Our Microsoft Digital engineers saw a better way forward: a single intelligent workspace, powered by an AI agent that makes identifying problems, troubleshooting them, and sharing context much quicker and simpler.

What began as a side project, inspired by a hackathon, quickly grew into a cross-team initiative.

“People were passionate about this project,” says Payal Awasthi, a senior software engineer in Microsoft Digital, the company’s IT organization. “Whenever people had some free capacity, they were coming in and contributing to it.”

The tool, called Smart DRI Agent, now supports over 40 teams at Microsoft, delivering more than 7,800 AI-assisted interactions and nearly 6,000 proactive incident notifications. This has saved the company an estimated 600 engineering hours per month, with bigger gains projected in the future.

“It saves a lot of time on context switching,” says Bhupesh Guptha Muthiyalu, a principal engineering manager in Microsoft HR. “The DRIs have ready-made information in hand, and based on that they’re typically able to resolve the incident quickly.”

Bringing all incident info into one place

In Microsoft Digital, our engineers serve as designated responsible individuals, or DRIs, who oversee production scenarios on a rotating basis. Their responsibilities include investigating incidents, monitoring service health, reviewing security work, and responding to other operational issues—work that can be both time sensitive and stressful.

“Whenever a new incident comes in, a DRI might have to elevate a lot of production permissions before they can get any insight into it. That’s one of the reasons we wanted to build something that can bring all the information into one place.”

Payal Awasthi, senior software engineer, Microsoft Digital

Meanwhile, the information that our DRIs need to take action on is typically distributed across several different portals and dashboards, along with troubleshooting guides, SharePoint sites, OneNote notebooks, and other engineering documentation.

Finding and assembling that information takes a while. For engineers who are new to a service or take over an unfamiliar DRI rotation, it can take even longer, as they may have to seek out the right subject matter expert to understand the situation.

“Whenever a new incident comes in, a DRI might have to elevate a lot of production permissions before they can get any insight into it,” Awasthi says. “That’s one of the reasons we wanted to build something that can bring all the information into one place; you don’t have to spend a lot of time switching between portals and elevating permissions.”

In some cases, important context can get lost in the shuffle, which can bog down the process and make it harder for DRIs to take the necessary next steps to resolve an issue.

“We depend on DRIs to be very proactive, and monitor these services 24/7 to make sure that everything is running smoothly,” says Sudhakar Sadasivuni, a principal group engineering manager in Microsoft Digital. “As part of our company’s native AI transformation, our idea was to make live site monitoring more proactive than reactive. We thought, why not use AI to make these decisions more intelligent, so that when DRIs come into the live site situation they’re already well informed.”

“We created goals and a 30-60-90-day plan and started making it more generic, where any service could simply onboard and start using that intelligence. It’s been one of the most successful open-source projects I’ve ever seen internally.”

Sudhakar Sadasivuni, a principal group engineering manager, Microsoft Digital

Teams in Microsoft Digital and the Microsoft HR organization were exploring related ideas for helping their DRIs, although the solutions they were considering were not identical. Once the teams recognized that they were addressing the same underlying operational problem, they decided to join forces.

Engineers from the two organizations created the first iteration of the agent during a Microsoft hackathon. As the prototype developed, they decided to treat it as a more structured effort.

“Later, we realized this was something that we should seriously invest in,” Sadasivuni says. “So we did a reset: We created goals and a 30-60-90-day plan and started making it more generic, where any service could simply onboard and start using that intelligence. It’s been one of the most successful open-source projects I’ve ever seen internally.”

Fine-tuning the product

One particularly challenging part of developing the agent was taking a scattered system and making it more uniform.

“Some services respond in different ways, and the reports that DRIs generate during handoffs can differ,” Sadasivuni says. “As we started interviewing various DRI teams, the requirements were piling up. We struggled with that for two or three months; eventually, we made some design changes to make it more generic.”

The initial implementation included more hard-coded behavior, but the team later separated configuration from the core logic and allowed teams to supply templates for workflows, such as DRI handoff reporting.

“We leveraged the framework functionality, but we also built a lot of custom code to support good results and good navigation through the system,” Awasthi says.

The team used Microsoft Semantic Kernel as an orchestrator. Different operational domains, such as incident management and Service 360, use separate sets of functions. The orchestrator determines which functions to call in response to a request.

“It’s easy, and there’s no limit on the number of services that I can query. That’s one of the biggest advantages that this agent brings.”

Lakshmi Kothamasu, principal engineering manager, Microsoft Digital

For similar-incident retrieval, the solution indexes incident information in Azure AI Search. The team found that search indexing alone didn’t always return useful matches, so developers added custom logic to assess similarity and improve the results supplied to DRIs. 

“It’s easy, and there’s no limit on the number of services that I can query,” says Lakshmi Kothamasu, a principal engineering manager in Microsoft Digital. “That’s one of the biggest advantages that this agent brings.”

When an incident comes in, the agent automatically provides an analysis that includes suggested troubleshooting steps and historical context from similar issues in the past, which speeds up the resolution process.

“It will connect to your telemetry and get all the relevant traces, logs, and exceptions that happened in the last few minutes.”

Bhupesh Guptha Muthiyalu, principal engineering manager, Microsoft HR

Based on the incident details, title, description, and other data, the agent will search your troubleshooting guide, identify all the matching patterns, explain how to troubleshoot this issue, and give you needed context.

“It will connect to your telemetry and get all the relevant traces, logs, and exceptions that happened in the last few minutes,” Guptha Muthiyalu says.

It can also function proactively, such as delivering a summary first thing in the morning that identifies what an engineer needs to complete that day. All of the information is presented directly in Teams, helping it to seamlessly fit into engineers’ workflows.

Looking ahead: Agentic incident management

In future iterations, the team hopes to train the agent to actually take action and mitigate some incidents for the DRIs, keeping them in the loop and enabling them to sign off on the steps the agent takes.

For teams considering a similar project, the starting point is the DRI workflow itself. Identify where engineers spend time, where information is fragmented, and which repeated steps are strong candidates for assistance. Then, connect the workflow from detection and context gathering through to mitigation and continuous improvement, while keeping real people responsible for operational decisions.

“Without a strong live site culture, where the reliability and health of production services are a priority, this agent is of no use at all,” Sadasivuni says. “They go hand in hand; otherwise, it’s an unnecessary use of computing and artificial intelligence. This agent was designed with a single goal: to empower the human DRI. So, the more the DRI is demanding, the more the system will respond.”

End-to-end coverage is also key. DRIs should be able to turn to the agent anytime, at any stage for guidance, helping engineers to move faster and with more confidence. And with even more proactive measures in place, DRI work will only become more seamless in the future.

The post Automating engineering operations at Microsoft with a Smart DRI Agent appeared first on Inside Track.

On the Infrastructure Engineering Services (IES) team within Microsoft Digital, our product managers (PMs) support the tools and services that keep Microsoft’s global network secure, resilient, and available. As Microsoft’s Customer Zero, our larger Microsoft Digital team—the company’s IT organization—is exploring how AI can accelerate individual tasks and help reshape the operating model that our PMs use to plan, govern, and communicate their work.

“One of the key things we do is make sure the most important work is getting done by the engineering teams, because our engineers are a pretty precious resource,” says Martin O’Flaherty, a principal PM manager in IES. “We need to be able to prioritize the work as it flows in. We have to understand what the engineering teams need, make trade-off decisions constantly, and make sure we’re delivering requirements and specifications that are essential for building the right thing.” 

That has led O’Flaherty and his team to experiment with AI across a broader Continuous Planning model. Rather than treat planning as a periodic exercise, this approach creates an ongoing view of the work in progress as well as upcoming priorities, deliverables, engineering investment, and strategic alignment. Planning dashboards, engineering-capacity visibility, ADO data quality, recurring leadership reviews, monthly delivery reporting, and AI-generated summaries work together as parts of the same operating model.

“We need to make sure that we’re getting the right level of leadership visibility and support. Senior leaders understand that engineering resources are finite, so they want to make sure we’re investing the right amount of resourcing in the appropriate areas.”

Martin O’Flaherty, principal PM manager, Microsoft Digital

The objective isn’t simply to automate existing PM tasks, but to also create a better feedback loop between planning, execution, data quality, reporting, and decision making, giving our PMs more time to work directly with customers and engineering partners.

Turning planning data into leadership insight

As a product management leader, O’Flaherty often has to gather reporting on his team’s scenarios, including which are active versus closed, how the work aligns to organizational priories, and how engineering capacity is being invested. This not only helps him and his team make better prioritization and trade-off decisions but also provides crucial information for advocating with senior leadership.

“We need to make sure that we’re getting the right level of leadership visibility and support,” O’Flaherty says. “Senior leaders understand that engineering resources are finite, so they want to make sure we’re investing the right amount of resourcing in the appropriate areas.”

Most of that data already exists within systems such as Azure DevOps. The challenge is gathering the information and turning it into easily digestible insights. For O’Flaherty, that became an opportunity to use AI not simply to automate reports but also to connect planning data, data quality, and leadership reporting together into a more continuous system.

To accomplish this, O’Flaherty and his team built an AI-assisted reporting capability that can comb through all scenarios completed during the previous month, organize them around established strategic priorities, and summarize the details into leadership-ready reporting and visualizations. These show where the engineering investment is going and outcomes that the organization is delivering.

Below is an anonymized example of a dashboard O’Flaherty might use in an operational planning discussion or business review to provide near real-time visibility into planning health, delivery progress, resource allocation, and overall execution:

Early on, the AI-generated reporting wasn’t always accurate or complete.

Rather than treating those missing details as an AI problem, O’Flaherty and team used them to improve the system around it. He and the team refined the reporting logic, strengthened the underlying planning data, and improved how this capability weighs the documented evidence of what was actually delivered. Human review remains an important part of the process, but the amount of manual effort required has fallen significantly.

“Last month, we had almost no feedback. We looked at the report and were like, ‘Yep, it’s good to go,'” O’Flaherty says. “We’re talking about a task that used to take weeks to do. It would be the end of August by the time you’d have July’s report. We can now send that report on the first day of August.”

During this process, O’Flaherty also learned the importance of clean, comprehensive data in getting the right outputs. Initially, missing or inconsistent information in Azure DevOps could lead to incomplete insights. And because that same planning data informs leadership reporting, improving the quality at the source became more important than improving the AI consuming it.

So, he built a second AI-assigned “hygiene” capability that continuously checks in-scope scenarios against a defined set of rules. It can identify data gaps and prompt team members with specific guidance on how to fill those gaps within Azure DevOps.

“The agent has driven the right behavior, and that’s honestly the key reason why our end-of-month reports don’t really require much human review anymore.”

Martin O’Flaherty, principal PM manager, Microsoft Digital

Together, the capabilities create a feedback loop: Better planning data produces better AI-generated insights, while AI continuously helps identify the data-quality issues that could undermine those insights.

“At the end of the day, the AI can only be as accurate as the data it has in front of it, and we were potentially making bad decisions based on that data,” O’Flaherty says. “The agent has driven the right behavior, and that’s honestly the key reason why our end-of-month reports don’t really require much human review anymore.”

Upskilling a diverse workforce

A common misconception with agents is that you need to be an AI expert to build one. O’Flaherty wanted to remove that barrier by making the process accessible to all product managers with a wide range of technical expertise. The goal was to teach people about AI and also encourage them to build capabilities against real problems in their own workflows.

As he and other team members developed their skills, they created short how-to videos of their process that broke the learning curve down into manageable steps. He began this effort by assuming the viewers knew nothing about the tools.

“We made a video on how you install Visual Studio Code, how you log into GitHub Copilot,” O’Flaherty says. “And then when you’ve done that, here’s how you access an MCP server.”

Those bite-sized explainers gave PMs a practical path into the tools and helped them to get comfortable applying what they learned directly to their own work. Rather than requiring everyone to become an AI expert first, the approach allowed people to start small, solve something useful, and build their skills through experience.

But as adoption grew, another challenge emerged: Product managers sometimes created multiple agents to solve similar problems. That presented a different scaling question: How do you encourage experimentation without recreating the same solution over and over again?

In response, the team began promoting reusable skills and encouraging PMs to build on existing work rather than starting from scratch.

“Our challenge was, how do we empower people to build without removing all the efficiencies?” O’Flaherty says. “We’ve partially solved that by creating a repository that gives people an easy way to upload stuff and encourages them to reuse where they can. Or to take the skill that’s there and customize it for their organization.”

That shift, from individual experimentation to reusable building blocks, helped turn AI adoption into more of a shared engineering discipline. PMs could still tailor capabilities to their own needs, but successful patterns could be reused, improved, and extended instead of repeatedly rebuilt.

Speeding up product planning and prototyping

For individual PM contributors, agents have made context gathering faster and simpler.

For example, Astha Sinha, a senior product manager on the IES team, says sorting through documents, meeting notes, and the various stacks her team leverages and turning that into reports could take hours every day. That was before she started using Copilot to summarize all the information for her.

Now she uses agentic skills to automate the reports that she sends to different PMs each month, further simplifying her everyday routine.

“One of the biggest benefits has been automation, which I’m empowered to achieve very easily,” Sinha says. “I support multiple partners, all with different reporting rhythms, so I created a set of skills that automatically generate reports for them on the right schedule.”

What used to be a recurring manual task for her now happens in the background. It’s reduced administrative overhead and freed up more time for strategic product work, making her workload lighter.

“Now, by making my agent aware of the code base and incident reporting, and stitching together the logs and the data models, I can get that insight faster without using engineering time. Then I can take it back to my customers and actually get down to what really matters to them.”

Owais Khan, senior product manager, Microsoft Digital

Senior product manager Owais Khan, who also works on the IES team in Microsoft Digital, has also set up agents to analyze usage data.

Previously, it might have taken him a few hours to sit down and look at where customers are clicking, what kind of APIs they’re using, and what their call patterns look like, then actually investigate improvements on that site.

“Now, by making my agent aware of the code base and incident reporting, and stitching together the logs and the data models, I can get that insight faster without using engineering time,” Khan says. “Then I can take it back to my customers and actually get down to what really matters to them.”   

AI builder tools like Copilot Studio also provide a low-code solution for product managers that allows them to produce prototypes communicating their vision to engineers.

Nevedita Mallick, a principal product manager on the IES team, owns a lot of the UI experience on our corporate network. Her typical process for prototyping used to be to create a one-pager, then build out the idea manually in Figma.

“With Copilot Studio, it’s much faster,” Mallick says. “Things that used to take a day or two I can now be done in less than an hour, even in minutes. I can give a very rough sketch to Copilot Studio and it’s able to render the mockup really quickly. It also gives me the complete HTML with all the CSS and JavaScript, so I can just click through and explain to my developers, ‘This is what I want,’ or, ‘This is the enhancement I’m looking for.'”

Using AI-generated prototypes, PMs can also show customers interactive experiences earlier in the design cycle. This helps everyone align on requirements faster and reduces the amount of work required later in the development cycle.

The value of AI is amplified through thoughtful prompting and clear context.

“Prompting is everything,” Mallick says. “When troubleshooting a network issue, I asked Copilot to think like a network engineer so it could evaluate the problem through the lens of network topology, dependencies, and operational context. It moved from delivering generic answers to providing insights tailored to the problem at hand.”

The result, she says, is that the quality of your outcome is directly tied to the context and expertise you bring into the prompt.

“What once required specialized expertise and significant development time can now be done in minutes. For example, I recently created a custom skill for a specific business need in under five minutes, allowing me to move from idea to solution almost instantly.”

Astha Sinha, senior product manager,
Microsoft Digital

Practice truly does make perfect. Creating their first agents took some time, but the PMs say that the ramp-up period has significantly shortened the more they do it.

“What once required specialized expertise and significant development time can now be done in minutes,” Sinha says. “For example, I recently created a custom skill for a specific business need in under five minutes, allowing me to move from idea to solution almost instantly.”

The future of PM work

The PMs all agree that human oversight of agentic AI will always be necessary, even as they allow agents to take over some tasks.  

O’Flaherty notes that even as his agent can estimate time spent on scenarios, there are still a lot of nuances in how productivity is evaluated.

