Organisations Struggle to Govern AI Agents Built in Afternoon

A simple AI agent can now be built in an afternoon, thanks to tools like Microsoft 365 Copilot, Microsoft Copilot Studio, and Microsoft Foundry. However, this ease of creation has led to a governance gap, as organisations struggle to decide how to govern these agents. The hard questions come after the build, such as whose permissions the agent uses, what data it can reach, and who owns it next year.

Microsoft’s Copilot Studio guidance recommends a zoned approach to governance, where agents are classified into personal, team, or organisation-wide zones. Each zone has its own set of rules and permissions, and agents are automatically assigned to a zone based on their creation process. However, this approach can be complex, and organisations need to plan carefully to ensure that their agents are properly governed.

To address the governance gap, Microsoft provides various tools and features, such as SharePoint Advanced Management reports and Restricted Content Discovery, to help administrators identify and fix overshared or sensitive content. Additionally, Copilot Studio creates a Microsoft Entra Agent ID for each new agent, which provides a sign-in identity that IT can see, restrict, and switch off.