Deploying Microsoft 365 Copilot and Copilot Studio without a structured framework is equivalent to exposing company data based on often poorly managed SharePoint permissions. This guide is for Microsoft 365 administrators, Power Platform engineers, and compliance officers who need to build a governance program proportionate to the actual risk of each agent — from personal prototypes to autonomous enterprise agents.
The three-zone governance model
Not all Copilot agents present the same level of risk. A maker building a personal productivity agent does not need the same safeguards as an IT team deploying an HR agent across the entire organization. Applying uniform controls is either too heavy-handed for simple cases or dangerously insufficient for complex ones.
Zone-based governance solves this by aligning the level of control to the level of risk. An agent progresses from one zone to another as it moves from personal to collective to organizational use, inheriting the corresponding controls at each step.
| Zone | Who | What is allowed | Risk level |
|---|---|---|---|
| Green | Individual makers, personal use | M365 connectors and approved connectors, agent not shared beyond the maker | Low – impact limited to the maker |
| Yellow | Team or department, with formal IT review | Shared data sources, advanced connectors, sharing to a defined group after IT approval | Medium – possible exposure of team data |
| Red | IT or professional developers, broad use or sensitive data | Highly confidential content, autonomous execution, external services, tenant-wide availability | High – organizational or regulatory impact |
Essential technical prerequisites before enabling Copilot
These controls must be in place before activating the first zone, regardless of which one. Without them, no zone offers real governance.
Data layer: audit, oversharing, retention, labels
Purview audit must be enabled before any Copilot activity. If it is disabled at launch, these interactions are never recorded and become unrecoverable. Admin path: Microsoft Purview portal > Solutions > Audit. License: included starting with Microsoft 365 E3.
Before enabling Copilot for a user group, run Data Access Governance (DAG) reports to identify overshared SharePoint sites. Copilot exposes content according to existing permissions: an overshared site becomes immediately accessible. Admin path: SharePoint admin center > Reports > Data access governance. License: included with the Microsoft 365 Copilot license (SharePoint Advanced Management).
Retention policies covering SharePoint, OneDrive, and Teams must be in place before activation, so Copilot-related content is covered from day one. Admin path: Microsoft Purview portal > Solutions > Data lifecycle management > Retention policies. License: basic retention included as of E3; adaptive scopes for Copilot interaction retention require Microsoft 365 E5 or the Microsoft Purview Suite add-on.
A sensitivity label taxonomy must be published before activation. It does not need to be applied immediately to all content, but users must be able to use it: Copilot checks encryption tied to the label during access, and an unlabeled sensitive file escapes this control. Admin path: Microsoft Purview portal > Solutions > Information Protection > Sensitivity labels. License: manual labeling included as of E3; service-side auto-labeling requires E5 or Purview Suite.
Licensed Copilot vs Copilot Chat
Copilot features in Word, Excel, PowerPoint, and OneNote are reserved for users with a Microsoft 365 Copilot license. Without this license, access is limited to Copilot Chat. Verify license assignments before enabling Copilot for a group.
Identity and devices: Conditional Access and Power Platform
A Conditional Access policy scoped to the pilot group, requiring MFA and a compliant device, must exist before any broad deployment. Start in Report-only mode and test for at least a week before enforcing the policy. Admin path: Microsoft Entra admin center > Entra ID > Conditional Access > Policies. License: Microsoft Entra ID Plan 1 (included in E3) covers basic Conditional Access; Entra ID Plan 2 (included in E5, or in the full Microsoft Entra Suite in E7) is required for risk-based Conditional Access.
Before a maker opens Copilot Studio, data policies must be configured on the environments where they will build. Without them, a maker can publish an agent connected to unapproved sources, unauthenticated channels, or sending data outside the organization. Admin path: Power Platform admin center > Security > Data and privacy > Data policies. License: included with any Power Platform or Copilot Studio environment.
Finally, environment routing must direct new makers to a personal developer environment rather than the shared default environment. Once a maker has built in the default environment, removing them becomes disruptive. Admin path: Power Platform admin center > Manage > Tenant settings > Environment routing. License: included with any Power Platform tenant.
Green Zone: individual experimentation under minimal control
The Green Zone covers makers building agents for their own productivity. The agent runs in the maker's context, uses only approved connectors, and is not shared with anyone else.
Allowed: M365 connectors and connectors in the Business group of the data policy, default or manual Microsoft authentication, deployment to the maker's personal Teams or SharePoint pages, knowledge sources that the maker personally has access to.
Blocked: no authentication (the data policy must block "Chat without Microsoft Entra ID authentication in Copilot Studio"), HTTP connectors and external API calls without IT review, sharing beyond the maker themselves, credentials supplied by the maker for tools accessing sensitive organizational data.
Monthly cadence: check the protection status column in Copilot Studio for any agent in "Needs review" state, review the Purview audit log for BotUpdateOperation-BotAuthUpdate events indicating an authentication change, and confirm that no Green agents have been shared beyond their maker.
