Copilot after rollout: agents and guardrails, without agent sprawl

Section 01What changed in 2026: Copilot became a place where agents get built

When we wrote Past the stall in June 2026, the hard question was whether a company could let Copilot read its SharePoint estate. A company that has since done that work has fixed its worst oversharing, and its pilot teams use Copilot every day. The next question usually comes from the IT lead who owns the tenant, and it is about agents: what people have built on Copilot, what those agents can read, who approved them and who will notice when their owner leaves.

Microsoft changed its vocabulary in the same year. Microsoft Learn now calls the product Microsoft Copilot (formerly Microsoft 365 Copilot), and the free chat Microsoft Copilot Chat; the product was renamed in 2026, while Microsoft's price list and Partner Center still sell Microsoft 365 Copilot and Copilot Business. In this paper, Copilot means a paid Copilot licence (Microsoft 365 Copilot, or Copilot Business for organizations with up to 300 users). Copilot Chat means the free chat, included with Microsoft 365 business and enterprise plans. Agent Builder, Copilot Studio, Agent 365 and Microsoft Foundry keep their names.

An agent, in Microsoft's sense, is a Copilot set up for one job, with instructions and approved sources to read. Some agents can also act in other systems. In one tenant they now come from four places. People with Copilot describe an agent in plain language in the Copilot Agent Builder and share it with colleagues. Makers, the employees who build agents beyond their own use, build more capable agents in Copilot Studio, with connectors to business systems, inside Power Platform environments. Engineers build and deploy custom agents in Microsoft Foundry. Agents built on other platforms can be synced into Microsoft's registry. Each route has its own controls.

Microsoft now provides a central agent inventory with lifecycle controls. The Agent Registry in the Microsoft 365 admin center (Agents, then All agents, then Registry) lists the agents in the tenant, and the actions an admin can take depend on the platform an agent was built on. Shared Agent Builder and Copilot Studio agents can be published, blocked, deleted and given a new owner; agents from other platforms follow the ownership process of their own platform. It belongs to Agent 365, Microsoft's agent management product, which became generally available on 1 May 2026. The registry, its basic actions and its conditions-based lifecycle rules are included in every Microsoft 365 plan at no extra cost. Agent 365 itself is a separate per-user licence on top of a qualifying Microsoft 365 licence. It adds monitoring of agent activity and failures (observability), control over which tools and MCP servers agents may call (MCP servers are the connectors agents use to reach other systems), Conditional Access for agents and Purview and Defender protection at the agent level.

Microsoft Entra Agent ID, the part of Entra that gives an agent an identity of its own, is generally available, and Microsoft now gives Copilot Studio agents their own identity in Entra. Microsoft is folding its separate agent registry experiences into Agent 365 while Entra keeps the identities, so the list of agents ends up in one place.

Licensing is moving as well, as of November 2026. From 1 December 2026, new Microsoft 365 Copilot and Copilot Business offers no longer need a Microsoft 365 base subscription, at the same price. Microsoft is adding fair-use limits for Copilot Chat users without a Copilot licence, from 2 November 2026 in tenants with up to 2,000 seats and from 9 November in larger ones, and admins can neither see nor change those limits. The Power Platform dates that affect agent makers are in the order of work later in this paper.

Section 02Where Copilot pays off once it is governed

The most careful recent public evaluation we know of comes from HMRC, the UK tax authority, published on 9 July 2026. HMRC allocated 3,000 Copilot licences at random. Of the staff who received one, 83 percent used it during the trial, and users reported saving 2 to 3 percent of their working week, about 60 minutes a week for a full-time employee, after HMRC reduced the self-reported figures by about a fifth to allow for bias. HMRC's analysts estimate around 50 million pounds a year of net productivity benefit from deploying up to 50,000 licences. HMRC calls these figures a baseline estimate rather than a precise measure.

Two details in the same report bear on what comes next. The trial ran only on material below the Official Sensitive classification, so Copilot never touched the most sensitive work. And 46 percent of the staff who did not use their licence named security and data privacy concerns as the main reason. HMRC's trial of Copilot across Microsoft 365 reported roughly an hour a week per person, inside a fenced area of the work, and it did not measure agents.

