Microsoft's move to give Copilot a persistent agent identity and memory inside M365 quietly changes what "data governance" has to cover. A memory that persists across sessions and users isn't the same governance object as a stateless assistant answering one prompt at a time — it raises retention and deletion questions, cross-tenant and cross-jurisdiction data-residency questions, and accountability questions (who's responsible for a decision the agent made based on something it remembered from a different context weeks earlier). Most governance frameworks built for GenAI in the Microsoft Cloud were written for the stateless version. This session works through what changes once the agent remembers, using real disclosed incidents of agentic systems taking unauthorized or unanticipated action as the cautionary evidence, and lays out the specific gaps a data-governance or compliance team needs to close before rolling out persistent-memory agents at enterprise scale — particularly for organizations operating across multiple regulatory jurisdictions.