For example, while the agent can predict how many hours a specific task might take, someone also needs to factor in who’s completing the task and how fast they can work. There’s also the need for a fact-checking pass. Because of these variables, O’Flaherty believes we still need humans to gather the full picture and oversee the process.

“We’ve become agent bosses—the agents do the work and we review and approve it,” he says. “We’re almost like a governance layer for the agents in how we do our work.”

“The real opportunity with agents isn’t just efficiency, it’s prevention. By embedding intelligence throughout the operational lifecycle, we can identify and address issues before they become incidents, fundamentally changing how we operate at scale.”

Nevedita Mallick, principal product manager, Microsoft Digital

PMs are also already seeing how their work has changed, and that it will continue to evolve in the age of AI. Mallick observes how AI is enabling product managers to have more room for deep, critical thinking and broader product vision work. She’s excited to see how agents work proactively down the line.

“The real opportunity with agents isn’t just efficiency, it’s prevention,” Mallick says. “By embedding intelligence throughout the operational lifecycle, we can identify and address issues before they become incidents, fundamentally changing how we operate at scale.”

The team’s ultimate goal isn’t to automate product management, but to make it easier for PMs to apply their expertise where it matters most.

As Microsoft Digital continues its important Customer Zero work, that mission is helping shape how product managers use AI to scale their impact while maintaining human judgment, collaboration, and accountability.

The post Boosting product manager productivity at Microsoft with AI appeared first on Inside Track.

Employees at Microsoft commonly face this decision. They might require help summarizing a meeting, finding a file, understanding a benefits policy, troubleshooting a device, or reporting a facilities problem. All these needs can begin as a question in a chat interface, but they don’t require the same data, context, or follow-through.

For our employee support, we’ve consolidated around a single “front door.” The Employee Self-Service Agent gives our employees one place to go for human resources (HR) and IT help, where they can get trusted answers grounded in company policy and complete supported tasks right in the interface. That’s why this agent sits alongside Microsoft 365 Copilot Chat, rather than competing with it.

We like to guide our employees this way:

• Use Microsoft 365 Copilot Chat for productivity work involving files, email, meetings, research, and other Microsoft 365 content.
• Use the Employee Self-Service Agent for workplace support involving human resources, IT help, facilities, and related employee-service actions.

This is not a choice between a general tool and a more advanced tool. Each experience has a different job, even where they share the same underlying platform. The right choice depends on an employee’s intent, the sources required to answer their question, and whether the request needs to connect to a business process or workflow.

This distinction offers a practical lesson for other organizations developing employee-facing AI tools: A familiar chat interface is only the starting point. Meeting an employee’s need depends on having the right grounding, context, permissions, and actions for the task.

Separating productivity from service

Microsoft 365 Copilot Chat is designed for productivity work. It helps our employees reason over the work content they can access, including files, email, Teams chats, meeting data, and relevant information from the web.

That makes it a natural place to ask questions such as:

• What decisions did we make in yesterday’s meeting?
• Can you compare these two proposals?
• Can you help me research and draft a project brief?

Employee support requires a different approach. Questions about benefits, device issues, or workplace services often depend on approved policies, support records, device details, or location-specific information. They may also lead to taking an action, such as opening a case, submitting a request, or connecting with a support specialist.

At Microsoft, these scenarios are handled by our Employee Self-Service Agent. Examples include:

• Can you help me troubleshoot a credentials issue?
• Help me open an HR ticket.
• How do I submit a facilities request about broken equipment?

For organizations designing employee-facing AI, the key lesson is simple: Some queries need an answer that helps the employee do their job, while others require more specialized assistance and possibly additional action.

When employees can handle common tasks themselves, getting an authoritative answer and a way to act on it in the same conversation, we can reduce avoidable support tickets and give people a faster, less frustrating path to resolution. HR and IT support teams can then spend their time on the cases that genuinely need human assistance.

Personalize each experience for its task

For productivity work, breadth is valuable. Copilot Chat can draw on an employee’s Microsoft 365 work context and external information to help summarize, compare, research, create, and reason across content.

For employee support, authority matters more than breadth. The Employee Self-Service Agent uses Microsoft-managed sources focused on HR, technology support, and campus services, so that the agent’s responses align with established policies and support processes.

The two experiences also rely on different types of context. Copilot Chat uses an employee’s work data to help them complete productivity tasks (a feature we call Work IQ). The Employee Self-Service Agent accesses only Microsoft-managed knowledge sources focused on employee support, including HR resources, tech support content, and campus services information. It can also use workplace signals such as device information or location to guide employees to the right policy, support path, or service.

Organizations building similar experiences should define both source boundaries and contextual signals early. Identify the approved systems for each service domain, assign ownership for keeping content current, and use only the context required to deliver an accurate response.

The Employee Self-Service Agent is also evolving architecturally. It’s being re-platformed as a declarative agent running natively on the Microsoft 365 Copilot orchestrator and runtime. Building directly on the platform, rather than alongside it, means the agent stays current with the latest Copilot-supported model, answers with Copilot-native reasoning, responds faster, and inherits platform improvements automatically, while still combining deterministic workflows for predictable tasks with generative intelligence for natural conversation.

Make the right experience easy to find

Even the best AI experiences create friction when your employees don’t know where to start.

At Microsoft, the Employee Self-Service Agent is available from within the Copilot environment. People can keep it pinned in their Copilot sidebar, and then easily switch from general productivity assistance to workplace support without having to open a different interface.

This approach reduces the effort required to reach the right experience while keeping each one focused on its specific role.

Your organization should apply the same principle to your own environment. Place specialized agents where employees already work, describe them according to the problems they solve, and provide a simple decision rule. Employees do not need to understand the underlying architecture; they just need to know where to go for the task in front of them.

Use feedback to improve routing and answers

Your employees will tell you when an internal process isn’t working the way they think it should. This kind of feedback becomes especially important when multiple AI experiences can address related questions.

Our employees can offer instant ratings of Employee Self-Service Agent responses and provide comments. That input helps identify missing knowledge, unclear guidance, routing issues, and actions that don’t function as expected.

Remember that this feedback should be viewed as more of an operational signal, rather than a satisfaction score. It can reveal where employees are struggling, which knowledge sources need improvement, and how the routing between experiences could be clearer.

The broader lesson from our journey with AI-driven employee support is that no single experience can or should serve every purpose. Give each tool a clear job, ground it in the right information, provide only the context it needs, and enable actions or escalation when the scenario requires it.

Doing so creates a simpler experience for employees and clearer boundaries for the teams responsible for knowledge, support processes, and ongoing improvement.

The post Choosing the right AI experience for employee productivity and support appeared first on Inside Track.

In those early days, training sessions, nudges, champions, and outreach campaigns kept us learning and growing through experimentation—but it was difficult to build momentum.

Today, the situation is fundamentally different. With the growing acceptance of agentic AI, adoption seems less like pushing a boulder and more like tending a garden where a million flowers bloom. It’s something we cultivate rather than force, planting seeds that continue to grow as our people discover new possibilities for themselves and their teams.

How did that shift happen? A great example comes from the experience of our field teams in Microsoft Europe South.

As they discovered, the challenge of enterprise AI has definitely changed. Adoption today is no longer the primary obstacle. As agents become easier to build and use, the harder questions are shifting towards governance, trust, and helping teams navigate a safe path from experimentation to production.

Early challenges with AI adoption: The prompt gap 

The generative AI era has taught us discipline. Rolling out Microsoft 365 Copilot at scale across a company of more than 200,000 employees was never really about the model. It was about the unglamorous foundations underneath it: clean data, clear governance, and relentless change management.

Where those foundations were solid, Copilot delivered. Where they were thin, no amount of enthusiasm could compensate.

There was a quieter challenge in those early days that we rarely named: The prompt gap. Copilot worked brilliantly if you knew what to ask it, but most people did not know exactly what—or how—to ask. Successful adoption depended on teaching tens of thousands of our Microsoft colleagues to clearly phrase their intent, and every gain faded the moment their attention moved elsewhere.

It was akin to the frustrating experience of pushing a boulder up a hill only to watch it roll back down, over and over. The value of AI was real, but progress was slow.

How the physics changed

Agentic AI changed the physics. Now, an agent doesn’t need to be prompted at every step. It carries context, can take multi-step actions, and returns a result instead of a suggestion. The interaction shifted from prompting to delegating, from “help me draft this” to “handle this task for me.”

That change rewired the incentives for AI adoption. People no longer had to translate every task into the perfect prompt. Instead, they could delegate meaningful work to agentic AI and stay in the loop as it progressed. The value became easier to see, because it showed up in completed work, not just generated content.

When we introduced Copilot agents such as Cowork and Scout into our everyday work, we stopped having to repeatedly sell the idea. People no longer needed a campaign to understand the value of a digital colleague that could do the work; they just needed one good proof point from someone they trusted.

What surprised us most was how the spread of Cowork and Scout happened: Not top-down through a rollout plan, but sideways, desk to desk and team to team. Someone would use these agents to handle a recurring task, show how it worked in a meeting, and within a week three more colleagues had their own ideas for agentic workflows. The change management challenge had switched from driving adoption to creating the conditions for it—providing fertile soil, as it were.

Organic adoption: Cultivating the garden

The organic spread of agentic AI was not an accident; it was a deliberate change in how we worked with our employees. In Microsoft Europe South we tested this change most fully with local teams, such as Customer and Partner Solutions Spain.

In a pilot program for this group, we didn’t launch with an AI training initiative. Instead, we started with a pattern we had observed from hackathons and previous community sessions.

Previously, participants were enthusiastic about agentic AI, but often lacked meaningful end-to-end business problems to solve. Many of the strongest ideas overlapped with solutions already being built elsewhere, while other scenarios could be addressed through existing Copilot capabilities. Often, the biggest barrier was the perceived complexity of making sure an agent met security, privacy, accessibility, and responsible AI requirements.

So, we changed our adoption efforts, focusing more on helping employees examine their own processes and identify workflows they could automate, and then assisting them in navigating through the compliance issues.  We were asking people to challenge everything they did at work—even the routines they had never thought to question—and identify the most repetitive, manual, decision-heavy tasks that quietly consumed their week.

Across a series of ideation workshops, teams generated a wealth of agentic AI opportunities. Yet the true success of the program was not measured by the number of ideas produced, but by the rigor applied to each one. Every idea was scrutinized not only for its potential value and feasibility, but also based on a more fundamental question: Does this problem truly require an agent, or is there a simpler path to solving it?

As a result, our team introduced a basic but powerful principle: Build, Reuse, or Prompt.

Rather than assuming every problem required a new agent, opportunities were explicitly routed to the most appropriate path. Many ideas were already covered by existing solutions. Others could be solved through one or more of the following:

• Better prompts
• Copilot capabilities
• Existing agents like Cowork, Scout, or even GitHub Copilot

Only a subset of challenges justified building a new agent. This reduced duplication, clarified ownership, and ensured that effort was invested where genuinely new value could be created.

The assessment process itself became part of the adoption journey. Ideas were evaluated against existing agent usage, technical feasibility, role readiness, value measurement, and data and security considerations. We also applied an important principle borrowed from continuous improvement: Sometimes a process should be improved before it’s automated.

The shift from just “knowing how to use AI” to “thinking differently about work” was the real outcome.

By the end, a number of colleagues had moved from passive consumers of AI to active builders. The strongest agent ideas rarely came from technical teams. Instead, they came from the people closest to the work. Once someone questioned a process, identified friction, and built a solution to reduce or remove it, they rarely stopped at one idea.

Our pilot program also reinforced another lesson: AI adoption is not only about learning technology. It’s about seeing how work can change. The next measures of success are whether those agents reduce friction, shorten cycle times, improve follow-through, and free people to focus on higher-value activities.

Trust, orchestration, and tending to what grows

The tough questions we face today regarding AI adoption are about trust, orchestration, and control. Will our people feel comfortable with an agent acting on their behalf? How do dozens of independently built agents coordinate across an organization, instead of colliding? And how do we govern software that actually does the work?

To help answer these questions, agent governance became our center of gravity. We learned to build these considerations into our process, beginning with our first interactions with field teams, and not just bolt it on at the end.

“The technology opens extraordinary possibilities, but the greatest impact comes when it is combined with the right methodology, governance, collaboration, and continuous learning. Transforming ourselves in this way is helping us become a more effective organization while also making us better equipped to guide our customers through their own AI transformation.”

Doris Gomes, customer success lead, Microsoft Spain

At Microsoft, every agent has to tread the same garden path before it can be published through approved channels:

• Service Tree registration
• Security Development Lifecycle and Secure Future Initiative validation
• Privacy assessments
• Accessibility checks
• Responsible AI review

Framed early, these stopped being obstacles and became part of what it means to build well.

We also learned that agentic AI adoption accelerates when publishing feels achievable. Making the governance process visible early helped teams understand the path to production and reduced the uncertainty that often discourages experimentation.

Governing what grows also demands visibility, and this is where Agent 365 has become our control plane. It lets us monitor every agent across all environments in the Microsoft tenant, making sure the ones appearing at the edge are discoverable, secured, and accountable rather than turning into invisible sprawl.

The principle is simple: Let ideas grow freely, but never lose sight of what your garden contains.

“The technology opens extraordinary possibilities, but the greatest impact comes when it is combined with the right methodology, governance, collaboration, and continuous learning,” says Doris Gomes, a customer success lead for Microsoft Spain. “Transforming ourselves in this way is helping us become a more effective organization while also making us better equipped to guide our customers through their own AI transformation.”

Growing the agentic future

The organizations that succeed in the next phase of AI adoption will not be the organizations that push the hardest. Success will be achieved by those that cultivate with care: helping employees rethink their work, creating the conditions for experimentation, and ensuring that what grows can scale safely.

“Agentic AI is helping our teams move from working harder to working smarter. We are simplifying processes, improving operational quality, better leveraging information and insights, and creating more scalable ways to serve our customers.”

Paco Salcedo, general manager, Microsoft Spain

This is the difference between pushing a boulder and planting a seed. A boulder needs continuous force. A seed needs the right conditions—good soil, a little light, a healthy environment. The plant then grows on its own and reseeds.

We are still early on the path to the Frontier Firm future, and there are many ways for us to keep growing and improving. Trust has to be earned, governance has to keep pace with autonomy, and not every seed takes. But with the right nurturing, a brighter agentic future can flower.

“Agentic AI is helping our teams move from working harder to working smarter,” says Paco Salcedo, a general manager for Microsoft Spain. “We are simplifying processes, improving operational quality, better leveraging information and insights, and creating more scalable ways to serve our customers.”

Salcedo points to innovations such as MSX-IQ, an AI assistant built by our team for Microsoft sellers that provides a “chat with your pipeline” experience and is now used across multiple countries. Its adoption demonstrates how giving people the right tools, governance, and support can accelerate meaningful business transformation.

The post From the field: How agentic AI is reshaping adoption at Microsoft appeared first on Inside Track.

“We have different tools to detect if there’s some outage in the network. After we have those alerts converted into tickets, we work to make sure the corporate network gets back up and running.”

Neeraj Mohan, senior site reliability engineering manager, Microsoft Digital

At the scale of Microsoft, a company with more than 900 sites, 500 datacenters, and tens of thousands of network devices, those incidents translate into thousands of tickets. And each ticket requires some combination of decision making, action, collaboration, and communication.

Managing connectivity for that internal network falls to Microsoft Digital, the company’s IT organization.

“We’re like a backbone for supporting the business,” says Neeraj Mohan, a site reliability engineering manager in Microsoft Digital. “We have different tools to detect if there’s some outage in the network. After we have those alerts converted into tickets, we work to make sure the corporate network gets back up and running.”

Through agentic AI, we’re changing how that work gets done. Instead of asking people to chase every diagnostic, status update, ticket handoff, and stakeholder question, our teams are building AI agents that can sense what’s happening, act within clear limits, and validate outcomes before we do the work.

The labor behind every alert

Network operations has always depended on strong tooling, disciplined processes, and experienced engineers. The challenge is that the volume of work keeps rising.

The Microsoft environment includes more than 75,000 devices, over 300,000 users, and in excess of 1 million connected endpoints. The monthly volume of tickets that require human intervention rose as high as 70,000 in January 2025. Eighteen months later, we’d reduced it to less than half—about 27,000—through the application of automation and AI.