In our view, more of the payoff after rollout comes from agents, and so does more of the risk; no public study yet measures that split, so each agent needs its own baseline. A chat assistant saves minutes for each person. An agent built around one workflow, such as answering staff questions from a controlled policy library or preparing the first draft of a recurring report from approved sources, changes how that work runs, and it can be measured against how the team works today. The same agent can be shared well beyond its builder's team and keep running after the builder moves on. Our argument in this paper is that every agent needs an accountable owner with written limits on what the agent may do, plus a decision at a set date on whether it stays. Microsoft's 2026 controls make that practical once the company has set the rules.

Section 03The guardrail stack in Microsoft terms

Guardrails are the settings and rules that limit what Copilot and its agents can read and do. We set them up in five layers of protection, which we call the guardrail stack, because each layer answers a different question a reviewer will ask. Data: what can Copilot and its agents read? Identity: who or what is acting? Building and sharing: who may create an agent, and how far may it spread? Runtime: what stops a harmful instruction while the agent runs? Audit: what can the company prove afterwards? The table names the Microsoft control for each layer and says what Business Premium covers on its own. E5-level rights, in this paper, means the additional security and compliance rights in Microsoft 365 E5 or a Microsoft Purview Suite add-on; confirm the exact suite for your plan with your Microsoft partner. DLP, short for data loss prevention, means rules that stop sensitive information being used or shared where it should not be.

We start with data, because the identity and agent controls all sit on top of what people can already open. One fact surprises most decision groups: a sensitivity label on its own does not stop Copilot. Copilot works with what the signed-in person may open, labelled or not. To keep labelled files and emails out of Copilot, Microsoft documents a DLP policy on the location called Microsoft 365 Copilot and Copilot Chat, with conditions on the label. That policy needs E5-level rights, and Business Premium alone does not include it. The policy has documented limits. A matching item can still appear as a citation while its content is excluded, only emails sent on or after 1 January 2025 are covered, calendar invitations are not, and files a user uploads straight into a prompt are not scanned. Label encryption is the hard backstop on any plan, because Copilot needs both the view right and the extract right to use encrypted content.

For oversharing, one Copilot licence in the tenant makes the SharePoint Advanced Management (SAM) features for Copilot available. They include site access reviews, data access governance reports, Restricted Access Control, which limits a site to named groups, and Restricted Content Discovery (RCD), which hides a site from company-wide search and Copilot without changing who can open it. RCD controls what can be found. Who can open a site is still a matter of permissions and Restricted Access Control. Restricted SharePoint Search, the older allow-list, is retiring: new enablement has been blocked since 31 July 2026, it is capped at 100 sites and Microsoft says it isn't a security boundary. Microsoft's SAM page does not name Copilot Business, so a Copilot Business tenant should confirm the features in its admin center.

Single controls fail, and Microsoft's own incident shows it. From about 21 January 2026, a Microsoft bug tracked as CW1226324 let Copilot Chat summarize labelled emails in Sent Items and Drafts even though a DLP policy was configured, as BleepingComputer reported on 18 February; Microsoft's fix was mostly deployed by 20 February. We use the incident to argue for layers. Labels, encryption, permissions and DLP each cover a gap the others leave.

Identity answers who or what is acting. For Copilot and most Agent Builder agents the answer is the signed-in person, and the agent sees what that person can open. Agents that act on their own, on a schedule or in the background, need an identity of their own, which Entra Agent ID provides. Applying sign-in rules to agents, which Microsoft calls Conditional Access for agents, and the risk checks of ID Protection need Agent 365 or Microsoft 365 E7. Agent 365 licences attach to people: Microsoft's licensing FAQ says a licence is needed for the users who interact with, manage or sponsor agents that use its premium capabilities. For enterprises the FAQ names Microsoft 365 E5, or E3 with the Defender and Purview suites, as the base. For smaller companies Business Premium is the formal prerequisite, and Microsoft says the Defender and Purview suites for SMB are also needed to get the Agent 365 functionality. Confirm the licences for the specific controls you plan to use with your Microsoft partner before you buy.

