Microsoft Power Platform enables organizations to build low-code apps and automation within your established governance, controls, and operational models. This framework can be applied to AI agents as well. Microsoft Copilot Studio is built upon the developments and experiences from Power Platform, allowing organizations to utilize their existing resources.

Copilot Studio plays a leading role in the agent shift. According to Microsoft’s FY25 Q3 earnings release, Copilot Studio has been used by over 230,000 organizations, including 90% of the Fortune 500¹. IDC project 1.3 billion AI agents by 2028². The scale and speed of adoption make one thing clear: governance is emerging as a critical priority.

CIOs should consider these five key areas:

1. A Governance Mindset Is Essential for Agents
2. Low-code Lessons Apply Directly to Agents
3. Driving Visibility, Cost Control, and Business Value
4. Empower Innovation with Guardrails
5. Community, Training, and Experimentation Drive Adoption

1. A Governance Mindset Is Essential for Agents

Agents don’t just respond to prompts. They initiate actions and operate across disparate systems. That means governance can’t be static. It must evolve to cover the growing agent behaviors and industry requirements.

Begin by considering agents as digital labor. Assign them trackable identities, define their roles and permissions, and continuously monitor their behaviour and performance.

According to Microsoft’s 2025 Work Trend Index, Frontier Firms—organizations powered by intelligence on tap and human-agent teams—are emerging through three phases of AI evolution: from assistants to digital colleagues running entire businesses processes. This progression is redefining collaboration, as humans shift from users to orchestrators of digital labor.

Not every agent should have the same level of autonomy. Some might only perform low risk activities like answering questions. Others, like a sales development agent, might handle RFPs and pricing proposals autonomously. CIOs should define tiers of autonomy and enforce them with technical guardrails. Just like you wouldn’t give a new hire full system access on day one, agents also need scoped permission and supervision. Consider the agent supervision across review, monitor and protect depending on the agent complexity.

Reviewers are responsible for identifying and reviewing AI-generated output and content to verify accuracy. Monitors observe and track the actions of AI and agents, enabling human or AI-based follow-up as necessary. Protectors have the ability to adjust or restrict AI and agent actions and permissions.

2. Low-code Lessons Apply Directly to Agents

If you have experience with Power Platform, you’re already familiar with this process. You can apply the same playbook: establishing a center of excellence, enforcing security measures like Data Loss Prevention policies, managed environments, and role-based access controls to agents as well.

Maintain consistency by applying your existing compliance, security, and audit frameworks to agents, updating them for new behaviors as needed. In addition to using Power Platform Admin Center, leverage other Microsoft tools like Purview and Entra ID, and ensure your governance framework supports safe innovation.

Additional IT guidance content can be found on the adoption site.

3. Driving Visibility, Cost Control, and Business Value

Visibility is the foundation of effective agent governance. Without it, agents can proliferate unchecked, leading to redundancy, security gaps, and unnecessary costs. This is why CIOs must establish reliable telemetry that offers deep insight into who created an agent, what data it accesses, how often it’s used, and the resulting impact on the organization’s resources.

Fortunately, tools like Copilot Studio’s built-in analytics and Power Platform Admin Center offer the transparency and insights to manage agent usage and costs effectively. By tracking consumption and reviewing performance regularly, teams can identify underused or redundant agents, forecast expenses with tools like the cost calculator, and ensure agents stay aligned with strategic goals.

Read the agents cost management E-book here

While managing costs helps keep investments in check, it’s the business value that ultimately justifies them. CIOs should look beyond usage limits and budget forecasts to ask a more strategic question: what outcomes are agents actually driving? This shifts the focus from spend to impact.

Ultimately, governance without visibility is just guesswork. Robust telemetry ensures that every agent is accounted for, managed wisely, and contributing to safe, scalable innovation.

4. Empower Innovation with Guardrails

The people closest to the work often have the best ideas for how agents can help them. Empowering business teams to build their own agents can accelerate innovation and speed.

But empowerment without guardrails is a risk. All agents must operate within strict security and compliance boundaries. Enforce permission models so agents only access authorized data sources. Use environment strategies and connector policies to keep sensitive data safe and audit each key step.