That showed great progress, but this many tickets a month still demands a lot of effort. Many of these tickets require enrichment to provide engineers with information like the current device state, neighboring device status, links, logs, and prior troubleshooting. Others require coordination with internal teams, datacenter operations, site services, telecommunications providers, or network device vendors.

The difficult aspect isn’t just the technical fix. It’s the time spent changing context from one system to another, checking partner portals, scheduling work windows, answering leadership questions, and validating whether a fix has actually restored service.

To make matters more complicated, we can’t let just anyone log in to network devices or run changes in a secure environment. We need to design read access, execution permissions, and human approvals deliberately.

To address these challenges, we looked across the incident lifecycle, reviewed ticket volume and manual effort, and prioritized agent opportunities based on impact, user need, and development effort. The first set of agents focused on three connected problems: dynamic troubleshooting, cross-system handoffs, and outage communications.

Three agents, one operating model

The network operations agents we’ve created aren’t a single monolithic utility. They’re a set of focused tools that map to how operations work already happens. We created them using first-party, cloud-based technologies that include Microsoft Azure OpenAI, Microsoft Foundry, Microsoft Agent Framework, Microsoft Copilot Studio, and Microsoft Teams, and then integrated them into our internal incident management (ICM) tool.

Each agent sits close to the work, respects the permissions required for network operations, and gives engineers or stakeholders the next useful action without forcing them to assemble context manually.

Falcon Agent: Fresh diagnostics on demand

Falcon Agent is the action engine in our AI network operations loop. Before this expansion of agentic capabilities, Falcon already supported automated troubleshooting and remediation for known scenarios like access-point-down incidents. A service line could onboard a scenario once, define the troubleshooting steps, and let Falcon handle repeat tickets without asking a directly responsible individual (DRI) to rerun the same actions every time.

The Falcon Agent adds an on-demand layer. If Falcon has already run a workflow and a DRI starts work later in the day, the earlier results might be stale.

“We want to be where the users are. Falcon Agent is available through Teams and the incident management tool, giving engineers a choice of where to work while keeping the controls in place.”

Shayoni (mononym only), product manager 2, Microsoft Digital

With the agent, authorized engineers can refresh troubleshooting, retrieve current logs, check device reachability, validate service restoration, and enrich the ticket with updated information. By the time an engineer opens a ticket, the agent has already refreshed and summarized the ticket.

Falcon Agent also restricts executional prompts to the right engineering users on secure admin workstations (SAWs). Meanwhile, informational prompts can serve a broader audience without exposing device-level control.

“We want to be where the users are,” says Shayoni, a product manager for Falcon in Microsoft Digital. “Falcon Agent is available through Teams and the incident management tool, giving engineers a choice of where to work while keeping the controls in place.”

Smart Bonding Agent: Closing the handoff gap

We can’t fix every incident remotely. If we need to restart a router on site, reseat a cable, access a power supply, or call in a telecommunications provider for a fiber cut, the work shifts from remediation to coordination. That’s where the Smart Bonding Agent comes in.

“This agent provides for lifecycle continuity across systems. It closes the handoff gaps where we would often lose context in the past.”

Suvodip Moitra, senior product manager, Microsoft Digital

The Smart Bonding Agent contains several flows:

• A recommendation agent reviews the incident and identifies the likely issue and the team to engage.
• A ticket steward agent creates the right ticket after human approval and monitors updates.
• A work-window scheduling flow helps connect the right people when the receiving team needs help from Microsoft engineers.

The goal is to keep the engineer in the incident record instead of asking them to jump across portals, emails, and partner systems. At the same time, human approval is intentional by design. We don’t want to reduce one team’s work by flooding a partner with unnecessary tickets.

“This agent provides for lifecycle continuity across systems,” says Suvodip Moitra, a senior product manager responsible for the Smart Bonding Agent in Microsoft Digital. “It closes the handoff gaps where we would often lose context in the past.”

As confidence improves, lower-risk workflows can move toward more automation. The agent already covers Global Datacenter Operations and Puget Sound Network Operations, with expansion underway across more issue types, telecommunications providers, and network device vendors.

Network Outage Insights Agent: Less talk, faster restoration

When a site has a network problem, engineers aren’t the only people who need information.

IT managers want to know whether their location has connectivity. Leaders are responsible for answering to business stakeholders. Help-desk teams need to know whether an employee issue is local to a device or tied to a site-level outage.

“Part of our role is knowing the people we support. This agent helps us understand who we’re serving and what the best forums are where we can interact with them, all in one place.”

Laxman Bhinnale, senior technical program manager, Microsoft Digital

Built on Copilot Studio, the Network Outage Insights Agent supports both push and pull communications. It can send targeted Teams notifications to impacted IT managers on the push side and answer natural-language queries when people need to pull answers.

An IT leader might ask, “Are there any active site outages on my campus?” The agent returns the incident link, current status, estimated time to resolve, impact, region-level details, and historical trends that can help teams spot recurring issues with a site or provider.

The agent also changes how the team learns. It can track feedback in a backlog and connect improvements back to the people who requested them.

“Part of our role is knowing the people we support,” says Laxman Bhinnale, a senior technical program manager in Microsoft Digital. “This agent helps us understand who we’re serving and what the best forums are where we can interact with them, all in one place.”

Great results, exciting opportunities

The measurable impact of our AI network operations agents is still emerging, but the signals of success are clear.

Falcon Agent users report saving around 300 hours in the first few months of operation, equating to 10–15 minutes saved per ticket. The agent has a 60% retention rate and 100% positive user feedback.

We’ve observed that Falcon can handle about 60% of total incident volume already, with an expectation it can reach about 80% as more scenarios mature. The remaining work is likely to include physical or cross-team activity where the Smart Bonding Agent is a better fit.

Meanwhile, our Network Outage Insights dashboard showed 149 outages in one month, with 32 hours saved on communications and reporting.

“The future is multi-agent orchestration: monitoring, troubleshooting, partner engagement, and communication working together.”

Raghavendran Loganathan, principal software engineering manager, Microsoft Digital

The next step is connecting these agents’ efforts. In future flows, the Smart Bonding Agent will be able to engage the right internal or external party while Falcon Agent validates that the issue is resolved. Finally, Outage Agent Insights will communicate impact and recovery status before a post-incident agent generates the postmortem. Each agent keeps its focus, but the work moves as one incident lifecycle.

“The future is multi-agent orchestration: monitoring, troubleshooting, partner engagement, and communication working together,” says Raghavendran Loganathan, a principal software engineering manager in Microsoft Digital.

For our customers, the lesson is that you don’t need to copy our exact network or ticketing model. Instead, study your own top sources of work. Analyze telemetry and see what constitutes your most significant pain points, then try to attack the problem with agents.

That’s the practical pattern: Start with the work that repeats, put agents where people already operate, keep humans in the loop in places where actions carry risk, and measure whether the agent changes real behavior. At Microsoft scale, that’s meant fewer stale tickets, fewer missed handoffs, clearer communications, and more engineering time spent on restoring service so the company can achieve at top performance.

The post From alerts to action: How AI agents are reshaping network operations at Microsoft appeared first on Inside Track.

That’s certainly true for Doug Pierson, a recently retired US Marine Corps Major General who manages our Microsoft Executive Support Team. As part of that role, he works with our company’s senior leaders and created an Executive Cyber Defense service offering to assist them with protecting themselves and the company from Malicious Cyber Actors (MCAs).

“Yes, this is a different situation, but not so much that the lessons don’t apply. We need our executives to be very vigilant.”

Doug Pierson, senior director of IT Service Management, Microsoft Digital

While serving in the U.S. Marines, one of his assignments was deputy commander of Marine Corps Forces Cyber Command, U.S. Cyber Command, where he led multiple Joint Task Forces protecting the United States worldwide from cyber and asymmetric threats via nonstop offensive and defensive cyber operations. At Microsoft, he and his team have created a service offering that is founded on his time in direct contact with near peer and other adversary MCAs to help our executives protect themselves and the company from cyber threats that they face.

The attackers and battlefields may be different, but the concept is the same.

“Yes, this is a different situation, but not so much that the lessons don’t apply,” says Pierson, now a senior director of IT Service Management in Microsoft Digital, the company’s IT organization. “We need our executives to be very vigilant.”

As technology advances and proliferates, so too do the different ways that MCAs hack into businesses.

Executives—and the people around them, such as executive assistants, chiefs of staffs, and other closely aligned administrators—are particularly vulnerable to cyberattacks. As criminals look to access trade secrets, impersonate individuals, and use sensitive or confidential information for malicious means, we’ve seen an expansion in their unique approaches to finding and exploiting vulnerabilities.

Recently, Pierson and our Executive Support Team saw an opportunity to scale up how we protect our leaders’ communications and data, with approaches tailored to each person’s workflows and potential vulnerabilities.

They tackled the problem from three angles:

1. People. Besides Microsoft executive leadership, we advise support staff, clients, client stakeholders, and anyone else who might unintentionally create access vectors that lead bad actors to our executives.
2. Places. Many of our executives travel to high-risk locations that require proactive security measures. We also take into consideration whether a destination has Microsoft infrastructure in place, making it safer. Areas without Microsoft infrastructure might leave someone vulnerable. Airports, for example, might require you to sign onto a public Wi-Fi network or put you at risk of “shoulder surfing,” meaning someone looking at your laptop and gaining access to sensitive information. Our Executive Support Team provide awareness of how to safely navigate through these locations, while partnering with our Executive Protection Unit to enable a multilayered virtual and physical cyber shield while on the road.
3. Things. No matter who the staff member is and where they’re located, we ensure they have devices that are updated with the latest software, functional for mobile use, and include secure measures like cloud backup or VPN. We set them up with travel routers, provide insight on IoT home network devices, and offer support for other tools that secure communications and internal information.

As we continue to refine and build out our operating principles for executives that allow them to conduct business safely from any device and location, we learned several key lessons along the way. In simplest terms, executive support regularly ties in with an internal partnership on executive cyber protection in a “triad”:

• Our Executive Support Team maintains cyber security in proximate access: coordinating directly with the executives and their teams on IT security practices, devices, travel, and immediate concerns.
• Our Executive Protection Unit maintains physical security overwatch for executives in the office and during travel—most notably when in a high-risk area.

Lesson 1: Partner with your CISO team

Our team works with the Microsoft Office of the CISO to monitor and consistently review network and account activity on-net, and off-net for anomalies.

Our initiative has been a success in large part because we set clear, easy-to-follow guidelines and invested time and resources into educating staff on those guidelines. As an example, we deliver quarterly Protect Your Tech upskilling sessions that routinely attract 20 executive assistants (EAs), who learn about things not readily apparent as well as how to find cyber protection capabilities via Executive Support or other teams within Microsoft.

“It started with a foundational set of tips and tricks due to very real and specific need, given active targeting of the Executive Admin community and how much passion EAs have around protecting their executive on multiple levels,” Pierson says.

In newsletters, informational booklets, and the regularly offered Protect Your Tech sessions, we discuss the foundational importance of using multifactor authentication (MFA), strong passwords, keeping devices updated, and avoiding untrusted Wi-Fi networks. We then go from there into more specific measures.

“We provide executives with a secure physical device enabled with Cloud PC, a system that essentially mirrors their primary computer within a highly secure virtual environment.”

Nolan Mitchell, IT service manager, Microsoft Digital

We also regularly educate support staff on how to manage their devices with Entra ID or Intune, save files to OneDrive and SharePoint, and identify scam links or fake accounts.

In addition, we meet with executives prior to travel to high-risk locations, setting them  up with a secure environment in advance of their trip.

“We provide executives with a secure physical device enabled with Cloud PC, a system that essentially mirrors their primary computer within a highly secure virtual environment,” says Nolan Mitchell, an IT service manager in Microsoft Digital.

That means that if a device is lost or stolen, data is designed to remain accessible through the cloud rather than being stored locally on the device.

“We’re seeing governments put laws and policies in place that enable them to view what is on your devices, so we remind our folks that those laws and policies exist, and that they should be mindful or give very specific guidance related to traveling with their devices.”

Elias Gonzales, director of executive protections, Global Security

We also might advise them on what they shouldn’t bring with them.

“We’re seeing governments put laws and policies in place that enable them to view what’s on your devices, so we remind our folks that those laws and policies exist, and that they should be mindful or give very specific guidance related to traveling with their devices,” says Elias Gonzales, a director of executive protection in Microsoft Global Security.

This strong foundation has led to our team being more proactive before a threat emerges, rather than being reactive to attacks that might have already impacted them.

“The fact that folks are engaging us regarding security, for high-risk travel briefs, and to understand the environment they will be operating in before they start moving around—that’s a good thing,” Mitchell says.

Lesson 2: Collaboration is the way

It’s all about working together.

“We realized early on that leveraging our expertise and collaborating across organizations would make our initiative way more effective,” Pierson says.

Much of Pierson’s work at Microsoft Digital, for example, is informed by his extensive experience commanding offensive and defensive cyber units in the Marines.

Likewise, Asaf Kashi, a Microsoft vice president and deputy CISO, taps into his deep knowledge and experience leading teams that maintain Microsoft capabilities, systems, and tool security.

“We notify and involve executives on threat actors and actions around areas of ownership. We tell them,‘Here’s how to keep yourself and your team secure in an agile environment.’”

Asaf Kashi, vice president and deputy CISO

Collaboration across physical and digital security is crucial.

“I think sometimes the can be very siloed, but increasingly, there’s this understanding across Microsoft that it’s a blended threat—you can’t be good at one and ignore the other,” Gonzales adds.

Equally as important is the third arm of the triad: executive support.

Our Executive Support Team also works closely with other executive teams, both within the Microsoft universe (LinkedIn Executive Support as an example) and at other companies via showcase opportunities, to trade best practices.

“We notify and involve executives on threat actors and actions around areas of ownership. We tell them, ‘Here’s how to keep yourself and your team secure in an agile environment,’” says Asaf Kashi, a Microsoft vice president and deputy CISO.

Lesson 3: Stay vigilant and proactive

Cybersecurity is a rapidly moving target, which means we have to stay on top of the latest hacks and trends.

“It changes fast,” Mitchell says. “You need to be dynamic to keep ahead of MCAs.”

One way we do this is by reviewing case studies of attacks and benchmarking our security protocols against our peers and partners.

“It really does involve engagement with the industry and having a pulse on what’s going on there,” Gonzales says.

We also have to remind staff to remain vigilant in even the safest of environments.

“People are the easiest and most vulnerable link in the chain,” Pierson says. “You have to constantly remind yourself to be alert.”

This may mean trading some conveniences for peace of mind.

“Security is intended to be an inconvenience,” Gonzales says. “If it’s an inconvenience for you, it will be for bad actors. And so we need to accept the criticality of it, and do as we’re asked to do when it comes to our devices and our data.”

The post Keeping leaders safe from cyber actors: Three lessons learned from our experience at Microsoft  appeared first on Inside Track.

• Introduction: Understanding device readiness and lifecycle
• Chapter 1: Plan and standardize
• Chapter 2: Acquire
• Chapter 3: Onboard
• Chapter 4: Operate
• Chapter 5: Optimize
• Chapter 6: Refresh or reassign
• Chapter 7: Retire
• Conclusion

In a global organization such as Microsoft—with more than 220,000 employees connecting and working together from offices and remote workspaces scattered around the world—we enable our workers to stay productive from almost anywhere, on a wide range of devices.

At Microsoft Digital, the company’s IT organization, we provide our employees with that flexibility while helping keep the devices they use secure, compliant, and supportable at enterprise scale.

“Every digital experience depends on the readiness of the devices our employees use every day. Organizations that treat device management as a strategic lifecycle capability rather than a series of operational tasks are better positioned to adapt to change, reduce risk, and take advantage of new innovations with confidence.”

Brian Fielder, vice president, Microsoft Digital

We balance employee experience, security posture, and operational efficiency as part of modern device management.

This IT playbook explains how we think about device readiness at Microsoft Digital, where we serve as Customer Zero for the company. It covers the tradeoffs we manage, the lifecycle patterns that hold up over time, and the signals we monitor to understand whether we’re reducing risk or quietly accumulating it.

We also share resources you can use to apply modern device management in your own enterprise.

