{"id":18694,"date":"2025-09-18T09:05:00","date_gmt":"2025-09-18T16:05:00","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=18694"},"modified":"2026-06-17T09:18:52","modified_gmt":"2026-06-17T16:18:52","slug":"how-our-employees-are-extending-enterprise-ai-with-custom-retrieval-agents","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/how-our-employees-are-extending-enterprise-ai-with-custom-retrieval-agents\/","title":{"rendered":"How our employees are extending enterprise AI with custom retrieval agents"},"content":{"rendered":"\n

Employees who are using Microsoft 365 Copilot to transform the way they work now have a new tool to help them even more\u2014the agent.<\/p>\n\n\n\n

At Microsoft, we\u2019re deploying a spectrum of agents to fulfill different needs, from acting as knowledge sources for our individual employees, to helpers that handle specific tasks for our teams, organizations, and for the full company. <\/p>\n\n\n\n

Of the different kinds of agents, the easiest to implement are retrieval agents, which employees can build using Microsoft Copilot Studio agent builder or SharePoint. After a few quick steps, the agents they create retrieve information for them from data grounded in our Microsoft 365 tenant, like a SharePoint library or collection of libraries, reason over it, summarize it, and answer their questions. <\/p>\n\n\n\n

As one of the first enterprise IT organizations to deploy this capability to our employees, we\u2019re starting to see their impact first-hand, and along the way, we\u2019re learning lessons that our customers can use to unlock their own agentic abilities.<\/p>\n\n\n\n

Copilot + retrieval agents: A new way to drive enterprise AI value<\/h2>\n\n\n\n

So, what are retrieval agents?<\/p>\n\n\n\n

First, it\u2019s important to understand where these Microsoft 365 Copilot extensions fit within the emerging agentic environment.<\/p>\n\n\n\n

Copilot agents expand Copilot\u2019s knowledge and skills, and they can even operate autonomously to complete tasks or automate processes<\/a>. Retrieval agents operate at the simplest end of the agentic spectrum and are the easiest for employees to create.<\/p>\n\n\n\n

Types of agents<\/h2>\n\n\n\n
\"A
As part of the wider framework of Microsoft 365 Copilot extensibility, retrieval agents are the simplest extensions to create and administer.<\/em><\/figcaption><\/figure>\n\n\n\n

“Retrieval agents wrap around knowledge sources and data sets, and they include system prompts so they behave the way their creators want,\u201d says Aisha Hasan, Power Platform and Copilot Studio product manager for Microsoft Digital. \u201cThey\u2019re AI helpers that our employees can create to find what they want without having to search around manually.”<\/p>\n\n\n\n

\"A<\/figure>\n\n\n\n
\n

\u201cIf we think of Copilot as the UI for AI, retrieval agents are a further layer on that UI, that can access and reason over their organization\u2019s data.\u201d<\/p>\nMykhailo Sydorchuk, Customer Zero lead for Microsoft 365 integrated apps, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n

A retrieval agent is essentially Copilot, plus its creator\u2019s instructions, plus grounding in a particular data set. These extensions can accomplish a wide variety of jobs, from acting as an event planning assistant to sourcing insights into business optimizations to surfacing internal guidance around leadership best practices. <\/p>\n\n\n\n

\u201cIf we think of Copilot as the UI for AI, retrieval agents are a further layer on that UI, that can access and reason over their organization\u2019s data,\u201d says Mykhailo Sydorchuk, Customer Zero lead for Microsoft 365 integrated apps at Microsoft Digital. \u201cThey can also address other data sets and systems using Copilot, without the need to build custom connectors or orchestration.\u201d<\/p>\n\n\n\n

At Microsoft, retrieval agents are accelerating our AI journey by enabling employees to tailor Copilot\u2019s capabilities to their own work and specific knowledge sources. Their value comes from creating micro-experiences that meet specialized needs to enhance productivity and information discoverability.<\/p>\n\n\n\n

\n

\u201cWith Copilot Studio agent builder and retrieval agents, we\u2019re empowering our employee citizen developers to experiment freely and create agents easily, then share them out, all surrounded by the right governance and management process.”<\/p>\nAmy Rosenkranz, principal product manager for Customer Zero Extensibility, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n