Identity is also where the published agent attacks have landed. In October 2025 Datadog Security Labs showed that a Copilot Studio agent's demo website, hosted on a Microsoft domain, could carry a backdoored sign-in step and phish the tokens that let an app act for a user (OAuth tokens). Datadog's suggested fix starts in Entra, with a tighter consent policy and no default right for users to register apps. It also suggests watching the audit events that record when an agent is created or changed.

Building and sharing decides how many agents the company will have to govern, so it carries the most weight after rollout. In the Microsoft 365 admin center, agent settings control who may use agents (all users, no users, or named users and groups) and who may share Agent Builder agents across the organization. Two limits matter before anyone writes the policy. Microsoft documents no switch that stops users creating Agent Builder agents, so the rule on who may build has to live in policy and training. And the sharing setting applies only to Agent Builder agents; with sharing set to No users, people can still share an agent with named individuals. Agents submitted for company-wide use land in a Requests queue, where an admin publishes or rejects them, and a management rule can reject requests left open longer than a set number of days.

Copilot Studio has firmer controls, because its agents live in Power Platform environments. Environment routing, a premium governance feature, sends makers to their own managed developer environment, a separate workspace where one person builds and tests under rules IT has set, instead of the shared Default environment. Managed Environments let admins turn editor and viewer sharing on or off and cap the number of viewers, without touching access that already exists. Data policies sort connectors into groups, such as Business and Non-business, and can block a connector outright; for agents they can also block unauthenticated chat, HTTP calls, event triggers and publishing channels such as Teams or a website. One setting is often misread. The Copilot Studio authors setting grants authoring to a group but revokes no one, so people with a Copilot licence can still author. The right to use Managed Environments comes with premium Power Platform and Copilot Studio licences, and, for Copilot Studio features only, with the Copilot Studio rights in a Copilot licence. Our guide to citizen-built agents at querynow.com/ai-agents/registry/citizen-built-agents covers the settings one by one.

Runtime controls act while an agent runs. Microsoft screens Copilot prompts with jailbreak and cross-prompt injection classifiers before the model runs, though its documentation says they may not be available in every Copilot scenario. Cross-prompt injection means instructions hidden in a document or email that the agent reads and then follows. Every published Copilot Studio agent has threat detection switched on, and prompt attacks are blocked by default. On the customer side, DLP can block web search for prompts that contain sensitive information, which carries no preview label, and can block such prompts outright, which is still in preview. Admins can stop Copilot from using up to 1,000 named websites in its answers, or switch web search off. Classifiers lower the risk without removing it: in 2025 the EchoLeak flaw (CVE-2025-32711) got past the injection filter with one crafted email, and Microsoft fixed it before disclosure. The agent's permissions still decide how much damage a successful attack can do. Our guardrails guide at querynow.com/ai-agents/guardrails sets out where each check sits on the request path.

Audit lets a compliance lead answer a question months later. Copilot and Copilot Studio interactions are logged in Purview Audit as CopilotInteraction records. For supported experiences, these records can include the agent's ID and name, the resources it accessed with their sensitivity labels, the model where Microsoft records it, and flags for detected jailbreak and cross-prompt injection attempts. The fields and the channels covered vary by app, so before a company-wide agent is approved we test that its channel produces the evidence the compliance lead needs. The records hold message IDs, not prompt text. Prompts and responses sit with the user's Microsoft 365 content, where authorized reviewers can find them with Microsoft Purview eDiscovery, the search tool for legal and compliance investigations. Business Premium's Audit (Standard) keeps the records for 180 days when Copilot is licensed and in use. Audit (Premium) comes with E5 and the Purview Suite for Business Premium, but its default one-year retention covers Exchange, SharePoint, OneDrive and Entra records only. Keeping Copilot records for a year takes E5-level audit rights for the users concerned and a custom audit retention policy that covers the Copilot record type, which should be tested before anyone relies on it as evidence. Purview Data Security Posture Management (DSPM), generally available in its unified form since May 2026, gives one view across Copilot, agents and other AI apps; Microsoft still runs the older DSPM for AI as the classic experience alongside it.

