How can we restrict the capabilities of an agent created within our Microsoft 365 tenant? For example, how can we prevent the agent from accessing Outlook and Teams or communicating with resources outside our tenant? Additionally, do we need any additional licenses beyond our existing Microsoft 365 Enterprise licenses to configure and enforce these restrictions?