Regulating your AI companion: Best practices for governing Copilot, agents, and the LLMs behind them
Copilot is one assistant answering one question. The agents built on top of it are standing capabilities, created by people who do not work in IT, holding whatever access their maker had. An average Fortune 500 enterprise is on track for more than 150,000 agents by 2028, up from fewer than 15 in 2025.
This whitepaper sets out what an ungoverned AI estate costs, why agents change the shape of the problem, and how to build governance that holds as the estate grows.
This is what you can expect from our whitepaper:
- Understand what an ungoverned AI estate costs, including the agent consumption that never shows up in the admin center.
- Learn how agents inherit access from whoever built them, why ownership outlives intent, and the three questions to ask about every agent you have.
- Find out where Microsoft's own controls stop, from Restricted SharePoint Search to Purview to Agent 365, and what sits in the gaps between them.
- Get a practical path to continuous governance across Microsoft 365, Power Platform, and the AI stack, mapped to the EU AI Act, GDPR, NIS2, and DORA.
A full section on governing the agents built on top of Copilot. Current breach, license, and agent consumption costs. Where Microsoft's own agent governance reaches, and where it stops. The EU AI Act obligations now in force, with the dates still ahead.
Organizations have been here before. Cloud collaboration tools were bought, deployed, and used at scale before anyone wrote the rules for them, and most tenants are still paying that down today. AI is repeating the pattern faster. The difference this time is that the agents are being built by people outside IT, on data nobody reviewed, and there is a regulator attached to the outcome. Governance cannot be the clean-up exercise again.
Matthias Einig Microsoft MVP and CEO at Rencore Frequently asked questions
What is AI agent governance?
AI agent governance is the set of controls that decide who can build an agent, what data and permissions it can reach, who owns it, and when it is reviewed or retired. It differs from governing Copilot itself because an agent is a standing capability: it keeps running with the access of the person who built it, often someone outside IT, long after the original need has passed.
Why do Copilot agents need governance beyond Copilot itself?
Copilot answers one question at a time for one user. An agent built on top of it is shared, runs again and again, and inherits the permissions of its maker. That means it can surface data its users were never meant to see, keep consuming capacity after its owner has left, and sit outside every review cycle. The whitepaper sets out the three questions to ask about every agent you have.
Don't Microsoft Purview and Agent 365 already cover this?
They cover important parts of it. Purview classifies and labels data and prevents it from leaking, Restricted SharePoint Search limits what Copilot can surface, and Agent 365 gives IT a registry and controls for agents. What sits between them is the operating model: one inventory across Microsoft 365, Power Platform and the wider AI stack, an accountable owner for every agent, and a lifecycle that retires what is no longer needed. Rencore extends these Microsoft controls rather than replacing them.
Which regulations does the whitepaper cover?
It maps AI governance practice to the EU AI Act, GDPR, NIS2 and DORA. For the EU AI Act it separates the obligations already in force from the dates still ahead, so IT, security and compliance teams can plan against the actual timeline rather than the headlines.
How does Rencore help govern Copilot and AI agents?
Rencore Governance gives IT one control plane across Microsoft 365, Power Platform and AI. Its AI & Agents module inventories every Copilot and custom agent, shows who owns each one, and ranks them by risk. Policies flag stale or orphaned agents, for example one that has not been used in 90 days or whose owner has left the company, so they can be reassigned or retired before they pile up.