Keep Copilot healthy: review, remove and retire access
Enabling a feature is only the start. Every licence, agent, connector, Cowork pilot and automation should have an owner, purpose, review date and clear end-of-life action.
Last reviewed 2026-10-26
Lifecycle health check
| Stage | Questions to ask |
|---|---|
| Before enabling | What problem are we solving? Who owns it? Who needs access? What data is involved? Which identity will the Agent or automation use? What is the cost/risk? Which actions need human approval? What will we test before release? When will we review it? |
| While in use | Is it being used? Is it producing value? Are build/test/evaluation and production costs within expectations? Are permissions and source documents still appropriate? Are approval gates and execution identities still in the right places? Are shared Skills still current? |
| Review | Is the owner/sponsor still in post? Is the project active? Are all users and Agent identities still appropriate? Are sources and reusable Skills current? Have evaluations been rerun after material changes? Has the Agent produced self-learning recommendations, and if so were they reviewed, evidenced and tested before any change was published? |
| Retire | Remove users or groups, revoke unnecessary connectors, archive Agents or flows, retire any dedicated/persistent Agent account or identity that is no longer required, reclaim licences/capacity where appropriate and record the decision. |
What should be reviewed regularly?
At minimum: Microsoft 365 Copilot licences and model/usage limits; Cowork access and spending; shared agents; work-grounded agents; connectors; Power Automate flows; Copilot Studio agents; privileged data sources; sensitivity labels and any Purview rules that exclude labelled content from AI processing; endpoint/browser controls used to prevent protected files being uploaded to AI services; SharePoint Site AI settings and Restricted Content Discovery; and any pilot or temporary security groups.
Suggested minimum register
For shared or higher-risk capabilities, record: name, purpose, business owner/sponsor, technical owner, users/group, data sources, permissions, connectors, Entra Agent ID or other execution identity, any persistent Microsoft 365 Agent account, reusable Skills/dependencies, allowed actions, human-approval gates, licence or credit dependency, expected and actual consumption, risk level, test/evaluation evidence, accepted/rejected self-learning recommendations, date enabled, last reviewed, next review and retirement status. A Microsoft List is enough to start if no dedicated tooling exists.
Related guidance
Sources
- Microsoft 365 Copilot documentation — checked 2026-09-21
- Review the Copilot Studio implementation checklist — checked 2026-09-21
- Govern Copilot Credit consumption — checked 2026-09-21
- View agent billing consumption — checked 2026-09-21
- Agent identities and authentication for Copilot Studio — checked 2026-10-06
- AI at Work roadmap — identity, self-learning and Skills — checked 2026-10-06
- Automate web and desktop apps with computer use — checked 2026-10-06
- Purview DLP for Microsoft 365 Copilot and Cowork — checked 2026-10-26
- Learn about Endpoint data loss prevention — checked 2026-10-26
- Get started with Copilot in SharePoint — checked 2026-10-26