4.3.3. Agent Approval and Lifecycle Management
š” First Principle: The agent approval process is the governance gate that separates personal/draft agents from org-wide agents. It exists because an agent that accesses org data on behalf of all users is an organizational risk ā it needs IT and security review before broad deployment.
What admins review during agent approval:
- What knowledge sources is the agent connected to? Are they appropriate for org-wide access?
- Does the agent access any sensitive or confidential data that shouldn't be broadly available?
- Does the agent's behavior match its stated purpose, or could it be used for unintended purposes?
- Does the agent have any external API connections that need security review?
Agent monitoring after publishing: In the Microsoft 365 admin center ā Copilot ā Agents and the Power Platform admin center:
- Usage metrics: how many users, how many conversations, which questions are asked most
- Operational insights: error rates, response quality signals, knowledge source freshness
- Agent lifecycle: creation date, last modified, creator, approval status
Admins can decommission (disable or delete) any agent that violates policy, produces harmful content, or is no longer needed. When a creator leaves the organization, their personal agents should be reviewed ā orphaned agents with no owner represent a governance gap.
ā ļø Exam Trap: The Power Platform admin center and the Microsoft 365 admin center both have agent-related settings, but they serve different purposes. The M365 admin center controls Copilot-side settings (which agents are available in Copilot Chat). The Power Platform admin center controls the agent's runtime, usage analytics, and connector configuration.
Reflection Question: Six months after approving and publishing an agent, your security team discovers the agent was connected to a SharePoint site that now contains newly classified "Confidential" documents. What immediate action should the admin take, and what ongoing governance process would prevent this scenario in the future?