Yellow Zone: team agents under IT validation
The Yellow Zone adds an IT approval requirement before any sharing beyond the maker. It inherits all Green controls and adds: data policy review to cover new connectors, sensitivity labels on accessed sites and files, execution of a Site Access Review to confirm oversharing has been remediated, application of Restricted Access Control on sensitive sites, and verification of agent protection status (must be "Protected") before sharing.
Each agent moving from Green to Yellow must have an approval file documenting: the agent's name and description, connectors and knowledge sources used, authentication method for each tool, intended sharing audience, accessed sites with their labeling and oversharing status, name of IT reviewer and date, and protection status at time of approval.
No approval, no sharing
An agent without a completed approval file must never be shared beyond its maker. This is Yellow Zone's most critical control: an unapproved agent shared with a department can access data on behalf of all those users, with no IT oversight whatsoever.
Restriction of maker-provided credentials reached general availability on August 25, 2026. It is disabled by default and must be enabled per environment or environment group: Admin path: Power Platform admin center > Manage > Environments > Settings > Product > Features > Copilot Studio agents > Control maker credential options.
One new control deserves particular attention: automatic detection of credential oversharing in Copilot Studio will reach general availability on September 30, 2026, per Microsoft announcements. This feature identifies agents or flows relying on maker or system credentials not intended for reuse, and automatically blocks at design, publish, and share stages, requiring no activation action. Verify its activation in your tenant and inform your makers that previously shareable agents may be blocked once this control is in effect.
Weekly cadence: check the Purview audit log for BotUpdateOperation events on Yellow agents and protection status. Monthly cadence: run a Site Access Review on the most overshared sites, verify that all shared agents have a complete approval file, and assign the Analytics Viewer role to compliance reviewers and business owners so they can oversee performance without maker access.
Red Zone: enterprise agents and sensitive data
The Red Zone covers agents available across the entire organization, accessing regulated or highly confidential data, running autonomously, or built by IT or professional developers. It inherits all Green and Yellow controls.
Additionally: mandatory approval via the Agents section of the Microsoft 365 admin center, restriction of agent self-installation for affected users, application of Restricted Content Discovery (RCD) on sites being remediated, Purview DLP policies covering Copilot interactions, Communication Compliance policies to monitor at-risk prompts or responses, registration in the Agent 365 registry, eDiscovery hold rules for regulated workflows, evaluation of customer-managed keys (CMK) for environments processing regulated data, and review of autonomous triggers against the authorized connectors list.
Slow propagation on large sites
On sites with more than 500,000 items, Restricted Content Discovery propagation may take over a week. Plan containment timeline accordingly: content deemed sensitive will not be instantly hidden from Copilot.
Communication Compliance is licensed via Microsoft 365 E5 or the Microsoft Purview Suite add-on — the current name of the former standalone E5 Compliance add-on. The Agent 365 registry is available as a standalone add-on or included in Microsoft 365 E7, a single SKU combining E5, Microsoft Copilot license, the full Microsoft Entra Suite, and Microsoft Agent 365.
Irreversible deletion of Teams meeting content
Teams meeting organizers can permanently delete generated content (recordings, transcripts, AI summaries, meeting notes) directly from the Recap page, without IT intervention. Deleted content cannot be restored. Verify that your Teams meeting retention policies are properly applied to avoid loss of governed content.
Piloting the program: cadence, metrics, and licensing
Beyond initial setup, a governance program is sustained over time through regular cadence and metrics tracked over time.
| Metric | Source | Green target | Yellow/Red target |
|---|---|---|---|
| Overshared sites remediated (%) | DAG reports | Awareness | 100% before agent deployment |
| Sites under Restricted Access Control | SharePoint admin center | 0 required | All sensitive sites |
| Agents in 'Needs review' status | Copilot Studio protection status | 0 | 0 |
| Agents without approval file | Internal inventory | Not applicable | 0 |
| Sensitive data occurrences in Copilot interactions | DSPM for AI | Track trend | Act on any increase |
| Agents without owner | Agent 365 registry | Not applicable | 0 |
To arbitrate between zones, one rule overrides all others: the highest zone always wins. An agent shared with multiple people, accessing labeled content, running autonomously, or processing regulated data must be governed at the most constraining level, regardless of the answer to the preceding criteria.
| Control | Green | Yellow | Red | License required |
|---|---|---|---|---|
| SharePoint sensitivity labels | Recommended | Required | Required | Manual: E3. Auto: E5/Purview Suite |
| DAG reports (oversharing) | Recommended | Required | Required | Included with Copilot license |
| Site Access Review (SAR) | Optional | Required | Required | Included with Copilot license |
| Restricted Access Control (RAC) | Optional | Required | Required | Included with Copilot license |
| Conditional Access (MFA + compliant device) | Recommended | Required | Required | Entra ID P1 (E3); P2 (E5/E7) for risk |
| Maker credential restriction | Optional | Recommended | Required | Included with any Power Platform tenant (GA August 25, 2026) |
| Approval via Agents section | Not applicable | Required | Required | Included with Copilot license |
| Agent 365 registry | Optional | Recommended | Required | Standalone add-on, or included in E7 |
| Communication Compliance | Not applicable | Optional | Required | Microsoft 365 E5 or Purview Suite add-on |
Verify license by feature, not by tier
Purview and Power Platform licenses evolve more frequently than the rest of this framework. Before committing a control to a customer design, confirm the current license requirement for that specific feature rather than relying on tier name alone.
