IT Governance Controls for Your Copilot agents

By Ryan Jones, Partner Director of Product Management, Power Apps

September 16, 2024

In today’s rapidly evolving digital landscape, organizations are constantly seeking innovative ways to enhance productivity and streamline operations. Microsoft 365 Copilot is at the forefront of this transformation, offering a suite of governance capabilities that empower organizations to harness the full potential of generative AI.

With Microsoft 365 Copilot, makers can develop powerful agents directly within Teams. These agents can be tailored to meet specific organizational needs, providing seamless integration and enhanced functionality. But the innovation doesn’t stop there. Now, through Microsoft Copilot Studio now included in Microsoft 365 Copilot, makers can extend the capabilities of these agents, creating robust solutions that drive efficiency and effectiveness.

Once these agents are created, administrators can apply a comprehensive set of features to govern their generative-AI solutions. This includes granular control over sharing and data extensibility, ensuring that sensitive information remains secure and accessible only to authorized users. Additionally, admins gain visibility into usage patterns, enabling them to monitor and optimize the performance of their AI solutions. With tools designed to enforce governance strategies, organizations can confidently deploy and manage their AI initiatives, knowing they have the necessary controls in place.

Key Governance Features

Copilot governance page in the Microsoft Power Platform admin center: a central administration page to empower admins with guidelines, visibility and controls to manage their Copilots and Copilot agents adoption at scale.
Data Policies – managing Power Platform connectors: Data policies play a crucial role in ensuring data security and compliance. Data Policies allow IT administrators to permit or restrict the use of specific Power Platform connectors, to prevent the use of unauthorized data sources. See Configure data loss prevention policies for copilots – Microsoft Copilot Studio | Microsoft Learn to learn more.
Data Policies for blocking Anonymous Access, blocking Publish and more: Data Policies offer admins to configure a set of additional policies dedicated for Microsoft Copilot Studio, these policies allow IT to set access controls and prevent makers from building copilots for non-authenticated users, restrict makers from publishing to specific channels like Facebook, or block makers from publishing their solution all together before certifying the solution by IT.
Sharing Limits: IT administrators can configure limits to prevent makers from sharing non-certified solutions too broadly. IT can ensure that copilots are shared only with a limited set of users until the solutions are reviewed and are certified, ensuring makers have followed the organization guidelines. This capability is in preview and will be made publicly available shortly.

Sharing copilots with Editor permissions

Sharing Copilots with viewer permissions modal

Environment Rules, Groups, and Routing: These features allow IT administrators to create environment groups, define environment-specific rules, and route makers to personal development environments to build their copilots. Enterprises can use these features to adopt an advanced environment strategy that allows makers to create copilots and agents in personal environments. And with Pipelines and Solutions Explorer, makers can easily mature the copilots and agents they build from development to production using the streamlined application lifecycle management (ALM) experience, where IT can certify solutions before, they are shared broadly. To learn more about how to manage adoption of copilots at scale using these capabilities see Develop a tenant environment strategy to adopt Power Platform at scale | Microsoft Learn.
Maker Onboarding: Maker Onboarding simplifies the process of onboarding new makers and developers. IT can provide a custom welcome message to greet makers with step-by-step guidance and resources to help them start building and managing copilot applications. Admins can provide customized welcome content to help makers get started. This content can replace the default first-time help experience and include company-specific resources, training guides, and links to internal events.
Advisor: Advisor offers administrators a set of out-of-the-box recommendations and best practices guidance to help admins stay on top of the ongoing adoption of copilots and agents. The system continuously scans your environment and identifies copilots and agents that need IT attention. Administrators are provided with regular recommendations on gaps to go address with clear actions to perform to properly respond to these gaps. It helps IT administrators make informed decisions and ensures that their copilot implementations align with organizational guidelines and compliance requirements.
Catalog: Catalog provides a centralized repository for IT and Center of Enablement teams to offer standard and sharable controls, such as certified custom connectors, official organizational templates and more. IT administrators can easily manage, categorize, and certify reusable controls that then can be easily consumed by makers, simplifying the creation of more complicated solutions, promoting reusability and adherence to company guidelines.
MIP Labels: Microsoft Information Protection (MIP) Labels provide an additional layer of security and compliance. IT administrators can integrate the Microsoft Copilot Studio with Microsoft Purview sensitivity labels, forcing copilot content to get tagged with labels based on the MIP labels of the Microsoft 365 content, and ensure that sensitive data is properly labeled and managed according to organizational policies.
Audit Logging to Microsoft Purview: Copilot audit logging to Microsoft Purview captures interactions and activities within the Copilot environment. This includes logging user commands, responses generated by Copilot, and any administrative actions taken. These logs are securely stored and accessible through the Microsoft Purview compliance portal, allowing for thorough auditing and compliance checks. This ensures transparency, security, and accountability in the use of Copilot, aligning with organizational compliance and security policies.
Copilot Security checker: Each copilot is designed to be secure by default, but there is a possibility for makers and their admins to adjust settings for specific needs, potentially without being aware of the risks involved. We’re excited to introduce a new feature in Copilot Studio that alerts makers to security concerns.
Copilot Studio will now automatically perform security assessments and provide warnings to makers before they publish a copilot.
Security page: in the Power Platform admin center – a consolidated experience that help administrators to navigate the complexities of managing security for Power Platform workloads, including Copilots and Copilot agents, at enterprise scale.

Enhancing Governance Strategy for AI

Including Copilot Studio as part of Microsoft 365 Copilot significantly enhances the governance strategy for AI in your organization. By leveraging these governance features, IT administrators can ensure that all copilot experiences are managed, monitored, and governed effectively. This comprehensive approach to governance not only enhances data security and compliance but also empowers organizations to innovate and scale their AI-powered solutions with confidence.

Leading AI Growth through Governance

The governance capabilities of Microsoft 365 Copilot, combined with the powerful tools available in Microsoft Copilot Studio and the Power Platform admin center, provide IT administrators with unparalleled control and oversight. These features not only ensure that generative-AI solutions are deployed securely and efficiently but also empower organizations to expand their AI footprint with confidence.

IT admins play a pivotal role in this journey, acting as the architects of innovation and the guardians of data integrity. By leveraging the rich set of governance tools, they can manage sharing and data extensibility, gain visibility into usage patterns, and enforce robust governance strategies. This level of control fosters a secure and compliant environment, allowing organizations to fully embrace the transformative potential of generative AI.

As we look to the future, the possibilities are boundless. With the right governance in place, organizations can unlock new levels of productivity, creativity, and efficiency. Microsoft 365 Copilot, along with Microsoft Copilot Studio and the Power Platform admin center, is not just a set of tools—it’s a catalyst for growth and innovation. Together, we can build a future where AI-powered solutions are seamlessly integrated, responsibly managed, and poised to drive success in the digital age.