As AI agents move from pilot to production across organizations of every size, the question IT administrators are asking isn't just "How do we build agents?" It's "How do we govern them, at scale, without slowing the business down?"
That's exactly what the Administering and Governing Agents whitepaper is designed to help with. Downloaded more than 65,000 times by IT practitioners worldwide, it has now been updated to Version 3.2. Today you’ll find new and updated guidance that includes security and observability of your agents with Microsoft Agent 365, as well as discoverability of agents with the Microsoft 365 Agent Store. Additionally, there is new guidance on zone-based governance strategies, agent sharing controls, and agent owner reassignment.
As you continue to investigate, evaluate, or deploy agentic AI for your organization, keep this updated whitepaper on hand.
Why governance matters more than ever
Agents are being built by IT professionals, developers, and makers alike, using Microsoft Copilot Studio, Agent Builder in Microsoft 365 Copilot, and Microsoft Foundry. With that growth comes real accountability. Organizations carry responsibility for the agents they deploy—including how the agents access data, how they behave, and whether they comply with organizational and regulatory standards.
Governance can't be an afterthought. It needs to be built into the foundation from the beginning. As a long-time authority on security and governance, you can trust Microsoft to keep you updated with the information you need to run a secure agent ecosystem.
What the whitepaper covers
The Administering and Governing Agents whitepaper is designed specifically for IT practitioners and IT decision-makers in SMBs and large enterprises. It provides a structured, practical framework for securing and governing agents across the full Microsoft 365 ecosystem, from initial creation through deployment, monitoring, and ongoing management.
A governance framework built on three pillars
Effective governance starts with fundamentals. The whitepaper organizes core governance principles into three pillars: Policy, Process, and People.
Figure 1 Governance pyramid
No set of tools on their own can replace a clear governance strategy and disciplined processes, but the right tools make it far easier to operationalize those practices at scale.
Zones: a zonal tiered path to governance maturity
One of the most practical elements of the whitepaper is its zoned governance model, a structured framework that maps agent risk and technical complexity to three distinct governance levels, implemented as Environment Groups with the Copilot Studio admin controls. This model is designed to help IT teams adjust governance practices as agent risk evolves, enabling more intentional selection of controls over time while also still supporting early experimentation.
Zone 1: Personal productivity
The entry point. Agents assist with personal tasks, interact with Microsoft Graph data, and are confined to individual use. Security and sharing are tightly constrained by default, with connector access limited to approved Microsoft Enterprise plan and Copilot Studio core connections.
Zone 2: Team collaboration
Builds on Zone 1 with stricter connector controls, scoped Microsoft Entra security group access, and support for departmental agents. Editor access can be granted for collaborative development, but sharing remains governed and limited to internal channels.
Zone 3: Enterprise managed
The advanced tier for mission-critical or organization-wide agents. Managed by central IT or a Center of Excellence (CoE), with formal ALM pipelines, phased rollout controls, Sentinel integration, and the most rigorous security and compliance requirements.
Figure 2 Zonal Governance
Taken together, the zoned model gives organizations a practical way to govern agents as they grow. This methodology provides a clear path to go from individual experimentation to enterprise‑managed deployments without constantly redefining governance expectations. The whitepaper will show you how these zones map to real controls IT teams can apply over time.
Governance pillars in depth
The whitepaper walks through three governance pillars applied consistently across each zone: Security controls, Management controls, and Agent Reporting.
Security controls span the Copilot Studio data policies, Microsoft 365 admin center, SharePoint Online permissions, Microsoft Purview (DLP, Insider Risk Management, Communication Compliance, eDiscovery, Audit), and Microsoft Sentinel for enterprise-grade threat detection.
Management controls cover environment provisioning, Managed Environments, Application Lifecycle Management (ALM), pipelines, connector management, and agent publishing controls.
Agent reporting is delivered through four experiences: Inventory, Monitoring, Security, and the Copilot hub, alongside Microsoft Purview for cross-tenant data security and compliance reporting.
Each of these pillars is explored in detail throughout the whitepaper, covering how to configure controls, interpret reporting signals, and apply governance continuously as your agent deployments grow in scale and complexity.
The Agent Store as a governed distribution point
The whitepaper also highlights the Microsoft 365 Copilot Agent Store as a discovery and access point for agents. It covers distribution paths for Microsoft-built, partner-built, custom Copilot Studio, Teams Toolkit, and Agent 365 SDK-enabled agents, and how IT administrators maintain control over what is available and to whom. This is an area we've heard about consistently from admins, partners, and the field. Who gets access to which agents, and how IT stays in control of that, matters.
Figure 3 Agent Discoverability via Agent Store
Summary: What's new in Version 3.2
This update brings three focused changes.
- Agent Store as a governed entry point: New coverage of the Microsoft 365 Copilot Agent Store as a discovery and access point for agents, including distribution paths for all five agent categories and how IT administrators maintain control at every stage.
- A365 security and observability: Guidance has been introduced, covering onboarding and critical steps for maintaining visibility and security for agent activity across the tenant.
- Terminology and graphics updates to comply with name changes and enhancing visuals.
Get started
If you are just starting your agent governance journey or looking to put a more robust framework in place, the updated Administering and Governing Agents whitepaper (Version 3.2) is a practical, comprehensive resource for IT teams managing agents in Microsoft 365.
Download the whitepaper to start building governance that scales with your agents and your business.
Microsoft