What it does

Governance is how admins keep agents safe and in bounds: control who can build, restrict what agents can connect to, monitor what's out there, and shut down anything that shouldn't be running.

Key facts

• Data loss prevention (DLP) policies classify connectors and block combinations, controlling what an agent's tools can touch.
• The Power Platform admin centre and Copilot control features give tenant-wide visibility and control over agents.
• Quarantine lets admins block a published or misbehaving agent from being used.
• Environments are the primary boundary — maker rights, DLP and access are all set per environment.

When to use / skip

Governance isn't optional for anything past a single-maker experiment. The only thing to skip is heavy-handed lockdown of a sandboxed dev environment where makers should be free to try things.

Configuration decisions

• Environment strategy and who can create agents where.
• DLP policies: which connectors are business, non-business or blocked.
• Monitoring, review cadence and the process for quarantining rogue agents.

Gotchas

• DLP set too loose lets agents reach data they shouldn't; too tight and makers route around it or stall. Tune it.
• Agents built in the default environment escape most governance — lock that environment down early.

Consultant notes

• Fold Copilot Studio into the existing Power Platform CoE rather than governing it separately.
• Least-privilege on connections and run-as identities is the highest-value control you can set.
• Establish an agent inventory and review rhythm before sprawl, not after — retrofitting governance is the hard path.

---

Revisit as admin and governance controls expand each wave.