A zoned governance model, with centralized policy and progressive autonomy, gives CIOs a scalable way to manage agents. IT sets boundaries allowing business units to innovate safely within these zones:

• Zone One: Personal Productivity – The entry point for experimentation and innovation provides isolated environments where individuals can safely explore agent capabilities, guided by governance and security policies.
• Zone Two: Collaboration – This zone supports team-based agent development with stronger controls, including environment-level policies, connector restrictions, and operational oversight. It enables broader adoption while maintaining compliance and consistency.
• Zone Three: Enterprise Managed – The most advanced zone, designed for production-grade agents. It includes enhanced security protocols, continuous monitoring, and structured lifecycle management. This zone supports complex, cross-functional and autonomous agent scenarios with full visibility, scalability, and strategic alignment.

Scaling agent deployment effectively requires not just the right tools, but also thoughtful organizational structures and clear assignment of roles and responsibilities. Establishing rhythms and governance frameworks ensures responsible agent management across the organization.

As organizations operationalize agents and build the structures to support them, CIOs will likely encounter demand for roles that didn’t exist just a few years ago. They’re emerging in response to the unique demands of building, governing, scaling, and securing AI and agent systems responsibly.

5. Community, Training, and Experimentation Drive Adoption

People are the engine behind every successful technology initiative—and AI and agents are no exception. The biggest challenges in agent governance aren’t technical. They’re cultural. To succeed, you need more than policies and platforms. You need people who are bought in, equipped, and empowered. 

Build an active agent community hosting events such as “Agent Show-and-Tell” and hackathons. Acknowledge successful projects and appoint departmental champions to mentor others and drive adoption.

Training should cover both agent development and guidance on responsible governance. Support users with learning paths based on their different AI readiness levels and take advantage of the agent creator community.

Support experimentation within a structured framework. The Center of Excellence should manage best practices, training, and governance, gathering insights to improve and scale effective approaches.

What to Do Next

CIOs are uniquely positioned to lead the agent transformation by building and evolving on what already works. The governance models, CoEs, and controls you’ve established for Power Platform don’t need to be reinvented, they need to be extended to incorporate agent autonomy, decision making and responsible AI.

Calls to action:

1. Governance is the foundation, not the finish line.

Agents introduce new opportunities but also risks and responsibilities. CIOs must lead with a governance mindset that treats agents like digital labor—assigning identities, defining autonomy, and enforcing oversight through familiar tools like PPAC, DLP, Purview, and Entra ID.

2. Culture will make or break your agent strategy.
Technology alone won’t drive adoption. Build a community of practice, empower champions, and invest in training that reinforces not just how to build agents—but how to govern them responsibly.

3. Ready to operationalize? Start here.
Download the e-book for detailed insights and a shareable copy of the five sections.

Check out these additional resources to get started

• Agent Governance Whitepaper
• Implementation Guide
• Agent Success Kit
• Agents Cost Management E-Book
• Agent Creator Community
• How to deploy transformational enterprise-wide agents: Microsoft as Customer Zero

Citations:

1: Microsoft Earnings Release, Call Transcript, FY25, Q3

2: IDC Info Snapshot, sponsored by Microsoft, 1.3 Billion AI Agents by 2028, #US53361825 and May 2025

Disclaimers

This blog is for informational purposes only and does not constitute legal, regulatory, or compliance advice.

The strategies, tools, and governance models referenced herein are based on Microsoft technologies and may not be suitable for all organizations, industries, or jurisdictions.

Any forward-looking statements are subject to change and should not be interpreted as commitments or guarantees.

The post Evolving Power Platform Governance for AI Agents appeared first on Microsoft Power Platform Blog.

Keep reading to learn more about the benefits of automation through conversational bots and how you can get started. You can also watch this on-demand webinar to see it in action.

Digital transformation with conversational bots

Organizations across all industries need to automate business processes to innovate, save costs, and serve employee and customer needs. But what if you could take it a step further and add personalization via a conversational experience, improving the availability of your automation?

Power Virtual Agents support a variety of scenarios; from customers who are looking to update contact details to employees enrolling in their healthcare plans, to simple responses from a customer care team—all of these scenarios can be supported through Power Virtual Agents bot topics powered with Power Automate workflows.