“Every digital experience depends on the readiness of the devices our employees use every day,” says Brian Fielder, vice president of Microsoft Digital. “Organizations that treat device management as a strategic lifecycle capability rather than a series of operational tasks are better positioned to adapt to change, reduce risk, and take advantage of new innovations with confidence.”

Understanding device readiness and lifecycle

Effective device readiness must be sustained across the full device lifecycle, from planning and acquisition through operation, refresh, and retirement. In an enterprise environment, a device is considered ready only when we can:

• Identify it and confirm ownership
• Govern it through identity and policy
• Keep it secure and compliant over time
• Support and recover it when something goes wrong
• Remove it cleanly when its role ends

When these conditions work together, device readiness becomes an operating advantage. We can move employees onto approved devices faster, enforce security and access requirements more consistently, and make lifecycle decisions with better data and less guesswork. The result is a device estate that is manageable, trustworthy, and productive at enterprise scale.

The device lifecycle model

At Microsoft Digital, we use the device lifecycle as a control system for readiness. We connect decisions, standards, and signals across the full lifecycle, so we can manage readiness over time rather than just check on it at isolated points. Each stage reinforces the next, and any issues show up early enough for us to correct them before they spread.

The stages serve specific functions:

• Plan and standardize: Sets the device standards and guardrails that make the rest of the lifecycle workable at scale.
• Acquire: Brings devices in as approved enterprise assets that can be tracked and managed from the start.
• Onboard: Gets employees up and running quickly through automated setup and policy-driven enrollment.
• Operate: Ensures devices are secure, up-to-date, and dependable over time.
• Optimize: Uses telemetry to reduce friction and improve how the lifecycle performs.
• Refresh or reassign: Keeps devices useful longer by replacing or repurposing them before they become a problem.
• Retire: Removes devices cleanly so access is closed off, data is protected, and disposition is complete.

The device lifecycle is a durable operating model that we manage holistically. Weakness in any phase often appears after the original decision was made and far from the point where the issue began.

We describe each lifecycle stage using the following structure:

Readiness question

What must be true at this stage to enable readiness

What good looks like

Our outcome-oriented goals for the stage

Signals

How we identify drift or technical debt

Microsoft Digital operating practices

Systems and processes we use internally to make this stage durable and repeatable

Stakeholder lens

Who contributes or has expectations at this stage

Being Customer Zero

How we stress-test internally in Microsoft Digital and learns at scale

Chapter 1: Plan and standardize

In this stage, we define the standards, controls, and supported patterns that make the rest of the device lifecycle manageable. Good planning reduces downstream exceptions and gives later stages a more stable foundation.

Readiness question

Are our device standards enforceable in practice, and do they reduce downstream cost, risk, and fragmentation?

What good looks like

Clear, role-based device standards limit variance and make onboarding and support repeatable at scale. These standards are grounded in capabilities that our platforms and tools can enforce, not aspirational policy language.

Signals

Signals help us detect when a lifecycle stage is falling out of alignment with its intended outcomes, becoming harder to manage, or creating downstream cost and complexity. These signals include:

Exception rates that grow over time (more devices falling outside supported standards), which later shows up in higher support costs and weaker servicing consistency.

Policies that are documented but not enforced through device health and access controls, including modern management capabilities such as Intune compliance policies and Conditional Access. Some examples are minimum OS requirements, encryption standards, and Microsoft Defender health. Documented but unenforced controls create “paper compliance” instead of true operational compliance.

Device and OS coverage statements that become hard to verify. This could manifest as device counts, OS mix, and ownership mix becoming directional rather than telemetry-backed, which weakens credibility and decision making.

Microsoft Digital operating practices

These practices show how we design the operating model to make the target state durable and repeatable. They represent the baseline decisions we make around rollout control, visibility, and enforcement to help prevent drift before it emerges.

• Early partnership with chip providers such as Intel, AMD, Qualcomm, and NVIDIA enables upstream testing, validation, and feedback on next-generation hardware. As Customer Zero for the Windows product group, our team in Microsoft Digital co-develops and is an early adopter of the Copilot+ PC experience, so readiness, performance, and security are tested and proven before fleet-wide deployment.
• For Windows devices, readiness standards are anchored to enforceable hardware and security capabilities, including TPM 2.0, Secure Boot, Microsoft Pluton, Credential Guard, and Windows Hello for Business compatibility.
• Devices are sourced from approved OEM catalogs and built to order, then validated against supported firmware, BIOS or UEFI, driver configurations, and setup experience. This approach reduces downstream support, servicing risk and providing white-glove device preparation while supporting a consistent, secure out-of-box experience.
• Apple (macOS/iOS) readiness is anchored to managed enrollment, encryption (for example, FileVault on macOS), and phishing-resistant sign-in via Platform SSO and passkeys.
• Android readiness requires Android Enterprise Work Profile support, verified device integrity (not compromised), and minimum OS and security patch levels enforced via MDM posture and Conditional Access.

Stakeholder lens

The following stakeholder groups shape planning, depend on its outcomes, and can detect misalignment quickly when expectations drift:

Employees

Benefit from clear, role-appropriate device expectations.

Endpoint engineering

Defines standards and automation foundations.

Security

Partners on baseline posture and control requirements.

Procurement and finance teams

Influence catalog decisions and lifecycle cost models.

Being Customer Zero

Before broad deployment of new capabilities, enterprise endpoint teams and product groups align on an enterprise readiness contract that spans trust and safety, manageability, and recoverability. We validate identity-bound access and tenant trust boundaries early, so we don’t introduce unmanaged enterprise risk.

Chapter 2: Acquire

In this stage of device lifecycle management, we bring devices into the environment as known, trackable enterprise assets. The goal is to make sure every device enters the lifecycle with the identifiers, registrations, and sourcing controls needed for clean provisioning and management.

Readiness question

Are devices known, owned, and visible before employees need them?

What good looks like

Procurement and asset registration are predictable and integrated, ensuring devices enter the environment as known enterprise assets, already associated with inventory systems and ready for automated provisioning.

Signals

These signals show where breakdowns in sourcing, registration, or asset control can create problems later in the lifecycle.

Procurement lead times cause day-one onboarding delays when devices arrive before they are ready for provisioning.

Inventory and asset records drift from reality, causing organizations to lose a single source of truth for device status, ownership, and lifecycle stage. This can create gaps in offboarding, recovery, and audit evidence.

Devices reach employees before registration is complete, such as when Autopilot or Apple Business Manager registration isn’t done before delivery. This forces catch-up work and introduces exceptions.

Microsoft Digital operating practices

These practices show how we design the operating model to make the target state repeatable:

• Acquisition readiness and zero-touch deployment begin with an integrated sourcing and provisioning model. This model defines how we source and acquire devices globally, apply persona-based configuration, fulfill local language requirements, and preload the latest supported operating system and drivers.
• When devices are delivered, they arrive asset-tagged, bundled, and preregistered with Windows Autopilot. This enables a consistent, secure, hands-off setup experience from first power-on.
• Acquisition readiness is tied to asset registration and inventory accuracy. Corporate devices are registered at purchase, associated with enterprise asset identifiers, and tracked continuously from order through retirement.

Stakeholder lens

These groups influence acquisition decisions and depend on those decisions being accurate, timely, and supportable:

Procurement and finance

Own sourcing and logistics.

IT

Validates compatibility and enterprise readiness.

Security

Advises on supply chain and trust considerations.

Being Customer Zero

Our early adoption program accelerates learning while preserving governance. We operate under explicit guardrails, including security posture, data boundaries, and regulatory requirements, so speed doesn’t bypass enterprise controls.

Chapter 3: Onboard

In this stage, we turn a device into a usable, trusted work endpoint through automated setup, enrollment, and policy enforcement. A strong onboarding experience helps employees become productive more quickly without weakening identity or compliance controls.

Readiness question

Can employees be productive on day one, experiencing minimal friction without bypassing identity, policy, or compliance?

What good looks like

Onboarding is fast, predictable, and largely hands-off for IT while remaining identity-bound and policy-driven. Day-one productivity comes through repeatable automation rather than exception handling.

Signals

These signals tell us when onboarding is becoming inconsistent, support-heavy, or harder to scale cleanly:

“Time to productive” increases or varies significantly (the onboarding path is no longer repeatable at broad scale).

Enrollment Status Page (ESP) failures increase (setup blocks, app install delays, and policy install failures).

Enrollment-related support calls or tickets rise during onboarding windows, indicating that friction is shifting from automation to human support.

Post-onboarding surveys and helpdesk ticket analysis show declining satisfaction or repeated “same issue” patterns.

Bring-your-own-device (BYOD) enrollment confusion increases as employees are unclear on what’s managed, what data is collected, or what happens when access is revoked.

Microsoft Digital operating practices

These practices show how the operating model makes the target state repeatable:

• Devices are approved and certified before reaching employees. Corporate Windows and Apple devices are sourced from approved OEM catalogs and registered through Windows Autopilot or Apple Business Manager, then associated with user identities and asset systems.
• For Windows devices, Autopilot registration occurs via OEM or partner APIs whenever possible; manual hardware hash registration is reserved for exceptions. Assigned Autopilot profiles define Entra ID join behavior, Intune enrollment, Out‑of‑Box Experience configuration, required applications, and baseline policies.
• The Enrollment Status Page acts as a gate that can’t be bypassed. Devices cannot be used until required apps, updates, and policies are successfully installed. If setup fails, reset is blocked, and errors are captured for IT remediation.
• Apple Business Manager is used exclusively for corporate‑purchased Apple devices; personally owned Apple and Android devices follow Intune BYOD enrollment paths. Android devices enroll using the Android Work Profile mechanism; Google Zero Touch is not used in this environment.
• Before access to corporate resources is allowed, devices must meet certification requirements, including Intune enrollment, encryption (BitLocker or FileVault), supported OS versions, Defender for Endpoint health, and required hardware security capabilities. Conditional Access enforces these requirements at sign‑in.
• Virtual onboarding options such as Azure Virtual Desktop are used for contractors, regulated roles, or temporary fallback access.

Stakeholder lens

These groups own setup, experience the outcome directly, and rely on tight alignment for onboarding to work smoothly:

Employees

Expect a power-on-and-go experience.

IT

Owns provisioning automation and exceptions.

Identity and security teams

Validate trust and access enforcement.

Being Customer Zero

The readiness contract explicitly validates manageability, zero-touch onboarding readiness, and identity enforcement before capabilities advance beyond early internal cohorts.

Chapter 4: Operate

In this stage, we keep devices secure, current, and reliable through ongoing servicing and operational discipline. The aim is to maintain a stable experience over time while minimizing manual intervention and operational noise.

Readiness question

Can devices remain secure, reliable, and current over time without constant manual intervention, and can known vulnerabilities be remediated quickly without manual escalation?

What good looks like

Continuous servicing and support preserve productivity while minimizing operational noise and exposure windows.

Signals

These signals help us see when operations are getting noisier, less predictable, or more reactive than they should be:

Update compliance thresholds are missed, meaning more devices are at risk because of outdated patches or repeat failure patterns.

Rollbacks, pauses, or halted rollouts become frequent, which indicates that the ring and validation strategy isn’t catching issues early enough.

Helpdesk tickets trend upward for update failures or device remediation (operational noise is rising instead of staying quiet).

Firmware- or driver-related instability increases, which requires additional validation, staging, or rollback controls.

Zero-day response requires repeated emergency actions; this signals that baseline update hygiene isn’t consistently holding.

Microsoft Digital operating practices   

These practices show how we design the operating model to make the target state durable and repeatable:

• Windows Autopatch: Provides a single, integrated update management experience in Intune. It combines Windows Update for Business policy-based controls with automated, telemetry-driven deployment across staged rollout waves, including built-in issue detection, pause, and rollback capabilities.
• Windows Hotpatch: Helps reduce disruption by applying certain security updates without requiring a restart, which supports continuity for eligible devices.
• Intune Vulnerability Agent: Extends vulnerability visibility and supports coordinated remediation through device management workflows.
• Enterprise App Management: Gives us a structured way to manage application deployment, updates, and policy alignment across managed devices.
• Update Compliance: Via Azure Monitor, it provides insight into installation rates and failure patterns, triggering remediation workflows when thresholds are crossed. Firmware and driver updates are validated with OEM partners and staged using the same ring-based deployment model.
• Minimum OS requirements: Non-Windows devices must meet minimum operating system requirements, encryption standards, and endpoint protection requirements before they can access corporate resources. These are enforced by Intune compliance policies and Conditional Access.

Stakeholder lens

These groups keep the environment running smoothly and depend on that stability every day:

Employees

Experience quiet, predictable updates that minimize disruption and maintain productivity.

IT operations teams

Own reliability and remediation, so updates are delivered safely at scale.

Security teams

Use device compliance and update posture as critical signals for access control and risk reduction.

Being Customer Zero

We use a staged rollout approach to test new updates and features with progressively larger groups of users. This helps us identify issues early, validate performance and reliability at scale, and continuously improve quality before broad deployment across the company.

Chapter 5: Optimize

In this stage, we use telemetry and operational insight to improve how the device lifecycle performs. Optimization helps us reduce friction, close recurring gaps, and make better decisions about where to invest effort.

Readiness question

Are fleet health, compliance, and cost improving or merely visible?

What good looks like

Telemetry and automation inform decisions that decrease friction, eliminate compliance gaps, and improve lifecycle efficiency.

Signals

These signals show when optimization has stalled and the environment is absorbing effort without reducing friction or risk:

Known vulnerabilities remain open longer than expected, increasing exposure to risk.

Compliance rates stop improving from one release to the next, despite ongoing remediation efforts.

Routine issues continue to require manual intervention instead of being handled through automation.

Devices repeatedly cycle in and out of compliance, indicating deeper issues in the environment.

Operational reviews spend more time addressing recurring problems and less time improving the overall service.

Microsoft Digital operating practices

These practices help us improve the environment over time and reduce operational overhead. They focus on measuring results, standardizing management, and automating routine work where possible.

• Optimization investments are guided by metrics such as patch compliance, automation coverage, remediation success rates, and operational workload.
• We standardized Windows devices on Microsoft Entra ID join and retired older management models such as Workplace join, Hybrid Azure AD join, and Active Directory join. This reduced complexity, simplified policy enforcement, and created a more consistent management experience across devices.
• Windows Autopatch, Hotpatch, and automated remediation help us keep devices current while minimizing disruption for employees.
• Intune firmware, driver, and Enterprise App Management capabilities extend the same update and deployment discipline beyond the operating system to hardware components and third-party applications.
• Microsoft Security Copilot, Microsoft 365 Copilot, and Copilot in Power BI help our teams analyze Intune and Defender data more quickly, making it easier to identify issues and prioritize remediation efforts.

Stakeholder lens

Optimization in a cloud-native model depends on aligned ownership across engineering, security, and employee experience teams. Modern management gives us a standardized, policy-driven foundation.

Employees

Experience fewer disruptions and faster issue resolution.

Endpoint engineering and modern management teams

Drive standardization, policy enforcement, and continuous fleet health optimization.

Security and CISO partners

Rely on device compliance signals to enforce secure access with minimal manual intervention.

Product groups

Incorporate Customer Zero feedback from our team in Microsoft Digital to improve enterprise readiness.

Being Customer Zero

As Customer Zero for modern management, we validate optimization capabilities at enterprise scale and feeds insights directly to engineering. This helps ensure solutions are designed for real-world scenarios.

• Modern Management transformation (Entra ID–based) simplified management and closed Conditional Access gaps.
• Validation of Autopatch and Hotpatch improves update readiness and rollout quality before broad release.
• AI-powered investigations unified Defender and Intune signals to accelerate issue triage and remediation.

Chapter 6: Refresh or reassign

In this stage, we decide whether a device should continue in service, move to a new owner, or be replaced. When done with intention, refreshing and reassignment extend an asset’s value while reducing avoidable support issues and lowering security risk.

Readiness question

Are devices refreshed or reassigned before they become performance or security debt?

What good looks like

Condition-based refresh and reassignment maximize asset value while minimizing disruption.

Signals

These signals help us see when device reuse, replacement, or support timing is slipping out of a manageable rhythm:

Hardware health telemetry trends indicate looming failures, including battery wear, thermal events, and disk health degradation, which creates unplanned downtime risk.

