- Home
- AI agents
- AI agent registry and sprawl
- Citizen-built agents
Govern and secure · AI agent registry and sprawl
Citizen-built agents: how to let employees build AI agents safely
A citizen-built agent is an AI agent made by an employee outside IT, usually in a low-code tool such as Copilot Studio, Microsoft 365 Agent Builder or Gemini Enterprise. Governing them means tiers: personal agents run inside guardrails without review, and agents shared with teams or the whole company pass a review that grows with reach.
In this guide: 83 pages
Key takeaways
- Tie the depth of review to how far an agent is shared. Microsoft runs its own tenant this way: employees create and share simple, low-risk agents in a safe space, and team and line-of-business agents need enterprise review.
- Watch the credentials. A shared agent configured with maker-provided credentials lets anyone using it act with the author's access, so team and company agents should run with end-user credentials or their own identity.
- Every new Copilot Studio agent has received a Microsoft Entra agent identity automatically since July 2026, which gives each citizen-built agent an object you can disable, audit and target with policy.
- Plan for makers leaving. Shared agents go ownerless when the user who created them is deleted; decide in advance whether personal agents are deleted with the account, as Microsoft does internally, or reassigned to a manager.
Why tier citizen-built agents by reach?
Because the risk of a low-code agent grows with the number of people who can use it and the systems it can touch. A tier model lets personal agents run with light controls and saves review effort for the agents that reach a team or the whole company.
A three-tier model for citizen-built agents. The settings named are the Microsoft ones; Google and AWS equivalents are in the cross-cloud table.
| Tier | Who can use it | Where it is built | Review before use | When the maker leaves |
|---|---|---|---|---|
| Personal | The maker, or a few named colleagues | A personal developer environment with locked environment group rules | None beyond the platform guardrails | Deleted with the account, as Microsoft does internally, or reassigned to the manager by rule |
| Team | One team or department | A team environment with a pipeline to test and production | Owner named; data sources, connectors and credentials checked; sharing limited to the team | A named co-owner takes over; the registry flags the agent until then |
| Organization-wide | Everyone, through the agent store or a channel | A managed environment, deployed by pipeline with approvals | Security and data review, an evaluation run, then admin approval to publish | The business sponsor answers for it, with periodic attestation |
Each tier maps onto controls that already ship. Sharing limits keep a personal agent personal, pipelines with delegated deployments carry a team agent through test, and the Microsoft 365 Requests queue holds an organization-wide agent until an admin chooses Publish to store or Reject submission. Controlling agent sprawl, the sibling page, lists the exact environment and sharing settings.
Which credentials should a citizen-built agent run with?
End-user credentials wherever the agent acts for the person using it, and its own agent identity for anything it does on its own. Avoid maker-provided credentials in any agent other people use, because everyone who uses it borrows the maker's access.
Credential modes for a low-code agent, as Copilot Studio and Entra describe them on 2 Nov 2026.
| Mode | Whose access the agent uses | Fits | Watch for |
|---|---|---|---|
| End-user credentials (the Copilot Studio default for connectors) | The person chatting with the agent | Agents shared with a team or the company | Each user needs their own access to the connected system |
| Maker-provided credentials | The maker's, for every user | A personal agent only the maker uses | Microsoft warns that anyone using a shared agent then acts with the author's access |
| Agent identity (Microsoft Entra Agent ID) | The agent's own grants | Scheduled or event-driven work | Grants with no user ceiling need a sponsor and a review cycle |
| No authentication | Nobody signs in | Public information only | Anyone with the link can chat; block it with the Chat without Microsoft Entra ID authentication connector |
Agent Builder agents in Microsoft 365 Copilot work from SharePoint and connector knowledge and cannot take external actions. A maker who needs actions copies the agent to Copilot Studio, which is a sensible moment to move it into the team tier and give it a review.
What should a reviewer check before an agent goes to the whole company?
Ten points, each answerable from the agent's settings and its registry record: owner, purpose, sign-in, credentials, knowledge, actions, testing, deployment, threat protection, and risk tier with a review date. A reviewer who cannot answer one of them sends the request back.
- Owner and sponsor. A named maker and a business sponsor, plus a co-owner for continuity.
- Purpose. A written purpose, checked against the registry for an existing agent that already does the job.
- Sign-in. Authentication is on, and no agent can be reached by link alone.
- Credentials. End-user credentials or the agent's own identity, and no maker-provided connections in a shared agent.
- Knowledge sources. Sites and files with clean permissions, since the agent will surface whatever its users can already reach.
- Actions. Every connector, agent flow, MCP server and computer use step listed, with the write actions marked. Copilot Studio computer use has been generally available since May 2026, and its allow list blocks actions on unlisted sites without stopping the model from opening them.
- Testing. A set of test questions and expected answers run against the agent, with the results attached to the request.
- Deployment. The agent lives in a solution and moves by pipeline; Microsoft says pipeline deployments cannot bypass QA environments or your approval processes.
- Threat protection. Copilot Studio external threat detection (preview) is set per environment with no tenant-wide switch, so confirm the production environment has it and that it blocks when the provider does not answer.
- Risk tier and review date. Both recorded as registry tags, so the agent returns for review on a known date.
The gate itself is the Requests queue in the Microsoft 365 admin center, with Pending review, Pending update and Pending activate states. Until an admin approves an update, users keep the previous version, so a maker can iterate without breaking the published agent.
