundation remains Endpoint, Fabric and Standby, and is what the agents stand on; the platform is bought on its own or alongside it.
/ Acceptance
Know when your foundation is ready.
Acceptance is a set of checks we run with you, recorded in the handover pack.
- Owners recorded for the platform, each environment and each knowledge location
- Access granted and denied as designed, with tested denial
- Approved knowledge connected and reachable only by the right people
- Validation agent running in test
- Controlled release and disable demonstrated where the capability supports it
- Telemetry and cost review completed
- Runbooks handed over
- Exception list signed by both sides
/ Questions
Agent Platform questions
What is included?
Six workstreams to a written schedule: environment and licensing baseline, identity and permissions, data and connection readiness, build-test-live environments, operability, and team enablement with acceptance. Counts and entitlements are set in the schedule before work starts.
We already have a Microsoft tenant and an IT team. Does that work?
Yes. Agent Platform is built in your existing tenant, which you keep. We agree roles with your team, and your administrators keep ownership and can revoke Surya's access.
Does Surya build our agents?
Your team, or a workflow builder you choose, builds and owns the business agents. Surya establishes and operates the foundation, enables your makers and provides a validation agent to prove the platform. Surya does not build business agents for customers and does not sell consulting hours for it.
Will Microsoft charge extra?
Usually, yes. Copilot licenses, Copilot Studio capacity or credits and other Microsoft usage are billed under your Microsoft agreements or itemized separately in your quote. We confirm billing ownership during the baseline workstream.
How does the first year lead to ongoing operation?
Year one establishes, enables and stabilizes the platform. After agreed acceptance and stabilization, a separately defined, lower-fee ongoing phase keeps the same footprint operated. Both are agreed before work starts.
How is this different from Surya Endpoint and agent operations?
Surya Endpoint operates your workstations, identity lifecycle and device access. Agent operations describes how Surya runs its own products with AI and people. Agent Platform is the environment where your team builds and runs its own agents.
Can we rename the agents?
Yes. The names are defaults. During setup we work with you to tune each one to your organization's culture: the name, how it speaks, and where it hands off to a person.
Can an agent change something in our environment on its own?
Routine work on the approved list, yes. Privilege grants, destructive actions and broad policy changes wait for your named owner. Anything unknown stops and raises an exception.
Which Microsoft clouds are supported?
The standard offer uses a supported Microsoft commercial-cloud profile. Government clouds and specific features or connectors are qualified separately, because availability differs by cloud.
Defense suppliers: cloud, data and feature eligibility are qualified separately for each enquiry.
Start with the foundation. Build what your business needs.
Tell us about your Microsoft tenant, the teams who would build agents and what you want them to work on. Surya returns a supported first scope, prerequisites, who owns what and written commercial next steps.