Firmware or driver update readiness becomes inconsistent across models (this increases the cost of servicing and support).

Refresh timing becomes reactive (devices are replaced after repeated failures instead of during planned lifecycle windows).

Reassignment or reuse requires more manual work (this signals that reset and reprovision flows aren’t consistently repeatable).

Microsoft Digital operating practices

These practices show how we make device refresh and reassignment consistent, scalable, and repeatable. They aren’t reactive steps we take when aging devices, inventory gaps, or fulfillment delays become visible. They’re the standard processes, controls, and decision points we use to keep devices moving through their lifecycle efficiently and to prevent those issues from occurring in the first place.

• Windows lifecycle guardrails: Align firmware servicing and hardware support windows to a 48-month refresh baseline so devices remain within OEM-supported windows for security and firmware updates.
• Condition-based refresh signals: Battery wear, thermal events, disk health, and firmware servicing status are monitored through telemetry to trigger proactive refresh actions before devices become performance or security debt.
• Catalog discipline: Devices are sourced from the approved OEM catalog, with model selection tied to persona, lifecycle stage, and firmware support roadmap. This reduces drift between deployed inventory and supported hardware.
• Defined recovery workflow: Reassignment is supported through a documented recovery workflow where applicable. Previously owned corporate Windows devices are returned to the out-of-box experience using WinRE-based reset initiated locally or through Company Portal, enabling redeployment to new owners through Autopilot. Recovery USB is the documented fallback when WinRE can’t be used.
• Sustainability and cost outcomes: Where possible, devices are reassigned, repurposed, or returned through approved recycling channels. This extends asset value and supports our broader sustainability commitments.
• Structured exception handling: Devices that fall outside refresh windows because of supply, persona, or business constraints follow a documented exception path with a defined review cadence so exceptions don’t become the norm.

Stakeholder lens

These groups help determine whether devices should be refreshed, reassigned, repaired, or retired:

Employees

Need reliable devices that support their work without repeated failure or disruption.

Endpoint engineering and support teams

Use telemetry and recovery workflows to guide refresh and reassignment decisions.

Procurement, finance, and sustainability teams

Balance device value, lifecycle cost, reuse, and responsible disposition.

Being Customer Zero

Our team in Microsoft Digital validates refresh and reassignment workflows at scale across device models, OEMs, and silicon partners before they reach employees. By partnering early with Windows product group, silicon partners, and OEM partners, we test Autopilot re-enrollment, WinRE-based recovery, and Company Portal reset flows in real conditions. We then turn lifecycle telemetry and friction points into direct product feedback as part of our Customer Zero commitment.

Chapter 7: Retire

In this stage, we close the lifecycle cleanly by removing devices from service in a controlled and auditable way. Retirement helps ensure that access is revoked, data is protected, and disposition is complete.

Readiness question

Can devices exit cleanly without leaving behind data, access, or audit gaps?

What good looks like

Offboarding is policy-driven, auditable, and integrated with identity, asset, and sustainability workflows.

Signals

These signals show where offboarding is leaving loose ends that can create exposure, confusion, or audit gaps later:

Orphaned devices appear (devices aren’t tied to an active person or remain enrolled after a lifecycle trigger).

Time to offboard grows (slow decommissioning creates prolonged access and data risk).

Wipe verification and audit artifacts are incomplete (this includes missing wipe confirmation logs, disposition certificates, or chain-of-custody records).

Devices remain enabled in Entra ID or continue to pass access checks after they should be decommissioned (these are access revocation gaps).

People repurpose devices informally, such as loaners or secondary devices, without clarity on what decommissioning means for audit and compliance versus reassignment.

Microsoft Digital operating practices

Offboarding triggers include employee exit, end of warranty, hardware health degradation, or compliance failure. These triggers launch automated workflows using Power Automate and ServiceNow, revoke access through Microsoft Entra ID and Conditional Access, and wipe devices through Intune or Configuration Manager. Data sanitization aligns with NIST 800-88 guidelines, and chain-of-custody controls support secure disposition.

Stakeholder lens

These groups help ensure retirement is controlled, auditable, and complete:

Employees and managers

Return devices and confirm lifecycle events that trigger offboarding.

IT operations and asset teams

Coordinate wipe, recovery, inventory updates, and disposition records.

Security, compliance, and sustainability teams

Validate access removal, data sanitization, chain of custody, and responsible disposition.

Being Customer Zero

Our team in Microsoft Digital validates retirement workflows at scale, including automated offboarding, access revocation, NIST 800-88 sanitization, and chain-of-custody controls across devices. By partnering with Microsoft Entra ID, Windows, and Intune teams, we surface real-world gaps such as orphaned devices, delayed wipes, and residual access. We then translate those gaps into product improvements that strengthen the retirement experience for customers and help keep our own audit and compliance posture durable.

Conclusion

Device readiness is not a one-time milestone. It is a lifecycle discipline that connects planning, sourcing, onboarding, operations, optimization, refresh, and retirement. At Microsoft Digital, we use that lifecycle to keep devices secure, employees productive, and operational decisions grounded in data.

“Device readiness is ultimately about enabling people to do their best work wherever and however they choose to work. By treating the device lifecycle as a strategic capability, we’ve transformed this function from an operational necessity into a source of innovation, resilience, and future growth across our organization.”

Senthil Selveraj, principal group product manager, Microsoft Digital

When every stage has clear standards, measurable signals, and repeatable mechanisms, the device estate becomes easier to manage and safer to scale. That helps us reduce exceptions, improve employee experience, and strengthen enterprise security without relying on manual effort as the default path.

“Device readiness is ultimately about enabling people to do their best work wherever and however they choose to work,” says Senthil Selveraj, a principal group product manager in Microsoft Digital. “By treating the device lifecycle as a strategic capability, we’ve transformed this function from an operational necessity into a source of innovation, resilience, and future growth across our organization.”

The post How we deploy and manage enterprise devices at Microsoft Digital appeared first on Inside Track.

At Microsoft, we’ve been working to close that gap with a new kind of agent: Copilot Cowork. Rather than a strict instruction-and-response approach, Cowork has taken the leap to multi-step action across an employee’s Microsoft 365 environment.

From task assistants to true digital coworkers

For years, the promise of AI at work has centered on task assistance, like creating drafts quickly, delivering better summaries, and providing faster answers. But knowledge retrieval isn’t partnership.

“Cowork really sheds light on the art of the possible when it comes to agents, without the need for employees to build them for themselves. It has ignited people’s imagination around what agents can do.”

Stephan Kerametlian, senior director, Microsoft Digital

In Microsoft Digital, the company’s IT organization, we’ve been pursuing deeper impact for AI. We want agents to work alongside our employees, take on multi-step tasks, and produce real outputs, all while keeping the humans that direct their work in the loop.

Copilot Cowork represents that shift. It behaves less like a chatbot and more like a capable teammate that plans, executes, and checks in as it goes along.

“Cowork really sheds light on the art of the possible when it comes to agents, without the need for employees to build them for themselves,” says Stephan Kerametlian, a senior director in Microsoft Digital. “It has ignited people’s imagination around what agents can do, and it helps them understand that they don’t need to be a developer to get high-quality outputs very quickly.”

Microsoft 365 Copilot agents

Copilot Cowork is just one of the agents available through Copilot. Each is most effective in a specific set of scenarios.

Using Copilot Cowork to move from conversation to action

We created Copilot Cowork for workflows that span multiple steps, people, and applications. While traditional chat experiences answer questions or generate content, Cowork can interpret a request, create a plan, gather relevant context, and carry work forward over time.

“Work IQ packages relevance, ranking, and context into something AI can actually act on. It understands who you work with, what you’re working on, and which content matters in a given situation, helping the AI identify the right material and infer the steps needed to deliver an outcome.”

Swapna Malekar, principal product manager, Microsoft Digital

This agent can develop documents, coordinate meetings, generate research, create web applications, and manage ongoing tasks. It also provides visibility into its progress and requests approval before taking sensitive actions.

Work IQ, Microsoft’s intelligence layer for enterprise context, is the foundation of these capabilities. It helps Cowork understand relevant files, meetings, chats, collaborators, and organizational signals so that the agent can identify the right information for the task at hand. Cowork then uses that context to determine the steps needed to deliver the requested outcome.

“Work IQ packages relevance, ranking, and context into something AI can actually act on,” says Swapna Malekar, a principal product manager in Microsoft Digital. “It understands who you work with, what you’re working on, and which content matters in a given situation, helping the AI identify the right material and infer the steps needed to deliver an outcome.”

Our employees are already using Cowork to tackle work that would otherwise require multiple prompts and applications. With a single request, they can create presentations, establish Teams chats for collaboration, schedule recurring follow-up activities, begin building strategy documents, and more.

Cowork can also pull together emails, chats, documents, and news sources into a briefing or transform existing content into an interactive web experience. Throughout the process, employees can refine the work, answer clarifying questions, and approve actions before Cowork moves forward.

Helping employees embrace this watershed moment

During early adoption efforts for Cowork, we learned that successful usage depends as much on behavior change as on technology. Employees who approached Cowork simply as a better chatbot often saw incremental gains.

“Cowork introduces a new way of thinking about work, where you hand off a complex task, close your computer, and the work continues on your behalf. For adoption specialists, the goal is to help employees recognize where that capability fits naturally into their day.”

Petra Glattbach, senior business program manager, Microsoft Digital

People who learned to think in terms of outcomes uncovered far more value. Instead of asking for a draft, they delegated a process. Instead of requesting a summary, they assigned a research task with a defined deliverable.

Agent Launchpad is an instructional program we’ve designed to develop our employees’ agentic AI skills. This effort, alongside other readiness resources, is encouraging people to identify recurring workflows, experiment with multi-step requests, and refine their collaboration techniques over time.

“Cowork introduces a new way of thinking about work, where you hand off a complex task, close your computer, and the work continues on your behalf,” says Petra Glattbach, a senior business program manager in Microsoft Digital. “For adoption specialists, the goal is to help employees recognize where that capability fits naturally into their day.”

This process isn’t about replacing existing ways of working overnight. It’s helping employees recognize where a digital coworker can reduce manual effort, accelerate execution, and create more time for higher-value work.

Boosting our role as Customer Zero with Cowork

Based on our experience as Customer Zero, the most effective Cowork users start with a real business problem and then explore how an agent can help solve it to drive core business outcomes.

For Jody Ryan, principal cloud solution architect for Microsoft 365 Copilot AI Business Solutions, Cowork quickly became part of her daily workflow. She’s used it to build interactive HTML experiences, create adoption sites, and rapidly prototype customer-facing concepts during live conversations.

“Cowork has become a powerful partner in my day-to-day work, helping me turn information into action so I can be more present, proactive, and impactful with my customers.”

Jody Ryan, principal cloud solution architect, Microsoft 365 Copilot AI Business Solutions

In one scenario, Cowork helped her transform a customer discussion into a working web prototype that she refined in real time based on live feedback. Going from whiteboarding to prototype to Agent was a natural progression that helped her customers visualize the real impact of Microsoft’s agentic capabilities.

One of the greatest surprises for Ryan was how much she enjoyed the customizable approach to human-in-the-loop approval checkpoints. For example, Cowork will find a time for a meeting, build a deck, and draft the invite email, but then pause for her review before sending it out. It’s all about identifying patterns of work and enabling Cowork to be part of them.

“Cowork has become a powerful partner in my day-to-day work, helping me turn information into action so I can be more present, proactive, and impactful with my customers,” Ryan says.

Employees in all kinds of roles across Microsoft are echoing Ryan’s experience. People are feeling the genuine evolution that agents like Cowork represent.

The skills we’ve learned over the last three years have been leading to this moment. By demonstrating the tangible impacts of AI through adoption initiatives, celebrating wins, and setting employees free to explore and create AI solutions to business challenges, we’ve positioned ourselves to capitalize on this next leap into more advanced AI tools.

One of our most important lessons has been that cultivating an AI-ready workforce throughout our Frontier Transformation journey has built a sense of confidence and capability with AI. Now that true agentic partnership is a possibility, that journey has prepared our people to get the most value out of tools like this.

The next chapter in the agentic workplace

The response to Copilot Cowork within Microsoft has taken us through an inflection point where AI has moved beyond assistance and into genuine execution. Our internal adoption efforts clearly demonstrate that shift.

“When agents can reason over organizational knowledge and then take action on our behalf, they become a powerful force for productivity and a critical aspect of how we lead Frontier Transformation.”

Brian Fielder, vice president, Microsoft Digital

Within three weeks of its internal release, Cowork had 20,000 users. Employees are actively exploring new ways to use the agent, from streamlining meeting preparation and follow-up work to creating content, conducting research, and managing complex projects.

We’ve learned that different teams often have different uses for different agents. But Cowork is emerging as a tool that can accommodate efforts reaching across a wide array of apps, data sources, workflows, and scenarios.

That’s a big shift, and employees are excited. Interest has been so strong that we’re expanding our enablement efforts, including new, Cowork-focused learning experiences within Agent Launchpad.

As we continue to evaluate Cowork, product feedback is helping us improve reliability, strengthen connections to enterprise data and external systems, and refine the quality of outputs. Even though it’s still in the early stages, teams are finding that Cowork can reduce administrative burden and help work move faster.

“Work IQ is helping unlock a new era where AI can understand the context behind our work, not just the content,” says Brian Fielder, vice president of Microsoft Digital. “When agents can reason over organizational knowledge and then take action on our behalf, they become a powerful force for productivity and a critical aspect of how we lead Frontier Transformation.”

For us at Microsoft, Cowork is more than a new agent. It’s providing a glimpse into a new future of work, where digital coworkers help employees focus more of their time on the aspects of their job that matter most.

The post From AI assistant to capable teammate: How Copilot Cowork is changing the way we work at Microsoft appeared first on Inside Track.

Once captured, meeting data becomes a source of organizational knowledge that helps employees catch up on discussions, revisit decisions, track commitments, and surface unresolved issues. AI-powered experiences such as Microsoft 365 Copilot and Work IQ can connect insights across meetings, helping teams understand how conversations, decisions, and workstreams evolve over time and ensuring important information doesn’t get lost.

Although these features have proven to be incredibly useful to our employees and our wider organization, there are also concerns about how retaining Microsoft Teams meeting data and AI insights might affect our security posture, records retention policy, and privacy. Just like any other company, we at Microsoft must balance these different factors accordingly.

At Microsoft Digital, the company’s IT organization, we’re leading cross-disciplinary conversations on this topic to help ensure that we get it right.

The value of Teams meeting data

Within a meeting, the Microsoft 365 Copilot sidebar experience helps our late-joining employees catch up on what they’ve missed, provides intelligent prompts to review unresolved questions, summarizes key themes, and creates notes or action items.

“The value of a meeting should not end when the meeting ends. Transcription and AI help transform conversations into durable knowledge—making decisions easier to find, commitments easier to track, and information easier to access for everyone who needs it.”

Chanda Jensen, senior product manager, Microsoft Digital

The benefits of AI in meetings extend beyond the live meeting experience as well. When meeting content is available after the meeting, AI can transform conversations into accessible organizational knowledge. Transcripts and underlying documentation—including, notes, decisions, and action items—enable participants to revisit discussions, catch up on missed meetings, verify decisions, and accelerate follow-up work.

Our Microsoft Teams meeting data retention efforts focus on three key categories of artifacts: Underlying documentations, transcripts, and the AI-generated artifacts that help power Microsoft 365 Copilot and Work IQ experiences.

Transcription provides the underlying documentation that makes these AI-powered experiences possible. By making transcription and AI capabilities available in meetings while preserving organizer, administrative, compliance, and sensitivity controls, organizations can choose how these capabilities are used while enabling users to benefit from more effective collaboration and knowledge retention.

“The value of a meeting should not end when the meeting ends,” says Chanda Jensen, senior product manager in Microsoft Digital. “Transcription and AI help transform conversations into durable knowledge—making decisions easier to find, commitments easier to track, and information easier to access for everyone who needs it.”

Policy considerations for meeting data retention

The value of these tools is clear, but data-retention obligations also play an important compliance role that organizations like ours need to consider.

