On demand 62 min Recorded Feb 2026 15 chapters
Where Microsoft 365 Governance Meets Security: Controlling Copilot, Agents, and Data Risk
Security architect and Microsoft MVP Jussi Roine and Rencore CEO Matthias Einig talk through what Copilot and agents change for Microsoft 365 security: old data and old permissions resurfacing, agents nobody knew existed, shadow AI, and where Agent 365 fits. A conversation, not a product demo. Jump straight to the chapter you need.
Key takeaways
-
Copilot finds what your permissions already allow
Copilot does not create oversharing, it makes it searchable, just as enterprise search did. Fixing permissions and cleaning out old data is ongoing work, because people and content change every day.
Watch from 2:51 -
Old data degrades AI answers
Copilot grounds on everything a user can reach, with no date filter. Archiving, removing or deleting redundant, obsolete and trivial data improves answers as much as it reduces risk.
Watch from 7:50 -
Agents multiply faster than anyone tracks them
SharePoint and Copilot Studio agents take minutes to create, and some organizations find thousands on their first scan. Each needs an owner who answers for its data, its audience and its lifecycle.
Watch from 14:05 -
Blocking AI creates shadow AI
Lock everything down and people use their own subscriptions out of sight. Observe first, give people a governed option with clear guidance on data, and verify afterwards.
Watch from 25:49 -
Agent 365 is a start, not the whole picture
Agent 365 gives Microsoft a first inventory of agents, but control still spans Entra Agent ID, Defender, Purview and SharePoint permissions. Seeing how they connect is what lets you decide.
Watch from 40:10
A security architect and a governance founder, on the same problem
Jussi has worked on Microsoft platforms since 1994 and now untangles Microsoft security across Azure, Microsoft 365 and Power Platform as a consultant, architect and developer. He is a Microsoft Certified Trainer.
Matthias started Rencore after watching organizations adopt Microsoft 365, Power Platform and now Copilot and AI without a plan to govern them. He writes and speaks on where governance breaks in the age of AI.
Governance is not an IT game. Staying within the guardrails is a game everyone has to play, so you have to make it as easy as possible for people to be in the green area.
More from the Rencore webinar library
Recording Inside Rencore: Built in 2026. Bigger in 2027.Product update .png)
Recording Your company uses multiple AIs already. Why do you only govern one?AI governance beyond Copilot 
Frequently asked questions
What does this webinar cover?
How Copilot and agents change Microsoft 365 security: old data and permissions resurfacing in AI answers, agents created without anyone noticing, shadow AI, ownership and accountability, and where Microsoft Agent 365 fits.
Is this a product demo?
No. It is a conversation between a security architect and the founder of Rencore about what they see with customers. If you want to see Rencore on your own tenant, book a demo.
Does Copilot change who can access our data?
No. Copilot works with the permissions people already have. It makes overshared content far easier to find, which is why fixing permissions and cleaning out old data comes before, or alongside, a Copilot rollout.
Does Agent 365 already govern our agents?
It gives you a first inventory of agents. Access, data and ownership still sit across Entra Agent ID, Defender, Purview and SharePoint permissions. Rencore works alongside them and connects each agent to its owner, data sources and audience.
Is there a cost to watch?
No, the recording is free to watch, with no form to fill in.