A sensitivity label on its own does not keep a file out of Copilot. The label-based DLP exclusion needs E5-level rights; on any plan, label encryption keeps content from Copilot for people who lack the extract right, at the cost of also stopping them from copying it.

Section 04How agent sprawl starts, and the operating model that prevents it

Agent sprawl is a side effect of adoption. Microsoft's own tenant held more than 100,000 agents by November 2025, according to Microsoft Inside Track. Microsoft lets employees create and share simple, low-risk agents, and asks for enterprise documentation for agents owned by teams or lines of business. Inside Microsoft, agents owned by one person are deleted when the employee leaves. Team agents follow a lifecycle the tenant defines, tied to attestation, which means the owner confirms at set intervals that the agent is still needed and still correct.

In a tenant without rules the path to sprawl is easy to trace. People with Copilot build agents in Agent Builder because nothing stops them, and share them with named colleagues, which the org-wide sharing setting does not cover. Then the owners change jobs. Makers connect Copilot Studio agents to business systems from the shared Default environment. A year later nobody can say which agents still work or which of them read sensitive sites. We have not found a company outside Microsoft that has published an agent-sprawl incident, so the case for acting rests on the mechanism, and on Microsoft's decision to put a lifecycle on its own agents.

A customer tenant has to decide and switch on its own version of these rules. The operating model we set up has six parts, and each part maps onto a Microsoft control that already exists. Most of them cost nothing beyond the licences a Copilot tenant already holds.

Two details in the Microsoft controls matter for retirement. Blocking an Agent Builder or Copilot Studio agent removes it from every place it runs, while blocking a SharePoint or Foundry agent removes it only from Copilot Chat. And admin actions in the registry fail silently when the Power Platform IP firewall is in enforcement mode, so a company that uses that firewall needs another route, such as quarantine through the Power Platform API, before it relies on the block.

For maker tiers we start from a default and adjust it with the decision group. The table shows that default. It is our recommendation for a company of a few hundred to a few thousand staff, and every line is a choice the decision group can change.

The personal tier is for one person's own work. Once colleagues rely on an agent for recurring work, its owner registers it under the team tier and meets that tier's rules, because an agent's tier follows what it is used for and what it may do, whichever tool built it.

The registry products and the record we keep for each agent are at querynow.com/ai-agents/registry, and querynow.com/ai-agents/registry/controlling-agent-sprawl explains how to find and control unapproved agents in the tools employees use.

Section 05Training as a control

We count training among the controls. The policy works only if people know it, and the maker tiers work only if training is the gate to each tier. Europe adds a legal reason. The EU AI Act requires measures that support AI literacy, sized to the role and the risk. Article 4 has applied since 2 February 2025, and Regulation (EU) 2026/1744, in force since 27 July 2026, rewrote it: providers and deployers "shall take measures to support the development of AI literacy of their staff", with no guaranteed level for any individual. The European Commission's AI literacy Q&A, updated on 20 October 2026, says Article 4 needs no certificate and sets no strict requirements or mandatory trainings, and that supervision and enforcement apply from 2 August 2026. The measures should fit the staff's knowledge and the context and risk of the AI system, and the Q&A suggests keeping an internal record of trainings and other guiding initiatives. Germany's Bundesnetzagentur adds that the measures should be documented. Deployers of high-risk AI systems carry separate duties under Article 26, including human oversight by people with the competence and authority to exercise it.

We build the training in four layers. AI basics for every employee cover what Copilot and the approved tools may be used for and what must never go into them; this layer is the core of the AI literacy measures and of the record the Commission suggests. Copilot training per team uses that team's own documents and recurring tasks. Maker training comes before anyone gets Copilot Studio rights, and it covers the tiers, the data policy, the register record and how to retire an agent. IT handover training covers running the controls: the registry, the SAM reports, DLP alerts and the audit search.

The evidence base is thinner than vendors suggest. No public study we know of compares role-based with generic Copilot training. What exists is observational. The UK cross-government Copilot experiment concluded that "training was essential to achieve benefits of the tool". HMRC's users asked for "more practical and tailored training" and time to learn. BCG's AI at Work 2025 survey of more than 10,600 employees found regular use sharply higher among people who received at least five hours of training, which is a correlation and not proof.