“When individuals generate recordings or other artifacts during meetings, we tend to think of them as an individual’s data, but they actually represent the company’s data. We want to empower individuals, but we have to remember the retention and volume impacts of these artifacts on the company can be substantial.”

Rachael Heade, director of records compliance, Microsoft Corporate, External, and Legal Affairs (CELA)

First, producing and retaining this kind of data can be complex if it isn’t governed properly. For us at Microsoft, this data represents day-to-day general business practices that elevate productivity, and factors such as security and privacy must be considered when managing it. Second, data-rich artifacts like video recordings require a lot of space, quickly eating up cloud storage budgets.

“When individuals generate recordings or other artifacts during meetings, we tend to think of them as an individual’s data, but they actually represent the company’s data,” says Rachael Heade, director of records compliance in Microsoft’s legal division. “We want to empower individuals, but we have to remember the retention and volume impacts of these artifacts on the company can be substantial.”

In light of these potential impacts, some organizations simply opt out of enabling Microsoft Teams meeting recordings.

Asking the right questions to assemble the proper guardrails

Leaders in Microsoft Digital and Corporate, External, and Legal Affairs (CELA), our legal division, are working to balance the benefits of Microsoft Teams meeting data retention with our compliance obligations, aiming to provide empowering experiences for our employees while also keeping company data safe.

“Organizations are always concerned about centralized control over the retention and deletion of data artifacts,” Heade says. “You have excited employees who want to use this technology, so how do you set them up so they can use it confidently?”

Like many policy conversations, getting this right starts with the governance team in Microsoft Digital and our internal partners asking employees from across the company who are responsible for data governance the right questions:

• When should a meeting be recorded and when shouldn’t it?
• What kind of data gets stored?
• Who can initiate recording, and who can access it after the meeting?
• How long should we retain meeting data?
• Where does the data live while it’s retained?
• How can we control data capture and retention?
• What does this mean for eDiscovery management?

These questions help us think about the proper data-retention guardrails. Our IT perspective is only one part of the puzzle, so we’re actively consulting with CELA, corporate security, privacy, the Microsoft Teams product group, the company’s data custodians, and our business customers throughout this process.

“As an organization, this is about thinking through your tenant position and getting it to a reasonable state.”

David Johnson, tenant and compliance architect, Microsoft Digital

Our conversations have brought up distinctions that any organization should consider as they build policy around Microsoft Teams meeting retention:

• The length of time a meeting’s data remains fresh, relevant, or useful
• Consideration of the difference between AI-generated archival content versus the full meeting transcript
• The different risks inherent with recordings compared to transcriptions
• Establishing default policies while allowing limited variability and flexibility when employees require it

“As an organization, this is about thinking through your tenant position and getting it to a reasonable state,” says David Johnson, tenant and compliance architect in Microsoft Digital.

From sharing perspectives to crafting policy

Our policies around Microsoft Teams meeting data retention continue to evolve, but we’ve already implemented some highly effective practices, policies, and controls. Every organization’s situation is unique, so it’s important that you speak to your legal professionals to craft your own policies. But our work should give you an idea of what’s possible through the out-of-the-box features within Microsoft Teams.

The policies we’ve put in place represent a mix of technical defaults, meeting options, and empowering employees to make informed decisions about usefulness and privacy. They also build on the foundations of our work with sensitivity labeling, which helps secure data across our tenant.

Here are some of the practices we follow and features we use:

• Transcript attribution opt-out gives employees agency and reassures them that we honor their privacy.
• Recommending that employees “tell and confirm” before recording empowers and supports our people to speak up when they don’t believe the meeting should be recorded or don’t feel comfortable with this choice. Employees in the meeting can also stop the recording, if needed, or determine if automatic recording was set up but is not appropriate.
• Visual indicators that a meeting is being recorded and that transcription has started, allowing users to request that a meeting stop being recorded or to leave the call.
• User education, through an internal recording smart-use statement document, helps employees understand the implications of recording, when not to record, and when not to speak in a recorded call.
• We do not use compliance recording. While compliance recording could enforce full consent collection, unmuting themselves, we decided that opt-outs and user notices provided sufficient agency to our employees.
• We offer meeting labels that limit who can record, meaning only the organizer or co-organizer can initiate recordings for meetings labeled “highly confidential.”
• Meeting labels are informed by content shared within the meeting. If content is shared in the meeting that has a higher label than the meeting itself, the organizer is prompted to re-label it.
• Meeting labels are inherited and applied to all meeting artifacts, recordings, transcripts, and notes. This means that meeting knowledge remains protected, and any AI consumption of that recording will automatically inform the consumer of the sensitivity and required protections.
• Only meeting organizers can download meeting recordings, keeping the meeting data contained and restricting sharing.
• The default OneDrive and SharePoint meeting expiration is set to 90 days to ensure we minimize the risk of data leakage or cloud-storage bloat.
• The default Meeting AI Archive is set to an 18-month retention policy. That allows questions and decisions from the meeting to be leveraged by the team for post-meeting insights but ensures that data is not kept forever.  
• Deletion is applied in a consistent manner under the business general categories of our retention schedule. The schedule supports our designation of the Teams artifacts as productivity tools and resources, but not as official company records. This stance controls data volume, reduces review and production burden, and ultimately reduces risk (including security and privacy factors).

Balancing productivity with sensible data governance

At Microsoft, we apply different retention periods to different types of meeting data, based on their purpose and business value. Full meeting recordings and transcripts are governed by a default 90-day expiration policy, helping reduce privacy, security, and storage risks while ensuring employees can still benefit from recordings in the near term.

“The bottom line is that we rely on our employees to be good stewards of the company. Because we’ve got a good governance model in place for Teams and solid overall hygiene for our tenant, we’re well set up to deal with the evolution of the product and make these decisions.”

David Johnson, tenant and compliance architect, Microsoft Digital

Separately, AI-generated meeting knowledge—such as questions, decisions, and other insights extracted from meetings and used to support discovery and knowledge-sharing—can be retained for up to 18 months, allowing teams to benefit from the value of those insights long after the original transcript has expired.

These policies are designed to balance employee productivity with responsible data governance, ensuring that important information remains available when useful but is not retained indefinitely. They reflect the three core tenets we use to inform our governance efforts: empower, trust, and verify.

“The bottom line is that we rely on our employees to be good stewards of the company,” Johnson says. “Because we’ve got a good governance model in place for Teams and solid overall hygiene for our tenant, we’re well set up to deal with the evolution of the product and make these decisions.”

The net outcome of all of this work is that our organization is more confident in our approach to meeting knowledge, resulting in more meetings being recorded or transcribed and generating more valuable post-meeting artifacts.

We can’t specifically recommend that an organization follow our blueprint entirely, but asking questions similar to the ones we’ve outlined here can help you build a strong Teams data-governance foundation. With a firm grasp of the technology and close collaboration with key stakeholders, you can guide your own policy decisions and unlock more value for your employees.

The post Empowering employees after the call: Enabling and securing Microsoft Teams meeting data retention at Microsoft appeared first on Inside Track.

Every one of those devices relies on Secure Boot, a Windows security capability that verifies firmware, boot loaders, and operating system components before startup. This system helps ensure all our Windows devices run only trusted software and protects us against threats that target the boot process.

When three Microsoft-issued Secure Boot certificates approached expiration in 2026, our team in Microsoft Digital, the company’s IT organization, knew we needed to take action early and get ahead of the update. By partnering with the Microsoft Office of the CISO and several of our product teams, we developed an approach that ensured secure-by-default devices from the firmware up.

Updating the foundation of device trust

Secure Boot sits at the foundation of Windows security. Without updated certificates, devices would lose the ability to receive future Secure Boot protections and other boot-level security improvements.

“We manage a diverse fleet of devices and usage scenarios, so we needed an approach that could scale safely, provide visibility into our progress, and maintain confidence in device security.”

Luis Quintana, principal engineering group manager, Endpoint Security

To maintain protection, we needed to replace three legacy certificates with four new ones across a diverse device fleet. Replacing the certificates was straightforward. The real work was validating the update across thousands of device models and deployment scenarios.

We started early so we could test, validate, and gradually deploy the updates before the certificate expiration dates arrived. That approach helped us strengthen the security posture of our devices while minimizing disruption to employees and business-critical systems.

“Updating hundreds of thousands of devices without disrupting people and business operations is no small task,” says Luis Quintana, principal engineering group manager for Endpoint Security. “We manage a diverse fleet of devices and usage scenarios, so we needed an approach that could scale safely, provide visibility into our progress, and maintain confidence in device security.”

Leading the update across a complex device estate

We first began this work in 2024 by partnering with the Windows Servicing and Delivery team, which helped us identify device models the certificate renewal might affect. We tested those models end to end in our Client Test Lab, then deployed the update to a pilot group of around 35,000 devices using a controlled firmware release (CFR). That pilot achieved a 95% success rate, which gave us the confidence to scale up.

“Intune was the glue that brought the process together, turning a collection of settings and instructions into something we could orchestrate. It helped us create a repeatable playbook that covered everything from reporting and targeting to rollout.”

Kubilay Dagdelen, senior service engineer, Microsoft Intune

In February 2026, we kicked off the broader effort across our entire Windows 11 device ecosystem. Reporting and telemetry formed our essential starting point.

Microsoft Digital partnered with the Windows Autopatch, Intune, and Microsoft Defender for Endpoint teams to identify which devices already included the latest certificates because they were released after 2025, which devices needed the update, and which failed. In support of these efforts, the Autopatch team built fleet-wide reporting of Secure Boot status directly into Intune, turning raw telemetry into a live compliance dashboard.

“Intune was the glue that brought the process together, turning a collection of settings and instructions into something we could orchestrate,” says Kubilay Dagdelen, a senior service engineer on the Microsoft Intune team. “It helped us create a repeatable playbook that covered everything from reporting and targeting to rollout.”

A ringed approach across a range of devices

We started small, using telemetry signals to identify device cohorts based on their risk of failure. Starting from the simplest devices to update, we gradually scaled across models that carried more complexity, keeping backups and loaner machines ready to support global operations in case of disruption. After just 70 days, we had achieved 86% compliance across all our devices.

“This has been an opportunity to strengthen our security foundation. It’s about going from reactive security to a secure-by-default baseline aligned with Zero Trust principles.”

Pandurang Savagur, senior product manager, Microsoft Digital

But we don’t just maintain employee devices. Our hardware estate spans meeting rooms, secure admin workstations, digital signage, and executive devices. These different device types demanded different Secure Boot approaches.

To tackle this challenge we established a virtual team, with members responsible for each of these surfaces holding weekly syncs and leadership updates. For example, our 15,000 meeting room devices run a custom Windows 11 image, so we partnered with OEMs to release firmware for them.

Meanwhile, cloud PCs on Azure infrastructure needed scheduled reboots to update, so we let employees choose when to restart. For our server cohort, where telemetry gaps made progress hard, Microsoft Defender for Endpoint delivered the independent visibility we needed.

“This has been an opportunity to strengthen our security foundation,” says Pandurang Savagur, a senior product manager on the Device Lifecycle team in Microsoft Digital. “It’s about going from reactive security to a secure-by-default baseline aligned with Zero Trust principles.”

Our Customer Zero experience: Expertise and process pathfinding

Our role as Customer Zero shaped how we approached this process. As both the creators and users of Microsoft technology, we have direct access to product teams as well as intimate knowledge of our tools’ capabilities.

“Technology and culture matter equally here, and our Microsoft culture means we know what’s coming and can act proactively through direct access to our engineering groups.”

Yulia Evgrafova, principal security service engineer, Office of the CISO

Intune served as our execution engine, orchestrating policies and remediation scripts across more than 90% of our devices with precision. Autopatch and Defender added speed through visibility.

Thanks to the lessons we learned throughout our update journey, we’re in the process of incorporating capabilities we developed internally into each solution for public release. We’ve also established steps that can help you manage your own Secure Boot certificate updates.

“Technology and culture matter equally here, and our Microsoft culture means we know what’s coming and can act proactively through direct access to our engineering groups,” says Yulia Evgrafova, a principal security service engineer for our Office of the CISO. “On the technology side, we have the expertise to experiment and the privilege of reaching engineering teams directly.”

Secure by default and ready for what’s next

Thanks to thorough telemetry and a measured approach to rolling out the update, we’ve now reached 97% compliance globally, all while keeping our failure rate under one percent and our support burden low. Our devices now validate trusted firmware and boot components by default, keeping the list of trusted components current and closing gaps that attackers could exploit at startup.

This work continues as we collect logs on devices that need attention and remediate the stragglers, including meeting rooms and virtual machines. That long tail is the hard part, but it’s a natural component of any effort at this scale.

What we built here reaches well beyond one certificate update. Telemetry gave us the visibility to protect devices without disrupting people, and that aspect of this rollout will guide get compliant and stay compliant in the future.

“This effort serves as a playbook for many different initiatives that we’ll take on in the future,” Quintana says. “One of the biggest lessons is how we can balance experience and protection between Microsoft Digital and our security teams.”

The post Keeping the enterprise secure by default: Secure Boot certificate updates at Microsoft appeared first on Inside Track.

• Introduction: Building readiness for Agent 365 at Microsoft
• Chapter 1: Establishing a foundation of practice for agent administrators
• Chapter 2: Building a registry of agents to manage them at scale
• Chapter 3: Visualizing agents to support oversight and action
• Chapter 4: Securing agents and aligning Agent 365 with organizational priorities
• Conclusion: Turning visibility into confidence as agents scale

Building readiness for Agent 365 at Microsoft

At Microsoft, we’re on a Frontier Transformation journey to reimagine work and redefine processes through the power of agentic AI.

Microsoft Digital, the company’s IT organization, operates a large and diverse population of agents, built across a broad range of tools and technical capabilities. With Microsoft Agent 365, we now have visibility into more than 500,000 agents.

This distributed control plane has brought agent inventory and governance into one place, giving us a clear view of agent categories, metadata, usage, and ownership information. Agent 365 has also improved our ability to track agent lifecycle and bring in new risk insights.

There’s more work to be done, but it’s already enabling enterprise-scale agent management at Microsoft. Agent 365 provides helpful information about our agent ecosystem, including the top platforms used to create them and the agents our employees use most. It presents this info in helpful, all-up views like the dashboards below.

We’re increasingly connecting agents to business-critical data, involving them in vital workflows, and using them to drive concrete business outcomes. This shift to agentic workflows has inevitably led to questions about operational readiness:

• How do we further accelerate AI-powered innovation without losing visibility, trust, and control?
• How do we create useful, powerful agents while governing them safely?

Agent 365 is becoming an essential vehicle for answering these questions as we enhance agent oversight and control for everyone involved in Frontier Transformation, from AI administrators to security professionals to business decision makers.

Read and prepare

Becoming a Frontier Firm: A guide for deploying AI agents based on our experience at Microsoft.

Agent 365: A response to the challenges of agentic governance

At Microsoft, we share many of the concerns of our customers about properly governing and managing the wide array of agents we build and surface across different platforms. We take a “self-service with guardrails” approach to our productivity estate, which means we give employees the ability to create new workspaces across their Microsoft 365 applications, while we secure assets by default and expand access based on employee needs.

The same is true for agent creation. As a result, the number of agents within our organization has grown rapidly.

“Agent 365 is giving us the confidence to let innovation happen everywhere while ensuring we always understand what agents are doing, how they’re evolving, and where IT needs to engage as a trusted partner in the process.”

Brian Fielder, vice president, Microsoft Digital

Individuals and teams can create agents through a variety of platforms, including Microsoft 365 Copilot Agent Builder, Microsoft SharePoint, Microsoft Teams, Microsoft Copilot Studio, Microsoft Azure AI Foundry, and Agents Toolkit Software Development Kit (SDK). Each platform has its own tools, back-end systems, and ways to view inventory, usage, and risk.

As agents began operating across apps and runtime environments, the need for us to break down management and governance siloes became apparent. An effective method for managing this new class of enterprise asset was required.

We wanted one shared view of all agents in our organization, tightly connected to the people responsible for administration, governance, security, and business outcomes. That’s a challenging prospect—something that no organization has done before.

Microsoft created Agent 365 in response to these needs. In Microsoft Digital, we’ve been working alongside the Agent 365 product team to implement this suite of tools within our production tenant. We’re putting these core capabilities into practice, providing a unified way to observe, manage, govern, and secure agents as they scale across our organization.

