{ "schemaVersion": 2, "id": "microsoft-agent-governance", "path": "microsoft/agent-governance", "title": "How to govern AI agents across Microsoft", "shortTitle": "Agent governance across Microsoft", "description": "Start with one agent, one owner, and one unanswered question. Learn where to look across Microsoft without mistaking any one admin screen for the whole truth.", "targetQuestion": "How should an organization govern agents across the Microsoft cloud?", "directAnswer": "Start with one agent that matters. Name its business owner, inspect both the machine identity that lets it authenticate and any user-shaped collaboration identity it uses, and ask what it can reach, what it has done, who may approve a change, and how you will verify the result. Microsoft spreads those answers across several truthful but partial systems, so keep the evidence joined without pretending one screen knows everything.", "directAnswerSourceIds": [ "agent-registry", "agent-roles", "copilot-environments", "copilot-analytics", "purview-copilot-audit", "graph-agentidentity", "graph-agentuser" ], "scope": "This is a practical operating guide for workplace teams reviewing agents across Microsoft 365, Copilot Studio, Power Platform, Entra, Microsoft Graph agent identities and agent users, Azure, and adjacent GitHub workflows. It shows teams where to look for evidence and how to turn the records available in their tenant into an accountable decision.", "evidenceLevel": "Primary-source operating guide", "published": "2026-07-27", "updated": "2026-08-07", "indexLabel": "Microsoft", "author": { "name": "Celest", "url": "https://celest.dev/" }, "sections": [ { "id": "start-with-one-agent", "heading": "Start with one agent in one working session", "blocks": [ { "type": "paragraph", "text": "You don't need to solve the whole estate before doing useful governance. Choose an agent people rely on, bring together the person accountable for the work and the person who understands the platform, and leave the session with one honest result and one named next step." }, { "type": "list", "items": [ "Choose one agent tied to real work, important data, or a decision your team cares about.", "Name a business owner and a platform owner. One person may fill both roles, but the responsibilities are different.", "Open the source records you already trust. Record when each source was checked and whether it answered the question.", "Write down what is confirmed, what needs attention, what remains unknown, who acts next, and how the team will check the result." ] }, { "type": "callout", "label": "The useful unit of progress", "text": "One agent. One owner. One unanswered question. One next step." }, { "type": "paragraph", "text": "These steps get a first review moving. The full seven-question operating loop also asks what the system of record says after work runs. That verification step is covered in Analytics is evidence, not authority." } ] }, { "id": "where-to-look", "heading": "Where to look in Microsoft", "blocks": [ { "type": "paragraph", "text": "No single portal answers every governance question. Start with the row that matches the question in front of you, then keep the source and observation time attached to the answer." }, { "type": "table", "caption": "A practical map of Microsoft agent evidence", "columns": [ "Question", "Start here", "What it can establish—and what it can't" ], "rows": [ [ "What agents exist?", "Microsoft 365 admin center: Agent Registry and Agent Map", "Visible inventory, ownership gaps, and lifecycle posture. It is a front door, not proof that every agent or relevant record is present." ], [ "Who owns it, and what access does it have?", "Microsoft Entra and linked agent identity records", "Technical owner, business sponsor, runtime-facing agent identity, linked agent user, permissions, sign-ins, group memberships, licenses, and access policy. It doesn't establish whether the agent is useful or behaving well." ], [ "What can it reach?", "Copilot Studio and Power Platform", "Environment, tools, connectors, knowledge, connections, sharing, and data policy. Configuration shows potential reach, not what happened in one run." ], [ "What has it done?", "Copilot Studio analytics and Microsoft Purview", "Operational usage and an auditable interaction record, with different coverage and retention. A gap in one source is not proof of non-use." ], [ "What is risky right now?", "Microsoft Defender", "Supported posture, recommendations, alerts, protection, and investigation. Unsupported tools or integrations remain outside that evidence." ], [ "How did it run in an engineering workflow?", "Microsoft Foundry tracing or GitHub AI controls, when applicable", "Run-level traces or coding-agent policy and activity. Neither replaces tenant ownership, identity, or business-purpose evidence." ] ], "rowSourceIds": [ [ "agent-365-overview", "agent-registry", "agent-roles" ], [ "entra-agent-identities", "graph-agentidentity", "graph-agentuser" ], [ "copilot-environments", "power-platform-data-policy" ], [ "copilot-analytics", "purview-copilot-audit" ], [ "defender-agent-inventory" ], [ "foundry-agent-tracing", "github-ai-controls" ] ] } ] }, { "id": "join-the-records", "heading": "Join the records without erasing their limits", "blocks": [ { "type": "paragraph", "text": "Two admin screens can both be correct while answering different questions. Bring their records together, but keep four things attached to every answer: where it came from, when it was observed, whether the source was healthy, and whether another source disagreed." }, { "type": "callout", "label": "Unknown is useful", "text": "If no healthy source answered, keep the result unknown. That identifies an access, telemetry, ownership, or identity problem to fix; it doesn't prove the agent is safe, unused, ownerless, or healthy." } ] }, { "id": "treat-identity-as-a-pair", "heading": "Treat the runtime identity and the digital worker as different records", "blocks": [ { "type": "paragraph", "text": "Microsoft now distinguishes between an agent identity and an agent user. The agent identity is the service-principal-shaped runtime record. The agent user is a user-shaped digital worker record linked one-to-one to a parent agent identity through identityParentId. That split is useful because the runtime principal and the collaboration principal don't answer the same governance questions.", "sourceIds": [ "graph-agentidentity", "graph-agentuser" ] }, { "type": "list", "items": [ "Use the agent identity to review owners, app-role assignments, delegated permission grants, and blueprint/runtime lineage.", "Use the agent user to review mailbox, chat, group membership, licensing, manager/direct-report relationships, and sponsor coverage.", "Do not treat one record as a substitute for the other. A healthy runtime principal doesn't prove that the user-shaped collaboration surface is licensed, assigned, governed, or even present." ], "sourceIds": [ "graph-agentidentity", "graph-agentuser" ] }, { "type": "callout", "label": "Practical join rule", "text": "When a Microsoft agent uses both records, your canonical review should preserve the pair: runtime identity for execution authority, user-shaped identity for workforce semantics." } ] }, { "id": "choose-the-next-step", "heading": "Choose one honest next step", "blocks": [ { "type": "list", "items": [ "Confirmed: record the evidence and choose when this agent should be reviewed again.", "Needs attention: name the owner and prepare one bounded proposal for the person who owns the affected boundary.", "Unknown: repair the missing access, telemetry, ownership record, or identity join before making a stronger claim." ] }, { "type": "callout", "label": "Permission is not proof", "text": "Approval means go ahead; a handoff means work crossed a boundary. Check the authoritative Microsoft source again before calling an outcome verified." } ] }, { "id": "what-celest-does-today", "heading": "What Celest does today", "blocks": [ { "type": "paragraph", "text": "Celest's Agent Estate Review connects Microsoft evidence into one operating picture, produces source-backed findings, and creates a prioritized plan. It works read-only, so your tenant keeps running while the team decides what happens next. The review ends with that plan today; later action remains part of the control model." }, { "type": "paragraph", "text": "As Microsoft formalizes agent identities and linked agent users, Celest's job isn't to blur them into one comforting avatar. It is to join them honestly so an organization can see who the digital worker is, what the runtime principal can do, who sponsors it, and which decisions still require a human authority boundary." }, { "type": "callout", "label": "Bring this to a first review", "text": "One agent, the people who own its work and platform, one unanswered question, and access to the source your team already trusts." } ] } ], "limitations": [ "Microsoft product names, portal locations, roles, licensing, and source coverage change. Confirm the current boundary in your own tenant before treating a record as authoritative.", "No source listed here covers every agent type, tool, runtime, or interaction. Preview and integration-specific coverage must remain labeled.", "Analytics, audit, security, and platform traces have different retention windows and semantics. Missing data in one source doesn't prove inactivity or safety.", "This operating guide is not legal advice, a security certification, or a universal compliance checklist. Each organization must choose authorities, thresholds, and required evidence appropriate to its work." ], "sources": [ { "id": "agent-365-overview", "title": "Microsoft Agent 365 overview", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/microsoft-agent-365/overview", "accessed": "2026-07-27", "supports": "Microsoft's current framing of Agent 365 as a control plane spanning agent registry, identity, security, governance, and interoperability." }, { "id": "agent-registry", "title": "Manage agents in the Microsoft 365 admin center", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-registry?view=o365-worldwide", "accessed": "2026-07-27", "supports": "The centralized Agent Registry, ownership and unmanaged-agent views, and the boundary between central and product-specific controls." }, { "id": "agent-roles", "title": "Roles and permissions for managing agents", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-roles-perms?view=o365-worldwide", "accessed": "2026-07-27", "supports": "Tenant-wide and product-specific administrative authority for Microsoft agent governance surfaces." }, { "id": "entra-agent-identities", "title": "Manage agent identities in the Microsoft Entra admin center", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/entra/agent-id/manage-agent-identities-admin", "accessed": "2026-07-27", "supports": "Agent identity records, technical owners, business sponsors, permissions, sign-ins, and identity lifecycle administration." }, { "id": "graph-agentidentity", "title": "agentIdentity resource type", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/graph/api/resources/agentidentity?view=graph-rest-1.0", "accessed": "2026-08-07", "supports": "The service-principal-shaped runtime identity for Microsoft agents, including owners, sponsors, app-role assignments, and delegated permission grants." }, { "id": "graph-agentuser", "title": "agentUser resource type", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/graph/api/resources/agentuser?view=graph-rest-1.0", "accessed": "2026-08-07", "supports": "The user-shaped digital worker record linked one-to-one to a parent agent identity, including group membership, licensing, mailbox/chat semantics, manager, and sponsors." }, { "id": "copilot-environments", "title": "Work with Power Platform environments in Copilot Studio", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/environments-first-run-experience", "accessed": "2026-07-27", "supports": "The Power Platform environment boundary for Copilot Studio agents, resources, security, and governance." }, { "id": "power-platform-data-policy", "title": "Data policies in Power Platform", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention", "accessed": "2026-07-27", "supports": "Connector and data-policy controls applied to Power Platform and Copilot Studio capabilities." }, { "id": "copilot-analytics", "title": "Analyze agent performance and usage", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/analytics-overview", "accessed": "2026-07-27", "supports": "Copilot Studio activity, quality, tool, trigger, and knowledge analytics plus documented retention limits." }, { "id": "purview-copilot-audit", "title": "Audit Copilot and AI application activity", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/purview/audit-copilot", "accessed": "2026-07-27", "supports": "Microsoft Purview audit records for Copilot and AI application interactions and referenced resources." }, { "id": "defender-agent-inventory", "title": "AI agent inventory in Microsoft Defender", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-xdr/security-for-ai/ai-agent-inventory", "accessed": "2026-07-27", "supports": "Defender's agent inventory, risk, recommendations, alerts, tools, identities, and investigation boundary." }, { "id": "foundry-agent-tracing", "title": "Set up tracing for AI agents in Microsoft Foundry", "publisher": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/foundry/observability/how-to/trace-agent-setup", "accessed": "2026-07-27", "supports": "Opt-in run-level tracing and Application Insights prerequisites for agents hosted in Microsoft Foundry." }, { "id": "github-ai-controls", "title": "Enterprise policies and features for GitHub Copilot", "publisher": "GitHub Docs", "url": "https://docs.github.com/en/copilot/concepts/policies", "accessed": "2026-07-27", "supports": "The enterprise policy boundary for Copilot features, models, and coding-agent availability in GitHub." } ], "related": [ { "title": "Analytics is evidence, not authority", "url": "https://celest.dev/learn/analytics-is-evidence-not-authority", "description": "See how adoption, cost, and value signals fit into an operating review without becoming ownership, authority, or verified state." }, { "title": "A practical guide to governing AI agents at work", "url": "https://celest.dev/learn/agent-governance-controls-matrix", "description": "Use the six questions without depending on any one vendor or admin portal." }, { "title": "The Agent Estate Review methodology", "url": "https://celest.dev/learn/agent-estate-review", "description": "See how Celest connects Microsoft records into one operating picture and plan." }, { "title": "Review one agent with Celest", "url": "mailto:founders@celest.dev?subject=Microsoft%20Agent%20Review", "description": "Bring one agent, one unanswered question, and the source your team trusts." } ], "publication": { "canonicalUrl": "https://celest.dev/learn/microsoft/agent-governance", "mcpUrl": "https://celest.dev/learn/microsoft/agent-governance/mcp", "sourceDigest": "sha256:e653ba0372994cf754fefa4a21913b656fc5302d91e5855a62f62edccbb38060" } }