Admins can also point people to the policy at the moment it applies. A DLP policy tip can link to the company's own guidance, and admins can set a custom link that people see when the Copilot app is blocked for them. Copilot Academy in Viva Learning is open to all Microsoft 365 users and can carry the product basics, which leaves the company's own training time for its policy and its teams' work.

Section 06An order of work for the first quarter after rollout

The list below is the sequence we follow. We set the schedule after we have seen the tenant and the agents already in it, and approval times move it too. The order holds either way, because each step relies on the one before it.

• Count what exists. Export the Agent Registry and reconcile it with the agents in each Copilot Studio environment, including unmanaged developer environments, and with the inventories of other agent platforms in use. Publishing in Copilot Studio alone may not put an agent in the registry, and one agent can appear there more than once. List who can author in each environment. Add the AI features switched on inside department tools, such as the CRM or scientific software, because the same policy has to cover them.
• Set an interim rule. Until the policy is signed, limit org-wide sharing of Agent Builder agents to a named group and route makers to managed developer environments. Convert each unmanaged developer environment still in use to a managed one, or move its solutions out, before 15 December 2026. Staff get a one-page rule on which tools are approved.
• Close the data gaps that agents will expose. Run the SAM data access governance reports and put Restricted Content Discovery on the sites that should not surface company-wide. Then decide whether the label-based DLP exclusion is worth the E5-level rights it needs.
• Write the policy and the tiers. The AI policy and the maker tiers go to the decision group as one document, with the approval route for new tools attached.
• Fill the register. Give every existing agent an owner and a review date, and retire the agents nobody claims. Then switch on the management rules for ownerless agents.
• Train in the order the controls need it: AI basics before wider access, maker training before Copilot Studio rights, team training alongside the first governed agents and IT handover at the end.
• Build the first governed agents. Pick a small number of workflows with a clear owner and write acceptance criteria before the build starts. Measure the result against how the team works today.
• Hold the first review. At the first review date, owners confirm or retire their agents, and the decision group reads the register next to the training records.

For a company starting in November 2026, several Microsoft dates fall inside this window. From 15 November 2026 nobody can create a new unmanaged developer environment. Existing ones are suspended from 15 December, with everything in them unavailable, and deleted from 15 January 2027. New Copilot offers need no Microsoft 365 base subscription from 1 December 2026, usage-based billing becomes the default for new Copilot Business purchases through partners from January to March 2027, and in February 2027 users without a licence lose access to apps in managed environments. Step two exists partly because of the developer environment dates: anything a maker built in an unmanaged developer environment goes with it unless the environment is converted or the work is moved.

Section 07The regulated variant

Regulated companies, and any company with staff in Europe, run the same stack, but some uses need an assessment or an approval before they start, so those go into the plan from the beginning. Under Article 35 of the GDPR, a controller must assess the impact before processing that is likely to result in a high risk to people's rights and freedoms, in particular with new technologies, and must seek the advice of its data protection officer. For Copilot and agents that read staff and customer data, we plan for a data protection impact assessment (DPIA) by default. We write it with the data protection officer and then set the Copilot options it decides. Model choice is one of them: Anthropic models in Copilot are an admin choice and are currently excluded from the EU Data Boundary, so the DPIA should say whether they are switched on for European users.

In Germany, section 87(1) no. 6 of the Works Constitution Act gives the works council co-determination over "the introduction and use of technical devices designed to monitor the behaviour or performance of the employees". Copilot audit records and agent logs record what employees did, so a company with a works council needs its agreement before rollout, and again before new agents change what is logged. We prepare the information pack and the technical annexes for the works agreement, including what the audit and usage data may be used for and what it may not.

Using Copilot to draft and summarize is not on the EU AI Act's high-risk list, but an agent can move onto it. Annex III lists AI systems used to filter job applications and evaluate candidates, or to monitor and evaluate the performance and behaviour of workers. Under the amended timetable, those high-risk obligations apply from 2 December 2027. The maker tiers should keep an HR agent of that kind out of the personal and team tiers, and the register should flag it for the compliance lead.