“Agent 365 is giving us the confidence to let innovation happen everywhere while ensuring we always understand what agents are doing, how they’re evolving, and where IT needs to engage as a trusted partner in the process,” says Brian Fielder, vice president of Microsoft Digital.

This guide shares what we’ve learned so far:

• How we’re using Agent 365 in Microsoft Digital
• Where we’re supplementing it with additional practices
• Lessons learned that can help you use Agent 365 more effectively, whatever your scale or AI maturity level

From product vision to production

As Customer Zero for Agent 365, it’s important that we’re candid about our journey. Much of the product’s value comes from how we’re incorporating it into our current processes, alongside existing tools.

Scale is also relevant. For smaller or simpler tenants, readiness comes faster. At an organization like Microsoft, with hundreds of thousands of agents, there are times when manual oversight isn’t enough.

We’re actively involved in co-developing the product, uncovering opportunities for capabilities like automation and programmatic solutions to support administration and governance at scale. As part of this process, we’ve partnered closely with the product team to provide continuous feedback and share learnings from our hands-on experiences.

“This has been a strong partnership—daily standups, tracking real issues, and embracing the feedback needed to make the product better. Microsoft Digital plays a critical role as our Customer Zero while operating at a scale like no one else.”

Ray Smith, corporate vice president, Agent 365 product group

Today, we’re using core Agent 365 capabilities while actively sharing feedback with the product group in the following areas:

• Centralizing an accurate inventory of all agents running in the tenant across Microsoft and third‑party platforms to provide a genuinely unified registry across all agent platforms.
• Extending existing enterprise controls by integrating with Microsoft Entra for agent identity, Microsoft Purview for data security and compliance, Microsoft Defender for threat protection, and the Microsoft 365 admin center for operations—all enhanced for improved agent control and management.
• Assisting processes to streamline the lifecycle for agents, including new lifecycle metadata like draft vs. published status, ownership tracking, and usage analysis.
• Surfacing actionable insights and risk signals related to agent behavior, access, data usage, and runtime activity, helping IT prioritize attention and response.
• Supporting enterprise scale through automation and APIs to help manage large, diverse agent deployments without relying on manual management.

While full lifecycle capabilities for certain agent platforms, risk signals, and enterprise-scale automation evolve, we continue to partner with the product group to close gaps while existing processes support current operations.

“This has been a strong partnership—daily standups, tracking real issues, and embracing the feedback needed to make the product better,” says Ray Smith, corporate vice president for the Agent 365 product group. “Microsoft Digital plays a critical role as our Customer Zero while operating at a scale like no one else.”

Read and prepare

Governing AI agents at scale: Lessons from our journey at Microsoft 

Chapter 1: Establishing a foundation of practice for agent administrators

A new opportunity to break down silos between roles

As we began scaling agents inside Microsoft, we discovered that the future of agent management would need to evolve from our current ways of working. We wanted a world where we could create and use agents broadly while keeping administration manageable and consistent.

Getting there required new patterns of practice for IT, especially for administrators operating across different focuses. Agent 365 unifies observability between enterprise roles, acting in concert with the broader Microsoft suite of administration, security, identity, and governance tools.

Here is a summary of the needs of different personas involved in the agent-building and management processes, grouped by office and broken down by role:

Office of the CIO

Developers and makers

Build, test, and deploy intelligent agents at scale

Products: Agent Builder, Copilot Studio, Microsoft Foundry

IT administrators

Control, govern, and monitor agents across the organization

Product: Microsoft 365 Admin Center

Agent users and business decisions makers

Get work done faster with AI-powered assistance

Products: Copilot and Teams

Office of the CISO

SecOps

Detect threats and secure agent activity in real time

Product: Microsoft Defender

Data and compliance

Protect data and enforce compliance policies

Product: Microsoft Purview

Identity manager

Manage identities and access agents and users

Product: Microsoft Entra

We’ve found that our most effective AI administrators come from existing Microsoft 365 backgrounds, because they already have deep expertise with mature tools and processes. Whether they’re generalists or specialists, your administrators will already be positioned to manage agents at scale and use their skills and experience with the tools and insights that Agent 365 delivers.

Shifting from siloed administration to coordinated responsibility

Up until this point at Microsoft, managing agents has been the responsibility of the platform administrators who control agent creation tools. SharePoint administrators manage SharePoint agents, Power Platform administrators manage Copilot Studio agents, and so on. Meanwhile, identity, security, and compliance teams handle their respective layers using Microsoft Entra, Microsoft Defender, and Microsoft Purview—often independently.

We know that this model has the potential to break down as agents become more powerful and more interconnected, and as new agent types begin to run autonomously with their own identities.

“With agents in action across multiple spaces, managing them is a special challenge. It was clear that we needed a silo-buster to govern this new ecosystem effectively.”

Jonathan Clare, principal service engineering manager, Microsoft Digital

Within Microsoft Digital, we’re using Agent 365 to differentiate agent management from platform-specific administration without replacing existing expertise. Instead of creating a single, centralized agent manager that encroaches into each platform’s territory, Agent 365 gives us one shared view across platforms, so administrators can coordinate their work with the same data and context.

With this new, single pane of glass, we’re building shared responsibility and clear handoffs where they make the most sense. For example, our AI administrators manage the full lifecycle of Microsoft 365 Copilot Agent Builder agents. But when Copilot Studio is involved, they collaborate with Power Platform administrators to strategically manage those agents in their specific environment.

Agent 365 provides the connective tissue by providing details and common metadata as we move between platforms and administrators.

“With agents in action across multiple spaces, managing them is a special challenge,” says Jonathan Clare, principal service engineering manager in Microsoft Digital. “It was clear that we needed a silo-buster to govern this new ecosystem effectively.”

Evolving agent management from existing roles

One key insight we’ve uncovered from this work is that agent administration doesn’t require a new IT skill set. It builds on the same foundational experience we already use to manage products like Power Platform, SharePoint, Exchange, and Entra, or other identity-based systems.

“We’re still iterating on the seams between administrators with different responsibilities. Agent 365 is providing the space for AI and identity administrators to work closely alongside their colleagues in security, compliance, and governance.”

David Johnson, principal PM architect, Microsoft Digital

The core skills of maintaining accurate inventory, ensuring visibility and access, managing lifecycle, and mitigating risk are already mature and deeply established in our organization. Agent 365 now gives us the broad insight we need to oversee all agents in one place.

From there, we can lean into our well-developed expertise and mature processes with newly enhanced tools, shared metadata, logging, and controls. This coordination gives each team in sequence a sense of clarity and partnership, rather than feeding effort up and down a chain of approval.

“We’re still iterating on the seams between administrators with different responsibilities,” says David Johnson, a principal PM architect in Microsoft Digital. “Agent 365 is providing the space for AI and identity administrators to work closely alongside their colleagues in security, compliance, and governance.”

As we progress, we’re developing a three‑part administrative model facilitated by the oversight that Agent 365 provides.

AI administrators, the primary users for Agent 365

• Oversee complete agent inventory and usage at the tenant level
• Manage the agent lifecycle with the platform coordination to cover a broad range of agent types
• Provide the connective tissue between security, governance, identity, and platform administrators

Agent Identity administrators, new with Agent ID

• Manage agent identities after provisioning and throughout the agent’s lifecycle
• Manage lifecycle events tied to users, access changes, and deprovisioning
• Build identity backed policies for agent workload management and risk mitigation

Security, compliance, and governance teams

• Define the guardrails that apply to agents and agent blueprints, portable specifications for agents’ identities, capabilities, constraints, policies, data access, and lifecycles
• Approve the kinds of data, tools, and permissions agents can request
• Set agent evaluation and risk assessment criteria along with risk-aligned approval workflows
• Align publishing and runtime decisions with risk tolerance and security policy

Agent 365 facilitates this model by providing comprehensive agent coverage. This acts as a shared coordination layer, bringing different administrator, security, identity, and governance roles into a unified space.

Agent 365 in practice: Agent publishing and workflows

We didn’t create Agent 365 to handle every IT workflow. Many approval, vetting, and escalation processes are specific to an organization’s risk posture and operating model. At Microsoft, we’re currently handling much of that logic using an existing risk assessment and publishing workflow while evaluating how Agent 365 capabilities can simplify those steps. An example of the type of risk we look for is when an agent could read sensitive data and write it to destinations with broad access, like external sites or apps.

There are several areas of risk we use Agent 365 to assess:

Agent 365 itself assists us with additional risk awareness:  

Real-time

• Observability across agents
• Surfacing signals from identity, security, and governance systems
• Supporting the ability to act when risks or issues surface

Proactive

• More intelligent risk insight during the agent permissioning and approval processes
• Consistent agent publishing into the environment
• Forthcoming capability: the ability to integrate with our existing agent review and publishing process that spans multiple teams, including administration, governance, and security

As you consider ways to collaborate across your own administrator teams, our silo-busting approach can act as a helpful guide.

Chapter 2: Building a registry of agents to manage them at scale

A centralized source of truth for AI agents across the enterprise

As agents have proliferated across Microsoft, visibility has proven essential for robust governance. Without a clear understanding of all the agents that exist in our environment, including their origin and how people use them, it’s very difficult to make informed decisions or respond confidently when risks emerge. Establishing a thorough registry of agents and their key information is a critical step in governing the ecosystem.

Agent 365 provides that oversight.

Why an agent registry matters

An agent registry establishes the foundation for oversight, control, and compliance. As an organization introduces more agents, the environment can quickly become fragmented and difficult to track.

A comprehensive registry provides a single, authoritative inventory that makes every agent visible, tracks ownership, and captures key metadata. With that baseline, organizations can consistently govern, secure, and manage their agents with confidence.

“Managing agents begins with having a complete inventory with rich information, like their name, lifecycle status, type, ID, owner, where we created them, and where we’re using them. Once you have that level of clarity, everything else—security, compliance, lifecycle management—becomes much easier to manage.”

Mike Powers, AI administrator, Microsoft Digital

At the scale of a company like Microsoft, even small gaps in visibility can quickly become operational hurdles or compliance liabilities. Without that foundation, an organization faces substantial risks:

• Ownerless agents remain active after employees leave the company.
• Shadow or unsanctioned agents are difficult to detect.
• Oversight is unreliable with respect to agent growth, usage, and impact.

“Managing agents begins with having a complete inventory with rich information, like their name, lifecycle status, type, ID, owner, where we created them, and where we’re using them,” says Mike Powers, an AI administrator in Microsoft Digital. “Once you have that level of clarity, everything else—security, compliance, lifecycle management—becomes much easier to manage.”

Agent 365 registry capabilities

Within Agent 365, the registry acts as a central inventory enriched with metadata. We use that metadata to meet compliance, security, and management standards, including:

• Agent ownership and associated teams
• Creation platforms and publishing surfaces
• Lifecycle states like “draft” or “published”
• User scope: who can discover and use the agent

In Microsoft Digital, we’re providing real-world feedback to the Agent 365 product group to enable even more types of metadata, like differentiation between system vs. user-created agents, and new agent types like AI teammates. We’re also using metadata surfaced from the platform where the agent was created, for example, the Power Platform environment ID for Copilot Studio agents and the Azure AI Foundry subscription details for Foundry agents.

Agent 365 amalgamates all of this metadata into a single view.

This structure matters because agents vary widely. Some are short‑lived experiments. Some belong to only one employee, while others are broadly shared. Treating them all the same doesn’t make sense.

From an administrative perspective, the registry gives us:

A summary view of total agent count

Insights around growth and adoption

Identification of agents without owners

Analytics on platforms used to make agents and their usage trends

Search, sort, and filtering with customizable columns to get detailed views across agent types

Robust inventory export capabilities to support collaboration with security, compliance, and business stakeholders

Establishing our Agent 365 registry

The agent registry is an out-of-the-box feature for Agent 365, so there’s nothing to deploy or configure. As Customer Zero, we’ve focused much of our early work on validating the registry for accuracy and completeness.

Agent 365 automatically ingests agent metadata from supported platforms. This technology is still new, so we’ve partnered with product teams across SharePoint, Power Platform, Azure AI Foundry, and other builder experiences to reconcile counts, ensure accuracy, and request additional relevant metadata.

For first-party tools, Agent 365 creates registry entries automatically. Third-party agents can also benefit from automatic registration if their creators use the Agent 365 SDK during development.

For pro‑code scenarios, Entra Agent ID is key. Registering an agent through Entra assigns it a formal identity, which lays the groundwork for consistent identity and lifecycle management and conditional access policies.

Acting on the registry

The registry is a living system. Ownership changes, while lifecycle states and usage signals update automatically.

That means the registry supports critical processes for administrators that include:

• Passing audits for elements like tracking agent ownership
• Presenting the tenant’s agent footprint and usage to business decision makers
• Scoping agents to specific users, or excluding users based on regional or regulatory requirements
• Highlighting high‑impact agents based on usage and runtime

A single view has been one of the most valuable outcomes for us, enabling informed operational decisions and peer-to-peer collaboration.

Looking ahead

The registry is also the prerequisite for future experiences, including broader agent discovery and publishing. Moving forward, it will provide the context we need to guide reuse, review, publishing, and eventual retirement to support intentional agent lifecycle practices over time. As a result, it will be easier to combat sprawl and ownerless agents.

In Microsoft Digital, our early Agent 365 efforts have focused on validating our agent registry to lay the foundation for comprehensive observability. It may be helpful for you to mirror this approach.

Chapter 3: Visualizing agents to support oversight and action

Observability: Scaling beyond dashboards

At the scale of an organization like Microsoft, dashboards alone aren’t enough. We already have hundreds of thousands of agents in use across the company. At that scale, it would be impossible to review these agents individually. We rely on well-established governance in the form of guardrails, established software development lifecycle procedures, and risk-based app and agent management policies that trigger reviews when we detect risk.

Agent 365 helps us operationalize oversight using automation and rules engines, programmatic access via APIs and scripting, and bulk actions based on attributes like permissions, connectors, and usage patterns.

A simple user interface is essential for visibility, assessment, and decision‑making. Programmatic access is essential for execution. Effective agent administration requires both.

The lesson is that administering agents during Frontier Transformation requires a new approach that breaks out of traditional roles and inter-team hierarchies. By incorporating our experience into your own planning, you can use Agent 365 more effectively.

Why visualization matters

As agents spread across Microsoft, we learned that inventory alone isn’t enough. Knowing an agent exists is helpful, but understanding how people use it, how it connects to data and other agents to complete workflows, and where risks or concentration points emerge is what makes effective governance possible at scale.

In a Frontier Firm where almost anyone can create agents, observability is a core pillar of management. Like many organizations, we built agents first and only later confronted the challenge of seeing what existed. Agent 365 will help other organizations reverse that order by surfacing agent behavior continuously from the start.

“Just this first layer of visualizing our agent ecosystem in one central place is a big step toward flowing them into our business processes and demonstrating ROI more effectively.”

Amy Ceurvorst, director of business programs, Microsoft Digital

Visualization is helping us address questions we couldn’t answer before:

• Where is agent growth accelerating?
• Which agents are widely used?
• Where do risk hot spots occur across connectors, data sources, and permissions?
• What demands attention now, and what can wait?

“We’re uncovering so many new use cases for agents,” says Amy Ceurvorst, a director of business programs in Microsoft Digital. “Just this first layer of visualizing our agent ecosystem in one central place is a big step toward flowing them into our business processes and demonstrating ROI more effectively.”

The agent landscape changes quickly, and with Agent 365, we can look at usage at the individual agent level to track shifts over time. For example, Cowork (Frontier) is one of our newest agents, but in just a few weeks it became our most widely used.

In a recent review of Cowork adoption, Agent 365 allowed us to quickly analyze names, session activity, and locations for Cowork’s 58,000 active users in just a few minutes.

This is also where Agent 365 complements rather than replaces Viva Insights:

• Viva Insights combines Agent 365 data with our organization’s people data to provide enhanced insights into agent usage across the organization.
• Agent 365 provides oversight for the full agent estate: registry, publishing, ownership, lifecycle, and governance.

Both are important, but they serve different personas. Where Viva helps clarify usage for adoption leaders and change managers, Agent 365 helps determine what action IT should take next.

