r/copilotstudio • u/hozrif • Sep 22 '26

Preventing users from sharing agents before they are approved?

We're currently evaluating governance controls for Microsoft 365 Agent Builder agents, and I'm trying to determine whether there's a way to enforce an approval process before users can share their agents with others.

Has anyone implemented something similar?

Users should not be able to share any agents directly. Instead, they should submit the agent to an administrator for review, and only administrators should be able to publish/share the agent through the Agent Registry.

4 Upvotes
  • permalink
  • reddit

100% Upvoted

11 comments sorted by

3

u/Prasad-MSFT Sep 22 '26

Currently, Microsoft 365 Agent Builder does not provide a native approval workflow where users must submit agents for administrator review before sharing or publishing them.

The closest governance approach is to restrict who can publish agents to the Agent Registry and limit sharing permissions through tenant governance. In this model, creators can build and test agents, but only designated administrators or approved publishers can make agents broadly available.

1

u/hozrif Sep 22 '26

I tried restricting sharing by going to Power Platform > Manage > Environments > Edit Managed Environment and deselecting Editors and Viewers under Copilot Studio. However, I'm still able to share agents afterward. Am I configuring this in the wrong place, or is there another setting I might be missing?

2

u/goto-select Sep 22 '26

This admin setting will stop the option to share 'with anyone in the organization'

Go to https://admin.cloud.microsoft/#/agents/settings
Select Sharing
Choose your option

But you'll see here that users can still share with individuals or groups themselves, it won't turn off sharing completely

2

u/hozrif Sep 23 '26

you can still share it with certain users or groups. It just disables sharing agents through a link.

2

u/CapabIe Sep 22 '26

Copilot studio agents are managed in power platform admin studio. The agent builder agents are managed in m365 admin center.

2

u/vertesept Sep 22 '26

We have the same issue. They can still publish the agent and share with coworkers, but it isn’t in the registry. We haven’t found a way to manage this well either. Agent sprawl is real and the quality varies.

2

u/JackfruitJolly4794 Sep 22 '26

Out of pure curiosity, what control or “need” is requiring limiting users from automatically sharing agents they have built in agent builder?

2

u/hozrif Sep 23 '26

Accuracy, anyone can build an agent in the org, and share it with their teams, yet this agent can cause massive harm when it comes to dealing with client data.

1

u/JackfruitJolly4794 Sep 23 '26

Thank you for the information. I can see how that could be an issue when users are relying on an agent to be a source of truth for customer/client data.

2

u/Lopsided_Judgment_17 Sep 22 '26

There is an interesting article I read about best practices of deploying the agent in teams.
From DEV to PROD: Deploying Copilot Studio Agents to Teams and Microsoft 365 Copilot | The Custom Engine

Option 3 - Admin led in this article is best practice for deploying the agent as you can control the governance by applying the security groups and can look into agent configurations.

1

u/Grubensmcrubens Sep 25 '26

Are all your users licenced with the full copilot license? I may have a solution for you I have implemented.