Creating retrieval agents couldn\u2019t be easier. One option is through Microsoft Copilot Studio agent builder<\/a>, accessible through Copilot Chat within Microsoft Teams. Employees can use natural language prompts and a simplified configuration process to provide custom instructions, tell their agents how to behave, and provide specific data and knowledge sources.<\/p>\n\n\n\n

SharePoint agents are another opportunity to add AI assistance into everyday work. These enable users to turn SharePoint sites and documents into scoped agents that are subject matter experts for your business needs. Site owners or admins simply customize their SharePoint agent\u2019s branding and purpose, specify the sites, pages, and files it should get information from, and define customized prompts tailored to its purpose and scope.\u200b\u200b\u200b\u200b\u200b\u200b\u200b<\/p>\n\n\n\n

\u201cWe\u2019re targeting our core enterprise professional developer scenarios with more advanced tooling,\u201d says Amy Rosenkranz, principal product manager for Customer Zero Extensibility in Microsoft Digital. \u201cBut with Copilot Studio agent builder and retrieval agents, we\u2019re empowering our employee citizen developers to experiment freely and create agents easily, then share them out, all surrounded by the right governance and management process.\u201d<\/p>\n\n\n\n

Enabling retrieval agents while ensuring our organization\u2019s integrity <\/h2>\n\n\n\n

While agents represent a leap forward in AI-powered productivity, capturing that value means balancing the freedom to explore with the need to protect our company.<\/p>\n\n\n\n

Microsoft is one of the first and largest organizations to extend Microsoft 365 Copilot by enabling agents. As a result, our team here in Microsoft Digital, the company\u2019s IT organization, has been hard at work ensuring those agents don\u2019t put the company at risk.<\/p>\n\n\n\n

\"A<\/figure>\n\n\n\n
\n

“The beauty of retrieval agents is that, for the most part, they\u2019re grounded in Microsoft 365 data, so they provide a single-pane view within Teams, instead of forcing users to go from one source to another to seek out information.”<\/p>\nAisha Hasan, Power Platform and Copilot Studio product manager, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n

The level of risk an agent presents largely depends on its access to data sources and the actions it can take. More advanced task and autonomous agents need to cross Microsoft 365 tenant boundaries to enable actions<\/a>. But retrieval agents are much simpler.<\/p>\n\n\n\n

Retrieval agents typically only access data within tenant boundaries through graph connectors. Although they occasionally need to connect with information outside the tenant, they only retrieve data and don\u2019t transmit it externally. As a result, administrating and governing these agents is much simpler.<\/p>\n\n\n\n

\u201cThe beauty of retrieval agents is that, for the most part, they\u2019re grounded in Microsoft 365 data, so they provide a single-pane view within Teams, instead of forcing users to go from one source to another to seek out information,\u201d Hasan says. \u201cWhatever your window of productivity might be, you can interact with the information you need without constantly switching context.\u201d<\/p>\n\n\n\n

We started small, experimenting with retrieval agents with trusted stakeholders and reviewing each one to ensure they didn\u2019t present unacceptable risks to the company. Through what we learned during that process and the data safety controls we maintain across our tenant, we\u2019ve minimized the scenarios where agents require reviews, which only come into play for more complex agents that build on bespoke graph connectors, API plugins, or custom orchestration to access external knowledge sources and take actions.<\/p>\n\n\n\n

Our confidence in retrieval agents\u2019 safety comes from a few key factors.<\/p>\n\n\n\n

Administration and configuration<\/h3>\n\n\n\n

Retrieval agents\u2019 simplicity also helps us keep the risk of data overexposure low. Unlike more complex agents that require security assessments, threat modeling, privacy assessments, and Responsible AI reviews, we\u2019re able to define our policies for retrieval agents at the agent builder environment level.<\/p>\n\n\n\n

We empower tenant administrators and our partners on the Microsoft Security team to apply data loss prevention policies that configure what individual employees can enable for their retrieval agents. At this level, everyone in the company has the same configuration and tools available, and automation largely handles agent reviews and assessments. We based these pre-configured settings on the same security, privacy, and regulatory compliance standards we apply to any internally built application.<\/p>\n\n\n\n

