Review agent access, knowledge sources and permissions
An administrator reviews a shared agent's knowledge sources, connectors, users, owner and effective access before wider publication, and repeats the review when the agent's purpose, owner or source data changes.
Where the action happens
Agent 365 / Microsoft 365 admin centre / Entra / Purview
Product or feature needed
Agent access governance and least-privilege review
AI required
No - governance task
Extra credits
No - the review itself does not consume Copilot Credits
Technical skill
High
Risk level
High - agents can surface information users are already permitted to access and can also be given additional governed identities, tools or connectors
Licence dependency
The governance principle applies regardless of licence. Agent 365, Entra, Purview and other controls available to the tenant determine how much of the review can be centralised or automated.
Credit dependency
No Copilot Credits for the governance review itself; the governed agent or actions may have their own consumption model.
UK availability
available
What it can do
- Checks whether the agent's knowledge sources and connectors are necessary for its stated purpose.
- Supports least-privilege decisions for agent identities and governed access to Microsoft 365 resources.
- Helps identify overshared SharePoint or OneDrive content that an agent could make easier to discover and summarise.
- Creates a repeatable review point when an agent changes owner, purpose, audience, data source, connector or level of autonomy.
Limitations
- Agents do not automatically fix poor underlying permissions or overshared content; existing SharePoint, OneDrive and data-governance issues still need remediation.
- A permissions review should distinguish delegated access, where an agent acts within a user's existing access, from agents or tools granted their own governed access.
- Uploaded or embedded knowledge can have different sharing implications from content that remains permission-trimmed in Microsoft 365; confirm behaviour for the specific agent configuration.
Prerequisites
- An up-to-date agent inventory with a named owner or sponsor.
- Access to relevant Microsoft 365, Entra, Purview or workload-specific administration controls.
- A documented purpose and intended audience for the agent so reviewers can judge whether access is proportionate.
Workarounds
Where central Agent 365 controls are unavailable, perform a manual review of the agent's owner, users, SharePoint/OneDrive sources, uploaded files, connectors and external actions, and record the outcome in the governance register.
No premium licensing needed. External dependency: Governance process.
Notes
Use a least-privilege test: does the agent need this source, connector, audience and permission to perform its approved purpose? Treat agent governance as an extension of existing identity and data governance, not as a replacement for fixing overshared content.
Watch-outs for Advanced: govern & scale
- Keep detailed governance here rather than repeating it on every beginner capability.
- Track ownership, access, cost, lifecycle and exceptions once services are shared or business-critical.
- AI Redlines remain separate from normal governance and should be treated as hard boundaries.
Sources
- https://learn.microsoft.com/en-us/microsoft-agent-365/overview
- Microsoft Agent 365 overview checked 2026-09-15
- Protect agent identities with Microsoft Entra checked 2026-09-15
- Connect existing agents to Microsoft Agent 365 checked 2026-09-15
Last checked: 2026-09-15
Community feedback
Has your organisation tried this? Confirm whether it's possible, whether it's useful, and share any tips.
0
Confirmed possible
0
Reported not possible
0
Found it useful
0
Not useful
Loading feedback…