The Viva Insights Agent Dashboard extends the data in Agent 365 by translating agent inventory and telemetry into executive‑ready insights on adoption, usage patterns, and trends across the organization. By combining agent activity with organizational context, it helps leaders understand where people are using agents, how adoption is evolving over time, and where opportunities or risks may exist.

Together, Agent 365 and Viva Insights provide a governed, end‑to‑end view that supports informed decisions about scaling and governing agents to drive business impact.

From insight to action

One of our biggest lessons as Customer Zero is that visualization only matters if it leads to action. In Agent 365, insights increasingly surface as prioritized scenarios, such as risky, ownerless, or unused agents. We can then pair those insights with paths to response—for example, meeting compliance expectations by re-assigning or retiring ownerless agents.

“Agent 365 is saving us time by helping us analyze the kinds of issues that are common in agent management and bringing those to our administrators’ attention. It acts as a command center that surfaces those issues programmatically, so we’re able to prioritize the actions we need to take.”

Nate Zimmer, senior product manager, Microsoft Digital

Visualization in Agent 365 is about prioritization. For us, some of the most valuable scenarios include:

Ownerless agents

Visualization helps us distinguish unused agents we can retire vs. heavily used agents that need reassignment.

Duplication and naming patterns

Many agents share similar names. Visual signals help differentiate them based on usage and connections.

Trending agents

Rapid adoption can signal value or risk, necessitating a closer look for administrators.

Strategic adoption signals

Identify high-impact agents to scale as business priorities.

The goal is to focus attention where it counts.

“Agent 365 is saving us time by helping us analyze the kinds of issues that are common in agent management and bringing those to our administrators’ attention,” says Nate Zimmer, a senior product manager in Microsoft Digital. “It acts as a command center that surfaces those issues programmatically, so we’re able to prioritize the actions we need to take.”

Continuously clearing the fog

Observability is never finished. New agent types and creation tools continue to emerge. Agent 365 helps us embrace that reality by connecting signals across Microsoft 365, identity, security, and compliance for a continuously updated view of an evolving agent landscape.

We believe the Agent Map is going to be a differentiator in agent visualization, and we’re closely working with the product team to inform new, robust capabilities that will help us drill down to find hot spots, details on agent connectors, tools, and knowledge sources more easily.

For example, we use the large surface area provided by the Agent Map to search and filter for exactly what we want and then dive deeper into details.

Observability has been crucial for helping us guide agent usage at Microsoft. As you conduct Frontier Transformation at your organization, consider ways that observability has led to better oversight for our team, and incorporate them into your AI administrators’ discipline.

Chapter 4: Securing agents and aligning Agent 365 with organizational priorities

Melding agent oversight, identity, security, and governance

In Microsoft Digital, we’ve learned that securing agentic AI isn’t about inventing an entirely new security model. Instead, the focus should be on extending the identity, data, and threat protections we already trust, while also making risk visible in one place. Agent 365 plays a critical role by surfacing agent‑related security signals in a single view so that IT teams can see what matters quickly, even when remediation happens elsewhere.

The agentic security challenge

Up to this point, understanding agent risk has meant pulling information from multiple tools and manually stitching together context. Identity management lives in one place, data protection in another, and threat insights somewhere else. That makes it harder for IT administrators to spot patterns and gain insight.

“A lack of visibility creates real security risk, exposed data access, unmonitored behaviors, and unmanaged identities. Agent 365 helps us regain control by building a comprehensive inventory and risk profile of agents.”

Prathiba Enjeti, principal security manager, CISO

Other factors compound the challenge:

• People and teams are creating agents quickly, accelerating the need for manual reviews.
• Agents can operate across apps, data sources, action types, data, and data destinations, and they carry the potential for other agents to expand the attack surface, complicating oversight and control.
• Risk emerges at multiple stages, both during agent development (design time) and during execution (run time).

“This lack of visibility creates real security risk, exposed data access, unmonitored behaviors, and unmanaged identities,” says Prathiba Enjeti, a principal security manager for the Microsoft CISO organization. “Agent 365 helps us regain control by building a comprehensive inventory and risk profile of agents.”

Theoretically, existing agent governance policies and practices should mitigate these risks, but there are always exceptions. It’s easy to miss early warning signals, and teams may only detect issues after they have an impact.

Agent 365 helps us identify and remediate those issues.

Agent 365 as a security visibility layer

As we bring Agent 365 into our operational workflows, it connects with Microsoft Purview, Microsoft Entra, and Microsoft Defender, surfacing relevant agent‑specific risk insights in a cohesive experience. That reduces fragmentation and supports more informed, coordinated decisions.

You can see how Agent 365 capabilities apply to different members of the agent administration and management ecosystem.

Rather than replacing those tools, Agent 365 ingests identity signals from Entra, data signals from Purview, and runtime behavior from Defender. In practice, we think about agent security in two main categories:

• Build‑time risk: These signals surface when people create or configure agents. Examples include overly broad permissions, insecure configurations, or missing responsible AI safeguards. Seeing these early helps reduce downstream risk and rework.
• Run-time risk: As agents operate, they can expose data unexpectedly, become susceptible to vulnerabilities like prompt injection, or lose protection as data moves across systems. Run-time visibility becomes even more important as agents begin working together.

Agent 365 doesn’t eliminate these risks, but it does have the capacity to make them more visible, traceable, and easier to prioritize and mitigate. Follow‑up actions still happen in Entra, Purview, and Defender, but now those administrators benefit from improved oversight and coordination.

What we’ve learned so far

Internally, broader visibility has helped us uncover issues we had difficulty tracking before, like ownerless agents spanning multiple platforms or unexpected data handling behaviors. While more broadly available agent oversight might seem intimidating because it widens scrutiny, we’ve found that additional data and insights have accelerated alignment and improved decision making.

With Agent 365, we now have better conversations through shared context and metadata. As a result, IT, security, and business teams can discuss adoption trends and mitigate risk using the same information instead of chasing it across tools.

Conclusion: Turning visibility into confidence as agents scale

As we reflect on the early days of Agent 365, visibility is the foundation for everything that follows. As Customer Zero, our priority has been to understand the full extent of agents across our environment.

The real value will come when we can drill down further. How are people using agents? What risk patterns repeat? What building and usage trends emerge as Frontier Transformation progresses?

“When we started, I thought the hardest part would be the technology, but it turned out to be building the weekly rhythm where IT, security, identity, product, and business unit teams could look at the same picture, make decisions from the same facts, and act together. My advice to every IT leader is to establish that governance rhythm before your agent count grows faster than your ability to manage it.”

Garima Tiwari, principal product manager, Agent 365 Customer Zero, Microsoft Digital

As we mature in our use of Agent 365, it will give us greater ability to move from simple metrics like volumes of agents to more meaningful measures of impact. It will also help us see trends in our environment by segmenting low-use experimental agents from business‑critical digital workers so we can move beyond isolated usage to scaled adoption.

It’s important to be clear about where we are on this journey. Our operating model for Agent 365 isn’t complete. Much of our current focus is still on seeing clearly by surfacing trends, comparisons, and emerging patterns we couldn’t identify before.

“When we started, I thought the hardest part would be the technology, but it turned out to be building the weekly rhythm where IT, security, identity, product, and business unit teams could look at the same picture, make decisions from the same facts, and act together,” says Garima Tiwari, a principal product manager for Agent 365 Customer Zero in Microsoft Digital. “My advice to every IT leader is to establish that governance rhythm before your agent count grows faster than your ability to manage it.”

That visibility is already paying dividends by revealing duplication, ownerless agents, and cross‑platform risks that would otherwise remain uncovered. Over time, those insights will increasingly feed automation, lifecycle workflows, and deeper integrations across identity, security, and governance.

Looking ahead, our next steps are about translating this oversight into action at scale. That will include preparing for broader agent discovery, refining lifecycle management, and enabling new personas, such as managers who are responsible for selecting, creating, and overseeing digital workers. It will also encapsulate learning as new agent types, tools, and usage patterns emerge. Change is constant in a Frontier Firm environment; readiness is something you build continuously, not something you check off once.

“Agent 365 represents a new operating model for AI at scale. By bringing visibility, governance, and security together, it helps organizations move beyond experimentation and toward a future where agents are trusted and embedded in everyday work, all without slowing innovation.”

Stephan Kerametlian, senior director, Microsoft Digital

Our overall message in this guide is straightforward: You don’t need to have every answer on day one. What matters most is establishing the conditions for safe evolution as agents scale. Think about clear administration practices, a reliable registry, effective observability, and security signals you can trust. Here at Microsoft, Agent 365 has become an important part of that foundation.

“Agent 365 represents a new operating model for AI at scale,” says Stephan Kerametlian, a senior director in Microsoft Digital. “By bringing visibility, governance, and security together, it helps organizations move beyond experimentation and toward a future where agents are trusted and embedded in everyday work, all without slowing innovation.”

We’ll continue sharing what we learn as Customer Zero. As your organization moves through its own Frontier Firm transformation, we hope these lessons help you build the confidence to innovate quickly, supported by comprehensive insights, thoughtful governance, and security that scales with your ambition.

The post Implementing Agent 365: How we’re governing and managing AI agents at Microsoft appeared first on Inside Track.

During in-person briefings, I often remind our customers that generative AI systems like Copilot and Copilot Cowork are still quite new, and that they upend decades of human-computer interaction patterns. For over 40 years, we’ve trained knowledge workers to memorize patterns in the GUI to support their productivity.

With Copilot and agents, you can type nearly anything as a prompt and instantly get a detailed response, or create an agent to autonomously complete a business process on your behalf. It’s a very new way of working, and it’s no surprise that many knowledge workers—and even engineers themselves—are still adapting.

More than anything, our customers are looking for one key insight: They want to know how we measure and define the business value of Copilot and agents at Microsoft, especially through the lens of increased productivity and cost savings. After all, AI systems represent a significant investment for our customers, and leaders want to have confidence that they’ll yield sufficient ROI to justify the cost, knowing that the payback period isn’t immediate.

Six steps to proving value

So, how do you prove the value of AI-powered tools in the enterprise? There are six main steps that I share with customers that I believe are critical, based on the empirical evidence we’ve gathered in Microsoft Digital.

Our big mistake? We didn’t instrument all the arduous business processes that slow us down and impact effectiveness before our deployment, so that we could more easily prove the value of AI across our enterprise after deployment.

Here are further details on the six measurement steps to keep in mind:

1. Before you deploy, talk to people who are doing the frontline work in your organization. These should be hands-on managers or influential individual contributors (ICs), not executives or mid-level managers who are abstracted away from the work (although these individuals can be useful in helping identify the right SMEs to talk to).

For each role, identify three to five everyday pain points that could benefit from Copilot or agents. These could be operational, business, or technological processes, all of which can be improved by thoughtful applications of AI. This phase provides a great chance to use Six Sigma skills or other continuous improvement (CI) methodologies to evaluate your processes and identify waste, then consider how a combination of CI and AI could make them more efficient.

2. Once identified, instrument and measure each of the processes to get baseline data on the average time it takes to complete them. Then the hard work begins—you need to think deeply about how AI could make those processes better. This could be through defining a series of step-like prompts that take away the toil. It could be through further AI-powered automation to make some of the steps go away. It could be applications of AI that validate outputs to ensure that rework is minimized. More and more, it could be an agent that completes the work on the employee’s behalf.

If you lack detailed telemetry for the process in question, you have two options. The first is preferable: Build end-to-end telemetry, so you have observability throughout the process in question. While this is always the best way to reliably measure productivity gains at scale, there is also a second option: Identify a cross-section of ICs and measure them the old-fashioned way as they complete the process in question—with a stopwatch. Take the average of several people to get a better sense of how much time is typically needed to complete the task. Then consider how AI could make that process more efficient, while also improving the resulting business outcomes.

3. Concurrent with your investigation into ways that AI can improve productivity and reduce toil, you need to invest in enterprise AI skilling, ideally by role. The fact is, engineers are going to use AI differently than operations staff, who are going to use it differently than sales and marketing pros. Yes, there are common skills for each, but the best training is tailored to the role, grounded in the experience of using Copilot or agents to address challenges or opportunities that commonly arise in their day-to-day work.

It’s also important to ensure your employees understand the strengths and weaknesses of current AI models. No model is perfect, and understanding where reasoning errors can occur will help them avoid accepting AI-generated output that may be inaccurate. Human discernment and observability is a critical step in validating AI outputs.

A best practice is to gate access to generative AI; require employees to engage in both general and role-specific training prior to their provisioning to ensure they immediately unlock value in their work.

4. After you’ve trained your employees and given them the skills to succeed with AI and agents in the enterprise, begin your deployment in earnest. For tools like Copilot, we recommend deploying in cohorts by role, focusing on employees who will immediately see the greatest benefit. At Microsoft, we started with our sales team and then gradually deployed to the remaining employee population over the course of several months. This enabled us to scale up our skilling programs, governance strategies, and support function in anticipation of increased volumes. For agents, deploy to support the biggest pain points first, then monitor and observe agent performance before scaling to additional business or operational processes.
5. Post-deployment, give it a few weeks, then return to those same processes you identified in the first step and measure the average time savings. If time savings aren’t as significant as you hoped with either Copilot or agents, go back to process evaluation and employee skilling and continue to refine your approach.

This whole process is intentionally iterative—you’re not likely to get it exactly right on the first attempt. But if a process that used to take 30 minutes can now be completed in 10, you’ve obviously made a big difference that will save a lot of time when extrapolated across an entire fiscal year. Even better if that end-to-end process is now being completed by an autonomous agent, with a human reviewing and validating the output.

After you’ve succeeded in one domain, identify different role leaders and find another batch of processes that could be improved with a combination of continuous improvement and AI. There’s really no limit to the scope of ways you can positively impact your employees if you maintain a sharp focus on continually improving their experience with Copilot and agents.

6. The final step: Reclaim the value from those productivity savings and apply it to new business challenges or opportunities. Let’s be clear—most enterprises aren’t investing in AI solely to give their people back time. They’re trying to do more with less, enabling their workers to be more productive and generate more value for the company.

In this crucial final phase, you need to be thoughtful and deliberate about how you’ll use the time saved with AI. If your people are saving two hours per week on average, how will they use that time? There are innumerable ways you could redeploy that time to address new business challenges or opportunities. The key is to be intentional in maximizing value, so it aligns with your team and your company’s goals and ambitions. Then report those savings to the appropriate members of the leadership team, to help them understand how their AI investments are paying off.

There you have it—you now possess the tools to quantify the value of your generative AI investments in the enterprise, using them to recapture value and drive more business impact thanks to the power of Copilot and agents.

Learn more

Dive deeper into this topic with a framework that our organization put together to measure the impact Copilot is having at Microsoft.

Boosting AI adoption with structured change management

As you can see from the graphic above, it’s important to surround the AI value measurement process with structured change management and ongoing employee skilling. In Microsoft Digital, we’ve learned that even the most useful or intuitive technologies won’t see widespread adoption without a deliberate and sustained change management effort that’s localized to meet the disparate needs of a global organization.

In our case, that meant cultivating and supporting a community of Copilot Champions who have become the backbone of our global change management strategy. This community is now 10,000+ strong and even has its own Viva Engage forum, where our Copilot enthusiasts answer employee questions and share useful prompts.

Unfortunately, just doing AI skilling once won’t be enough. The pace of change with Copilot and agents is simply too great to do one training effort and then move on. Building an AI-forward culture takes time, and ongoing opportunities to learn and improve skills are one of the best ways to help your employees build the AI habit.

The Microsoft 365 Admin Center has an “AI adoption score” that can help you see—by cohort—how successfully people are building that habit. Having employees who use Copilot three times per week in any way is enough to build an AI-focused workforce, enabling your company to unlock the value of AI in the enterprise.

The promise of generative AI is significant, and there’s no doubt that you’ll see qualitative benefits in your organization even if you don’t instrument every process. But in an era of tight IT budgets, having the quantitative data necessary to calculate the ROI of your investments in Copilot and agents will make it far more likely that you’ll get financial support from your executive team to deploy and succeed at scale.

The post Unlocking the value of Microsoft 365 Copilot and agents at Microsoft appeared first on Inside Track.