How do you keep citizen-built agents owned and current?
Decide what happens when a maker leaves before the first one does, and automate it. The platforms now ship rules for ownerless agents, sponsor transfer and ownership transfer; your part is to switch them on and to watch the shared bill.
In the Microsoft 365 admin center, agent management rules can reassign ownerless Agent Builder agents to the previous owner's manager and block ownerless agents that nobody uses. Shared agents become ownerless when the user who created them is deleted, so run the rule as part of the leaver process. Entra lifecycle workflows notify cosponsors and transfer sponsorship when an agent identity's sponsor changes role or leaves. Gemini Enterprise lets admins transfer ownership of shared employee-made agents (21 Sep 2026).
Watch the bill as well as the list. Copilot Credits are pooled across the tenant, the Cost controls rule decides whether an environment may draw from that pool, and agents are blocked at 125% of prepaid capacity, even in a conversation already in progress, unless pay-as-you-go billing is attached. A popular citizen-built agent can stop a business process on the day it succeeds, so give team and company agents a capacity owner.
How do Microsoft, AWS and Google implement it?
Where employees build agents on each cloud, and the control for each tier, as the vendor pages showed on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Where employees build | Copilot Studio; Microsoft 365 Copilot Agent Builder | No low-code agent builder verified for this page; developers build on AgentCore | Employee-made agents in Gemini Enterprise |
| Approval to reach everyone | Requests queue: Publish to store or Reject submission | AWS Agent Registry approval, DRAFT to APPROVED, for agents developers publish | Admin review of sharing requests (GA 23 Feb 2026) |
| Ownership when a maker leaves | Management rules for ownerless agents; Entra sponsor transfer | Publisher and ownership fields on registry records | Ownership transfer of employee-made agents (21 Sep 2026) |
| Identity per agent | Entra agent identity for every new Copilot Studio agent (since Jul 2026) | One AgentCore workload identity per Runtime deployment | Agent Identity for Gemini Enterprise and Agent Runtime (API preview 18 Jun 2026) |
AWS has no first-party low-code builder in the material reviewed for this page, so on AWS the tier model applies to agents your developers publish to AWS Agent Registry.
Enterprise example · Publicly reported
Microsoft runs tiers for more than 100,000 agents in its own tenant
Microsoft Digital, the company's internal IT organization, governing agents in the Microsoft tenant with Agent 365.
Microsoft Digital wrote in November 2025 that "we have more than 100,000 agents on the Microsoft tenant today". Its model is tiered: individual employees can create and share simple, low-risk agents in a safe space, while team and line-of-business agents need enterprise review. DLP and sensitivity labels decide which connectors an agent may use.
Ownership follows the tier. Individually owned agents are deleted when the employee leaves, and team-owned agents have a lifecycle defined by the tenant and tied to attestation, linked to the software development lifecycle. The figures and practices are Microsoft's own account of its tenant and have not been independently checked.
- Owner
- The maker for individual agents; the owning team for team and line-of-business agents
- Identity
- Not described in the post; Copilot Studio has created an Entra agent identity for each new agent since July 2026
- Risk tier
- Simple, low-risk individual agents in a safe space; team and line-of-business agents reviewed
- Approval
- Enterprise review before team and line-of-business agents are used
- Data controls
- DLP and sensitivity labels gate which connectors an agent may use
- Retirement
- Individual agents deleted when the employee leaves; team agents on a tenant lifecycle tied to attestation
Publicly reported by Microsoft Inside Track, 21 Nov 2025
Frequently asked questions
Should we let employees build agents at all?
Yes, inside guardrails, because a ban sends them to tools you cannot see. Personal helpers with little reach are the lowest tier. A tier model keeps them cheap to run and spends review effort on the agents that reach a team or the company.
What is the difference between Agent Builder and Copilot Studio for a citizen maker?
Agent Builder makes declarative agents inside Microsoft 365 Copilot and Teams from SharePoint and connector knowledge, with no external actions. Copilot Studio adds connectors, agent flows, MCP servers, computer use and connections to other agents. Moving an agent from Agent Builder to Copilot Studio is a good trigger for a review.
Who should review citizen-built agents?
A small platform team for the team tier, with security and data protection joining for agents published to the whole company. Publish a response time for the Requests queue. Approval queues with no agreed response time push makers to share agents directly, and Microsoft's rule that rejects requests older than a set number of days needs explaining to makers first.
What happens to an agent when its maker leaves?
Whatever your tier rules say. Microsoft deletes individually owned agents in its own tenant when the employee leaves; the admin center can instead reassign ownerless Agent Builder agents to the previous owner's manager. Team and company agents need a named co-owner or sponsor before publishing, so someone is ready to take over.
More in AI agent registry and sprawl
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- Deploying Microsoft Agent 365 at Microsoft
- Use connectors in Copilot Studio
- Computer use in Copilot Studio
- What's new in Copilot Studio
- Agent Builder in Microsoft 365 Copilot
- Agent settings in the Microsoft 365 admin center
- Agent requests
- Agent Registry in the Microsoft 365 admin center
- Limit sharing in managed environments
- Overview of pipelines in Power Platform
- Copilot Studio solutions overview
- Configure data policies for agents (Copilot Studio)
- External threat detection for Copilot Studio agents
- Billing rates and management (Copilot Studio)
- What's new in Microsoft Entra Agent ID
- Gemini Enterprise release notes
- AWS Agent Registry record lifecycle
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner