Governance & AI Council
Control over Copilot and agents
More agents, more decisions: who approves, who monitors and who pays? We advise on and set up governance that gives you control.
AI Council
One body for every AI decision
An AI Council is no talking shop. It approves use cases, weighs risks and answers for them — built in four layers, sized to you.
1 · Core team
Compact multidisciplinary team that reviews use cases and writes guidelines — at business pace.
2 · Expert network
Specialists on call: from security architect to employment lawyer. Not at the table, but reachable.
3 · Steering group
Executive sponsors set budget and direction. Without a sponsor, every council slides into the optional.
4 · Sounding board
Employees from every layer. Listen only to the top and you miss the signals.
Four design principles guard the quality — diversity, independence, transparency and accountability — at the pace of the business.
What the council does
The governance cycle
From setting direction to course-correcting — the council moves with your AI journey.
- 1
Direction
Set the AI vision and ground rules: what do we approve?
- 2
Assessment
Test use cases against data, risk, the GDPR and the EU AI Act.
- 3
Monitoring
Track usage, quality, incidents and sentiment.
- 4
Course-correction
Report to the board, adjust policy, advise on investment.
Agent governance
Manage agents like colleagues
Give every agent identity, an owner, access rights and oversight — with Agent 365, Entra Agent ID and the admin tools you already have.
Agent register
One register of every agent through Microsoft Agent 365 — including agents from AWS, Google Cloud and Salesforce via registry sync (partly in preview).
Ownership & lifecycle
Every agent an owner and a sponsor. If they leave, ownership passes on instead of the agent becoming orphaned.
Security templates
Governance templates with Entra, Purview and Defender policies that apply automatically on activation. Design once, enforce everywhere.
Identity & tool access
Every agent its own Entra Agent ID, with access policies per agent and approval before sensitive actions.
Shadow AI detection
Visibility into unmanaged agents and AI tools in your tenant — with a block option through Defender and Purview.
Review & publishing flow
New agents to a pilot group first, then into the Agent Store after admin approval. Innovation with a gatekeeper.
Our conviction
Governance that accelerates, not slows.
AI Council
Ground rules only work when there are people behind them who keep watch.
Agent 365 & Entra Agent ID
The management layer for agents
Since May 2026, Microsoft Agent 365 has been the central control point for agents. Since 1 July 2026, Defender protection for Copilot Studio and Foundry agents also requires an Agent 365 licence — on its own or in Microsoft 365 E7. We help you choose what you need, and see what you already have.
Register with history
Every agent appears once in the register, with version history, multiple owners and 30 days to restore a deleted agent.
An identity for every agent
Every new Copilot Studio agent automatically gets an Entra Agent ID. You apply Conditional Access to it, and the logs show who did what: a person or an agent.
Tools register
Approve or block plugins, skills, connectors and MCP servers (connections built on the open Model Context Protocol standard) centrally, for every part of Copilot at once.
Guardrails while building
Block shared maker credentials, let Copilot Studio stop unsafe sharing and check the Agent Readiness indicator before publishing.
IT controls
The five dials IT holds
From knowledge agent to a full Copilot Studio solution: the same five control axes, set deliberately before the first agent goes live. Rules only work when people carry them — that is what our adoption approach secures. How to cap usage is covered in Copilot Credits & cost management; what the AI Act asks of you in Copilot and the EU AI Act.
- 01
Creation
Who may build agents — and who may upload agents with actions or MCP connections? Restrict that to security groups where needed.
- 02
Use
Per agent type, decide who may use it — access by group.
- 03
Sharing
Sharing limits via Managed Environments: a team agent should not sit organisation-wide.
- 04
Cost
Spending policies (rules for what may be spent) and limits in Copilot Credits per department, prepaid capacity and usage reports. No surprises.
- 05
Measurement
Usage reports per agent and user — the basis for scaling up or clearing out.
FAQ
Frequently asked questions
On AI governance, the AI Council and agent management.
Does a mid-sized organisation need an AI Council?
Yes, but right-sized. A compact multidisciplinary team of four to six people meeting fortnightly usually suffices. The pitfall is not starting too small — it is a council so heavily built that it slows innovation.
Who belongs on the AI steering group?
Four roles: an executive sponsor with mandate and budget, IT/security for the technical frame, legal/compliance for the legal side and a representative of the business. Diversity of perspective is a design requirement, not a luxury.
How does Copilot governance relate to the EU AI Act?
As a model provider, Microsoft is responsible for its part, but as a user the next move is yours. AI literacy (Article 4) has applied since February 2025, and the transparency obligation for chatbots and agents (Article 50) since 2 August 2026. The high-risk rules, for example for agents used in recruitment and selection, move to December 2027. An AI Council with a live register makes your compliance demonstrable.
What is shadow AI and how do you get a grip on it?
Shadow AI is AI use beyond IT’s sight. In 44% of Dutch organisations, employees choose their own AI tools (Info Support/Markteffect, 2026). The approach: detect and offer an approved alternative — banning without an alternative just relocates the problem.
How do agent costs stay manageable?
Through cost management from day one. Cowork, Autopilot and agents on the GitHub Copilot harness in Copilot Studio (the runtime for multi-step agents) consume Copilot Credits. Set spending policies per department, put limits and alerts on each agent and choose prepaid capacity where volumes are predictable. Note: new services automatically join existing spending policies by default.
Can we manage agents from other platforms centrally?
Yes. Through registry synchronisation in Agent 365, agents from AWS, Google Cloud, Salesforce Agentforce and Databricks, among others, appear in the same register as your Microsoft agents; part of this is still in preview. One governance regime for your entire agent landscape.
What is Microsoft Agent 365?
Agent 365 is Microsoft’s management layer for AI agents: one register, security through Defender, Entra and Purview, and insight into usage and cost — including for agents from other platforms. It is licensed per user, on its own or as part of Microsoft 365 E7. Whether you need it depends on how many agents you run and where they run.
What is an Entra Agent ID?
An identity of its own for an agent in Microsoft Entra, comparable to an employee’s account. Since July 2026, Copilot Studio creates one automatically for every new agent. That lets you set access rights and Conditional Access per agent, and the audit logs show whether a person or an agent did something.
Want to know where the gaps are first?
Our quickscan tests your situation against the five control axes and AI Council maturity — with a concrete advisory report.