Agent Lifecycle: Access, Approval & Monitoring

Why agent governance matters

1. Controlling who can access agents

Access to agents involves two layers:

Layer 1: Copilot license (who can USE agents)

• Users need a Microsoft 365 Copilot license to interact with agents
• Assigned in the M365 admin center (same as regular Copilot access)
• Without a license, agents don’t appear in Copilot Chat

Layer 2: Copilot Studio license + environment role (who can CREATE agents)

• Creating agents requires a Copilot Studio user license
• Plus an environment role in the Power Platform admin center:

Role	What They Can Do
Basic User	Use existing agents, no creation privileges
Environment Maker	Create and manage their own agents
Admin	Full control — manage all agents, settings, and permissions

💡 Best practice: use security groups

Don’t assign permissions individually. Use security groups:

• “Copilot Users” group → assign Copilot license → everyone can use agents
• “Agent Creators” group → assign Copilot Studio license + Environment Maker role → only approved people can create agents
• “Agent Admins” group → full admin role → IT team manages governance

Exam tip: The exam tests whether you know that USING agents and CREATING agents require different permissions. A Copilot license lets you use agents; a Copilot Studio license + environment role lets you create them.

2. The agent approval process

When someone creates an agent and wants to share it across the organisation, it goes through an approval workflow:

How it works

1. Creator builds and tests the agent locally
2. Creator submits for approval — the agent appears in the admin’s Agent inventory in the M365 admin center
3. Admin reviews the request:
   • What does the agent do?
   • What data does it access?
   • Does it comply with org policies?
   • Who will use it?
4. Admin decides: Approve ✅, Reject ❌, or Send back for changes 🔄
5. If approved → agent is published to the organisation

Agent categories in the inventory

Category	What It Means
Custom	Built by users in your organisation
Shared	Shared with specific people or groups
First-party	Built by Microsoft
External	From third-party vendors
Publisher attested	Vendor has declared compliance with standards
Microsoft 365 certified	Passed Microsoft’s rigorous security review

💡 Scenario: Northwave's governance board reviews agents

Northwave receives 12 agent requests in one month:

• 5 simple Q&A bots (HR, Finance, Marketing, Sales, IT) → Maya reviews: low risk, scoped to specific SharePoint sites → Approve all 5
• 3 agents with external connectors (Salesforce, Jira, ServiceNow) → Jordan (CISO) reviews: need to verify connector permissions and data flows → 2 approved, 1 sent back (too broad permissions)
• 2 agents from external vendors → Priya (Compliance) reviews: check Publisher attested status, data residency → 1 approved, 1 rejected (no attestation)
• 2 advanced agents with automation → Full governance review: what actions do they take? What happens if they fail? → 1 approved with conditions (human approval step required for critical actions), 1 sent back for redesign

This is the governance model the exam expects you to understand.

3. Monitoring agents in production

Once agents are live, admins need to monitor them continuously:

Agent monitoring checklist

What to Monitor	Where to Check	What to Look For
Usage	M365 admin center → Copilot reports	How many people use each agent, frequency, popular queries
Performance	Power Platform admin center	Response times, error rates, failed actions
Errors	Agent dashboards + logs	Connectivity failures, permission errors, timeout issues
Adoption	Copilot Analytics	Which agents are used, which are abandoned
Compliance	Audit logs + Purview	Data access patterns, policy violations

Agent lifecycle stages

Agents go through a lifecycle:

1. Draft → being built and tested
2. Submitted → awaiting approval
3. Published → live and available to users
4. Active → being used regularly
5. Declining → usage dropping (investigate why)
6. Blocked/Removed → admin disables or deletes the agent

When to take action

Signal	Action
Agent has high error rate	Investigate connectivity or permission issues
Agent usage is declining	Check if it’s still relevant; update or retire
Agent accesses unexpected data	Review permissions; check for oversharing
New version of agent submitted	Review changes before approving the update
Agent abandoned (zero usage)	Consider removing to reduce governance overhead

ℹ️ Troubleshooting common agent issues

When an agent isn’t working correctly, check these in order:

1. Licensing — does the user have a Copilot license?
2. Permissions — does the agent have access to its knowledge sources?
3. Connectivity — are Copilot connectors to external systems working?
4. Instructions — are the agent’s instructions clear and unambiguous?
5. Knowledge sources — is the content up to date and accessible?

Exam tip: Agent troubleshooting questions almost always start with “check licensing and permissions first.”

🎬 Video walkthrough

🎬 Video coming soon

Agent Governance & Lifecycle — AB-900 Module 28

Agent Governance & Lifecycle — AB-900 Module 28

~11 min

Flashcards

Question

What two things does a user need to CREATE agents (not just use them)?

Click or press Enter to reveal answer

Answer

1) A Copilot Studio user license (from M365 admin center). 2) An environment role (Environment Maker or Admin) in the Power Platform admin center. A regular Copilot license only lets you USE agents.

Click to flip back

💡 Show hint

Question

What are the three possible decisions an admin can make when reviewing an agent approval request?

Click or press Enter to reveal answer

Answer

1) Approve — agent is published to the organisation. 2) Reject — agent is denied. 3) Send back — return to creator with feedback for changes.

Click to flip back

Question

What's the first thing to check when an agent stops working?

Click or press Enter to reveal answer

Answer

Licensing and permissions. Does the user have a Copilot license? Does the agent still have access to its knowledge sources? Then check connectivity to external systems, instructions clarity, and content freshness.

Click to flip back

💡 Show hint

Knowledge Check

Knowledge Check

Clearfield Council wants to allow their IT team to create agents, but restrict all other departments to only USING agents. How should Director Chen configure access?

AGive everyone a Copilot Studio license but only assign Environment Maker role to ITBGive everyone a Copilot license. Give only the IT team a Copilot Studio license AND the Environment Maker roleCGive everyone the Environment Maker role but disable Copilot Studio for non-IT usersDCreate a conditional access policy that blocks agent creation for non-IT users

Check Answer

Knowledge Check

Maya notices an agent at Northwave has a high error rate and declining usage. When she investigates, she finds the agent's SharePoint knowledge source was moved to a new site. What should she do?

ADelete the agent and ask the creator to build a new oneBBlock the agent immediately — high error rates indicate a security issueCUpdate the agent's knowledge source to point to the new SharePoint site location, then testDSwitch the agent from SharePoint to web-based knowledge sources

Check Answer

---

🎉 Congratulations! You’ve completed all 8 modules in Domain 3: Copilot & Agent Admin. You now understand how Copilot works, what agents are, how licensing works, and how to manage the full agent lifecycle.

Next: Continue to Domain 1 (M365 Core Features) or Domain 2 (Data Protection) to prepare for the full exam.