Microsoft: 62 of 100 on Ora's agent-readiness scan

The score

Microsoft is a software and cloud company based in Redmond, Washington, and a major investor in OpenAI.

• 62of 100, grade C
  Ora's agent-readiness scan of microsoft.com, read 9 November 2026, listed under Identity & Auth.
• 16Discovery, of 17
  Whether assistants find the company: search presence, Wikipedia and Wikidata, catalogues.
• 29Access, of 54
  Whether they can read it: the door, text without JavaScript, llms.txt, structured data.
• 30Usability, of 57
  Whether they can act through it: an MCP server, an API with a specification, sign-in for agents.
• 0Payments, of 0
  No check in this layer applied to the site.

79 percent of the 132,085 domains Ora ranks score under 60, and the average score is 44.

Ora's one-line summary: Microsoft offers strong developer resource discoverability and SDK packages, but lacks published OpenAPI specifications for agent integration.

What an assistant meets at the door

Before an assistant can read, compare or buy, it has to get in. These rows are the door: whether the bot shield lets the main agents through, what robots.txt tells the search, training and user-triggered agents, and whether the home page has text without running JavaScript.

What it can read, and what it can do

The reading layer is what an assistant takes away from the pages: a text file written for it, markdown on request, structured data about the company, a sitemap. The act layer is whether it can do anything through a published interface rather than by clicking through the site.

Ora probed the six payment checks and found no x402, MPP, UCP, ACP or AP2 signal, so the pay layer reads 0 of 0.

Three fixes to hand to the web team

Ora estimates how many points each open check would return. These are the largest on this read, in Ora's words where it gave them, so a leader can hand the list over without translating it.

1. OpenAPI spec published, worth about 4.3 points by Ora's estimate: No OpenAPI/Swagger specification found.
2. Scoped permissions, worth about 3.9 points by Ora's estimate: No declared OAuth scopes, security schemes, or scoped-permission documentation found.
3. JSON error responses, worth about 3.1 points by Ora's estimate: API does not return JSON error responses (or no API detected).

Our read

Microsoft ships agent tooling from a home page that was not built for agents. All four agent user agents get in, robots.txt allows the crawlers, the sitemap is valid and the home page gives 6,598 characters with an H1 at a 2.8 percent text ratio; the one JSON-LD block carries no identity type, the metadata lacks og:image and there is no llms.txt, so the Access layer reads 29 of 54. The act layer is the strongest in this series so far: developer.microsoft.com, an OAuth endpoint at login.microsoft.com, SDKs on npm, PyPI and RubyGems, and a first-party MCP server on npm, credited in part for want of a live handshake at /.well-known/mcp; there is no OpenAPI specification and no declared scopes, so the Usability layer reads 30 of 57. Ora probed the six payment checks and found no protocol, so the pay layer reads 0 of 0. An Organization type in the JSON-LD is the cheapest fix; the handshake on the home domain is the one that fits.

Test your own site

Run the same scan on your own domain at ora.ai. The score, the layers and the fixes on this page come from its public result for microsoft.com; a scan of a public site takes a few minutes and needs no account.

• Scan your domain on OraThe same checks, the same scoring, on your own site.
• The self-check, 18 questionsWhat to ask for, in business terms, before the scan.
• All the 360 checksThe other companies in this series, newest first.