Security & governance

Who can build agents in your organisation? Answer that before Agent 365

By Matteo Garoli 7 min read

A white outline person with a solid shield in front of the shoulder on a frosted glass tile, with warm amber light and an ice blue orb glowing behind it on a near-black background.

At one large organisation where I ran an agent review recently, the answer on governance was that they were still working it out, and Copilot Studio hadn’t moved past a proof of concept. That is the moment to decide who may build agents, before they multiply.

Microsoft Agent 365 can list and govern the agents that exist. It doesn’t decide who is allowed to create them, and in Microsoft 365 agents are created in three tools with three sets of controls. Answer that question first.

Who can build agents in a Microsoft 365 tenant?

Anyone with the right licence in a tool that hasn’t been restricted. Microsoft’s agents FAQ names the groups: users who create declarative agents in Agent Builder or SharePoint, if tenant settings allow it and they have a Copilot licence or subscription; makers who use Copilot Studio; and developers who use the Copilot Studio SDK or the Agents Toolkit.

Agent Builder needs a Copilot licence, or pay-as-you-go enabled for Copilot Studio. Microsoft documents an on/off switch for Agent Builder; per-group settings exist for sharing and access, not creation (22 October 2026).

SharePoint agents can be made by people who can create or access files on a site, with a Copilot licence or pay-as-you-go for SharePoint.

Copilot Studio has four doors, according to Microsoft’s standard harness licensing page: a Copilot Studio user licence (free of charge once the tenant has a prepaid credit pack); membership of the security group named in the Copilot Studio authors tenant setting; a Microsoft 365 Copilot licence (Microsoft’s pages now call it Microsoft Copilot), which lets you use Copilot Studio to extend Copilot with agents; or a trial. Only the authors setting works by group. An admin can block trial sign-up, and the Copilot licence goes wherever you assign it. The Copilot Studio for Teams plan in select Microsoft 365 subscriptions adds classic agents for Teams, and the Copilot Studio Customer Advisory Team blog says E3 and E5 are included. Per-agent credit limits are covered in the article on the first Copilot Studio agent.

Who can share an agent, and with whom?

Three controls, one per tool: Sharing in the Microsoft 365 admin center for Agent Builder agents, Limit sharing on managed environments in the Power Platform admin center for Copilot Studio agents, and file permissions for SharePoint agents.

Sharing sits under Agents > Settings with the options All users, No users and Specific users. Microsoft states that it applies only to agents built with Agent Builder, and that with No users people can still share directly with specific individuals. Two neighbouring settings are easy to mix up with it. User access decides which users or groups can use and install agents. Agent and plugin access decides whether agents built by Microsoft, by your organisation or by external publishers are offered at all. Some Learn pages still describe these two under Copilot > Settings > Data access > Agents.

For Copilot Studio, open the Power Platform admin center, go to Manage > Environments, select a managed environment, then Edit Managed Environments and Manage sharing. A maker can otherwise share an agent with individuals, security groups or everyone in the organisation. The rules let you block Editor grants, block Viewer grants, allow individuals only, and cap viewers per agent. They apply when someone shares, can take up to an hour to start, and leave existing access alone. A non-compliant agent can only be unshared.

File permissions on the .agent file decide who can open or edit a SharePoint agent.

Publishing an agent to the whole tenant is a separate step that needs administrator approval. Requests appear under Agents > All agents > Requests, where an admin publishes the agent and chooses the audience, or rejects it. A management rule can reject requests older than a set number of days.

What do environments and data policies add?

They decide where Copilot Studio agents are built and what those agents may connect to. With environment routing off, makers work in the default environment, where their work can conflict with other people’s.

Environment routing is a premium governance feature, off by default, under Manage > Tenant settings > Environment routing. You pick the portals and the makers (everyone, or named security groups), and each maker gets a personal managed developer environment. Managed environments carry a licence consequence: people who run Power Apps or flows in them need premium licences, while the entitlement that comes with a Microsoft 365 Copilot licence covers Copilot Studio features only. So start with Copilot Studio only. The Developer, Production and Trial environment assignment settings in the same tenant settings can be set to Only specific admins, so makers can’t create environments of their own.

Data policies (Security > Data and privacy > Data policy) work through connectors. Blocking “Chat without Microsoft Entra ID authentication in Copilot Studio” stops makers publishing agents that need no sign-in. Other connectors cover knowledge sources, publishing channels, HTTP requests and event triggers. A policy with tenant scope applies to every agent in every environment, and an agent that breaks a policy can’t be published.

What does Agent 365 add?

A control plane for agents, with identity, data and threat protection on top. Microsoft Learn’s name for it is Microsoft Agent 365. It has been generally available since 1 May 2026 for the Commercial segment, licensed per user, and it’s included in Microsoft 365 E7 or sold stand-alone. Learn says it works best with Microsoft E5 as a prerequisite, and that at least one user needs a qualifying Agent 365 licence to switch it on.

Much of the inventory work doesn’t need it. Microsoft’s service description marks four things as included in the Microsoft 365 Enterprise, Business, Education and Front Line Worker plans: the agent registry in the admin center, basic governance actions (publish, deploy, block, delete, approve, reassign owner), conditions-based lifecycle rules, and registry sync from external platforms. Policy templates, observability, tenant-wide control of which tools agents can reach, and the Entra, Purview, Defender and Intune integrations (Conditional Access for agents, data loss prevention, Insider Risk Management) need E7 or Agent 365.

In what order should you set up agent controls?

Inventory, then who may build, then environments, then sharing and data policies, then a standing review.

  1. Inventory. Agents > All agents > Registry lists agents as Microsoft, partner-built, Published by your org or Shared by creator. Export it, then check the agents without owners, the unmanaged count and the Requests queue. Ask your Power Platform admin which Copilot Studio environments exist.
  2. Decide who may build, tool by tool, with a named group and a reason for each. Start with the Copilot Studio authors group, then check Copilot licence assignment, trial sign-up, Agent Builder availability and the Microsoft Copilot for SharePoint service plan, which also switches off Copilot in OneDrive for that user.
  3. Environments. Turn on environment routing for Copilot Studio, restrict who can create environments, and set up one shared environment for agents that have an owner and a purpose.
  4. Sharing and data policies. Set Agent Builder sharing to Specific users, apply Limit sharing to the managed environments, block the no-authentication connector at tenant scope, and name who approves requests.
  5. Review. Once a month, look at three lists: agents without owners, agents shared widely, agents nobody uses. Agent management rules can hand an ownerless Agent Builder agent to the previous owner’s manager, or block ownerless agents with no usage.

Agent 365 comes after step 4, once you know which agents you have and which rules you want it to enforce.

Sources

All pages accessed 22 October 2026.

If you are working on Copilot adoption, a training or a talk, or you are starting out in this world, write to me.