Thanks for your question! Agent creation and agent usage are currently coupled under a single tenant‑level control. In the Microsoft 365 admin center, under Agents > Settings > User Access, AI admins or Global admins can scope who can use agents, but there is no supported way to allow users to run agents while separately blocking them from creating agents under the same control.

What you can do to mitigate sprawl today:

Scope agent enablement to specific users or groups

Restrict org‑wide sharing

Govern agent lifecycle centrally via the Agent 365 registry