GxP is the family of good-practice rules that govern regulated work in pharmaceutical manufacturing and laboratories. In GxP work the line we draw is short: AI drafts, people decide and sign. AI is never the source of GxP data or conclusions, and GxP locations stay out of Copilot and its agents until a use has been approved and, where the rules require it, validated. Keeping them out takes more than one setting. Restricted Content Discovery keeps GxP sites out of company-wide search and Copilot answers, and Restricted Access Control closes them to people outside the GxP group. Neither stops Copilot for a GxP employee who can open the site. For those users the keep-out rests on the label-based DLP exclusion, or on label encryption that withholds the extract right from them, since Copilot can still use encrypted content for anyone who holds it. We test each Copilot experience and agent connection in the tenant before the quality lead approves a use. Changes to GxP locations go through the change control in the quality system. An agent that drafts a deviation summary for a reviewer sits inside that line. An agent that writes to a validated system or closes a record sits outside it. Our page for life-sciences teams, querynow.com/solutions/m365-copilot-gxp-readiness, describes the same work built to GxP expectations.

Section 08What to decide this quarter

The decision group needs to settle a short list before the agent count grows. The first item is who may build: whether the default tiers fit the company, and who signs off a company-wide agent. The second is licences: whether the label-based DLP exclusion and Audit (Premium) justify E5-level rights or a Purview Suite, and whether any agents will act on their own and so need Agent 365 for Conditional Access and agent-level audit. The third is ownership of the register itself, which works best with one named person in IT and a review cadence the decision group sets. The fourth is the regulated work described in the previous section, which has the longest lead time.

Microsoft's list prices help the CFO frame the licence decision. The figures below are Microsoft's own, as of November 2026, and the promotions among them end on 31 December 2026. Metered use is a separate line. Advanced features such as Copilot Cowork are billed in Copilot Credits. In enterprise tenants that billing stays off until an admin creates a spending policy, while new Copilot Business purchases through partners will have it on by default from January to March 2027, with a default limit of 4,000 Copilot Credits per user per month that admins can change. The CFO should decide who may create or raise a spending policy, and any company-wide agent that uses metered features should carry a budget owner in its register record.

Microsoft Ignite runs from 17 to 20 November 2026, two weeks after the date of this paper, and several statements here rest on features that are in preview or dated. We will recheck these first: whether DLP blocking of sensitive prompts, and blocking Copilot from using external emails to generate answers, reach general availability; whether Microsoft adds a switch to stop Agent Builder creation; whether Agent 365 and E7 licensing or capabilities change; the names of the Copilot licences; and the split between DSPM and DSPM for AI (classic). We will update this paper after the event and date the change.

We do this work as an engagement we call Copilot AI Foundation: discovery, the data foundation, the AI policy with a tool register and maker tiers, an agent register, training in four layers and a measured pilot, with a regulated track for European and GxP requirements. We have set up data and AI foundations, from sensitivity labels and DLP to the AI policy, at Tillotts Pharma and Burckhardt Compression. Since 2014 we have delivered more than 200 production deployments on AI and the Microsoft platform, we have been a Microsoft partner since 2015, and our teams work from Texas and Munich. Every engagement starts with one scoped workflow and a written definition of done. Commercial terms are set in the statement of work.

What to do with this on Monday morning

1. 1. Export the Agent Registry and count two numbers: agents with no owner, and agents shared beyond the team that built them.
2. 2. Check the sharing setting for Agent Builder agents and limit org-wide sharing to a named group until the maker tiers are signed.
3. 3. Turn on environment routing so Copilot Studio makers land in managed developer environments, and convert or empty the unmanaged developer environments still in use before they are suspended on 15 December 2026.
4. 4. Run the SharePoint Advanced Management data access governance reports and apply Restricted Content Discovery to the sites that should never surface in company-wide Copilot answers.
5. 5. Decide with your Microsoft partner whether you need E5-level rights for label-based DLP and whether any agent needs Agent 365, using the licence table in this paper.
6. 6. Put a review date on every team agent, and start an AI literacy record that lists who received which training and when.