Approved graph connectors<\/h3>\n\n\n\n

Graph connectors increase the discoverability of external data by integrating it into an agent\u2019s grounding. At Microsoft, we\u2019ve onboarded a series of approved connectors that creators can use to incorporate additional data for their agents to reason over. They include connectors for external websites as well as tools like Azure DevOps and ServiceNow.<\/p>\n\n\n\n

Our criteria and review process for connectors ensure that agents don\u2019t put our tenant at risk. As long as a connector is approved, employees are free to use it to create their agents.<\/p>\n\n\n\n

Ensuring Responsible AI standards at the platform layer<\/h3>\n\n\n\n

Microsoft has been at the forefront of establishing Responsible AI principles<\/a>: fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. To ensure we enabled retrieval agents that would respect Responsible AI standards, we needed to translate those concepts into concrete policies we could apply at the platform level.<\/p>\n\n\n\n

Microsoft\u2019s Office of Responsible AI has been an indispensable resource during this process. They maintain a comprehensive and evolving list of policy statements around restricted uses for AI capabilities. Those include things like using AI to infer emotions or personal characteristics, assess employee performance, or social scoring.<\/p>\n\n\n\n

As our implementation of retrieval agents matured, we instituted controls at the platform layer to block these restricted uses for AI, identifying what kinds of information an agent can retrieve. Now, Copilot Studio agent builder knows how to evaluate responsibility against a wide array of parameters and make determinations based on the parameters we\u2019ve set out.<\/p>\n\n\n\n

For example, if a manager attempted to create a retrieval agent that would assess employee performance based on meeting attendance, guardrails at the platform layer would curtail that ability. Naturally, as we develop our policies around responsible AI further, the parameters of Responsible AI will shift and grow, and we\u2019ll continue to nuance our configurations.<\/p>\n\n\n\n

Thanks to these foundations, we\u2019re now at the point where we feel comfortable giving every Microsoft employee access to Microsoft Copilot Studio agent builder and the freedom to create retrieval agents. It\u2019s all part of our principle of employee self-service with guardrails<\/a>.<\/p>\n\n\n\n

\u201cIt\u2019s a constant evaluation,\u201d says Hasan. \u201cOur goal is to allow as much freedom as we can with retrieval agents so employees can increase productivity without going down the path of greater customization that requires more intensive review.\u201d<\/p>\n\n\n\n

Different organizations are at different stages of their AI maturity journey. As you experiment with Copilot extensibility, it will be important to define your organization\u2019s level of experience implementing AI tools, your employees\u2019 state of readiness and training, key risk areas, and sensitive scenarios.<\/p>\n\n\n\n

\"A<\/figure>\n\n\n\n
\n

\u201cUsers who want to build agents with no code can select from premade templates using natural language, or they can fill out a few fields.”<\/p>\nBrian Moran, senior product manager, Employee Experiences team, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n

From there, you\u2019ll be able to use out-of-the-box configuration capabilities in Copilot Studio agent builder to establish guardrails that work for you. It will take careful collaboration across security, privacy, legal, and IT teams, but we\u2019re already learning that the benefits are worth the effort.<\/p>\n\n\n\n

Ease and access drive creativity and new ways to work<\/h2>\n\n\n\n

Now that we\u2019ve empowered our employees to build retrieval agents organization-wide, examples of creativity and innovation are popping up all over the company. Ease of use and freedom have a lot to do with this proliferation.<\/p>\n\n\n\n

Using Copilot Studio agent builder<\/h2>\n\n\n\n
\"The
Microsoft Copilot Studio agent builder provides a simple interface for creating agents, unlocking the power of Copilot extensibility for non-technical employees.<\/em><\/figcaption><\/figure>\n\n\n\n

\u201cUsers who want to build agents with no code can select from premade templates using natural language, or they can fill out a few fields,\u201d says Brian Moran, senior product manager on the Employee Experiences team at Microsoft Digital. \u201cThey can get their agents up and running in minutes.\u201d<\/p>\n\n\n\n

Creative examples of the ways that employees and teams are using retrieval agents include:<\/p>\n\n\n\n