We have seen customers adopt this approach for several reasons including:

• Artificial intelligence helps understand the user’s natural language, enabling the bot to route conversations to the correct topic or automation, even if the query contains errors such as spelling mistakes.
• Personalized and human-like experiences for customers and colleagues through gathering user intent and reusing information from the Microsoft Graph and Microsoft Azure Active Directory.
• Meet users on channels that work for them. Easily embed conversational bots wherever you engage, from websites, mobile apps, Facebook, Microsoft Teams, and dozens more.
• Improve over time. Identify new conversational topics and opportunity for automation through AI-powered topic suggestions.

Check out the quantifiable return on investment (ROI) associated with automation through conversation completed through these Forrester Consulting studies.

Results are for a composite organization based on interviewed customers. These are the Total Economic Impact™ commissioned studies conducted by Forrester Consulting.

How do they work together?

Seamlessly bring your Power Automate flows into Power Virtual Agents conversations

You can perform an action in Power Virtual Agents by calling a Power Automate flow. Flows can help you automate activities or call backend systems such as searching for the status of a customer order or booking an appointment.

The flow could call out of a plethora of Power Automate tools from digital process automation with the over 450 prebuilt connectors to triggering robotic process automation through Power Automate for desktop.

You can get started by:

1. Navigating to your Power Virtual Agents topics and select “Call an Action” in the node section.

2. Using the Create a flow option opens a starter flow template to begin creating your automated workflow. Now you can create flows that can complete a number of activities within your organization such as updating line of business applications based on the response from the end-user.

Find more information on adding actions to a bot using Power Automate.

Bring Power Virtual Agents into your Power Automate workflows with proactive messaging (preview)

Following Microsoft Ignite’s announcements for Power Virtual Agents, bot builders will be able to send proactive messages with Power Virtual Agents within Microsoft Teams, supported by Power Automate. The proactive message can be sent to a user or group with full context, based on external trigger events.

To get started:

1. You will need to create a Power Automate flow, select “post message in a chat or channel” and select your Power Virtual Agents bot.

2. You can then post as messages, adaptive cards, or adaptive cards with responses unlocking endless use cases within your organizations from HR, IT, to legal departments.

Find the full guidance and technical information on how to send proactive messages and cards from and to bots in Microsoft Teams.

How is Microsoft using automation through conversation?

Sometimes we get asked, how does Microsoft “eat our own dog food?”, well you may have noticed the Power Virtual Agents bot across all pages in Power Automate. Power Virtual Agents has been a great addition to helping enable users who have questions about the Power Automate product. The bot can answer your general questions like, “How do I share a flow or even specific questions” or “Why is my flow running slow”.

You can test out the bot in the bottom left of each of the Power Automate web pages (for example Flow, Process Insights, AI Builder).

Find more information on Power Automate Cloud Flows.

Customers modernizing their processes through automation through conversation

Learn more about ÖBB and City of Ottawa.

The City of Ottawa used Power Virtual Agents to respond to the COVID-19 pandemic. Power Automate was used to support the system fallback topic which will pull relevant content from QnA Maker, the knowledge base into the bot.

ÖBB also uses Power Virtual Agents and Power Automate to streamline customer service workflows so that as it expands its bot’s capabilities, it can deliver completely optimized ticket, travel, and rebate services through one chat window.

Learn more

We are excited to see your automation and bots come to life. Don’t forget to watch the demand session on “Automation Through Conversation with Power Automate and Power Virtual Agents” and use the below resources.

• Learning material.
• Find a community.
• Product blogs.
• Certifications.
• Customer stories.

Get started with Power Virtual Agents and Power Automate to begin your digital transformation journey.

Sources:
¹The Total Economic Impact™ Of Power Automate, a commissioned study conducted by Forrester Consulting on behalf of Microsoft, April 2020

²The Total Economic Impact™ Of Microsoft Power Virtual Agents, a commissioned study conducted by Forrester Consulting on behalf of Microsoft, October 2021

The post Automation through conversation with Power Automate and Power Virtual Agents appeared first on Microsoft Power Platform Blog.