Implementation: Copilot governance prerequisites audit script
The following script produces a read-only readiness report, making no configuration changes. It verifies the status of cross-functional prerequisites described above: Purview audit, retention, labels, DLP, and Conditional Access.
Required modules:
ExchangeOnlineManagement(v3.2.0 or later) —Install-Module -Name ExchangeOnlineManagement -Scope CurrentUserMicrosoft.Graph.Identity.SignIns—Install-Module -Name Microsoft.Graph.Identity.SignIns -Scope CurrentUser
Minimum permission: Microsoft Entra role "Compliance Administrator" or "Global Reader" for the Security & Compliance PowerShell session, and Graph scope Policy.Read.All read-only for Microsoft Graph.
1# --- Connect to Security & Compliance PowerShell (Purview) ---2Connect-IPPSSession -UserPrincipalName "admin@yourtenant.onmicrosoft.com"3 4# 1. Verify that unified audit is enabled (prerequisite #1)5$auditConfig = Get-AdminAuditLogConfig6[PSCustomObject]@{7 Control = "Purview Audit active"8 Status = if ($auditConfig.UnifiedAuditLogIngestionEnabled) { "Compliant" } else { "NON COMPLIANT" }9} | Format-Table -AutoSize10 11# 2. List retention policies covering SharePoint, OneDrive, and Teams (prerequisite #3)12Get-RetentionCompliancePolicy | 13 Select-Object Name, Enabled, SharePointLocation, OneDriveLocation, TeamsChannelLocation |14 Format-Table -AutoSize15 16# 3. List published sensitivity labels (prerequisite #4)17Get-Label | Select-Object Name, Priority, Disabled | Format-Table -AutoSize18 19# 4. List DLP policies covering Copilot interactions (Red Zone control)20Get-DlpCompliancePolicy | Select-Object Name, Mode, Enabled | Format-Table -AutoSize21 22# --- Close Purview session ---23Disconnect-ExchangeOnline -Confirm:$false24 25# --- Connect to Microsoft Graph to verify Conditional Access (prerequisite #5) ---26Connect-MgGraph -Scopes "Policy.Read.All"27 28# Retrieve Conditional Access policies and identify those requiring MFA29Get-MgIdentityConditionalAccessPolicy | 30 Select-Object DisplayName, State, @{Name="MFARequired";Expression={$_.GrantControls.BuiltInControls -contains "mfa"}} |31 Format-Table -AutoSizeThis script produces four tables in the console: unified audit status, inventory of retention policies, list of published labels, active DLP policies, and finally Conditional Access policies with their MFA requirement. Redirect output to Export-Csv if you wish to keep a dated record of the report for a customer engagement file.
Troubleshooting: common deployment errors
Connect-IPPSSessionfails with authorization error: the account used must have the Microsoft Entra role "Compliance Administrator" or "Global Reader". Also verify that modern authentication is enabled on the tenant.- DAG report shows zero overshared sites: Data Access Governance reports require an indexing delay after first run. Do not conclude there is no oversharing before rerunning the report a few days later.
- Maker credential restriction appears inactive: this control, in general availability since August 25, 2026, is disabled by default and must be explicitly activated per environment or environment group — there is no tenant-wide setting that enables it automatically.
- An unauthenticated agent passes despite the data policy: verify that the exact setting "Chat without Microsoft Entra ID authentication in Copilot Studio" is set to Blocked, not just Warning, in the data policy applied to the maker's environment.
- Restricted Content Discovery does not mask content immediately: on large sites (500,000+ items), propagation may take over a week. This is not an incident, it is an expected delay to factor into your remediation plan.
Key takeaways
Copilot governance does not happen at license activation, but beforehand: audit, oversharing, retention, and labeling must be in place before the first prompt. Practically speaking, Monday morning:
- Run the audit script above to establish a baseline of cross-functional prerequisites.
- Classify your existing agents into Green, Yellow, or Red zones using the rule "highest zone wins".
- Enable maker credential restriction by environment if not already done, and verify the general availability date for automatic credential oversharing detection announced for September 30, 2026.
- Document the first approval file for any Yellow agent already shared without IT validation — this is the control that closes the most critical gap.
If your organization plans to move to autonomous agents or those handling regulated data, plan the Red Zone evaluation now: Agent 365 registry, DLP policies, and Communication Compliance have compliance timelines measured in weeks, not days.
