Building a Robust Copilot Studio Strategy

Organizations deploying Copilot Studio face a critical inflection point: continue with fragmented, ungoverned agents or architect for enterprise scale. This session delivers the production-ready blueprint for the latter.

Explore proven architecture patterns for designing, deploying, and operating Copilot Studio across the enterprise, covering environment and DLP strategy, connector governance, ALM pipelines, compliance frameworks, and production monitoring.

Attendees leave with a comprehensive understanding of Copilot Studio governance across all five critical phases. Discovery, Architecture, Build, Deployment, and Monitoring, backed by a practical reference architecture and decision-making framework validated across Fortune 500 deployments.

Governing AI Agents with Microsoft Agent 365

This session shows how to get control of it using the Microsoft stack. We start with why the old model stops working. A human identity is created by HR and reviewed once a quarter. An agent identity is created from a blueprint in minutes, can clone itself, can call other agents, and makes access decisions in the middle of a conversation. Meanwhile, DLP still only looks at files and mail, not at prompts, inference, and tool calls. 6 We then name the four things that go wrong in practice: identity sprawl, data oversharing, tool misuse, and gaps in your compliance record, including agents left behind with no owner after their creator leaves the company.

The rest of the session covers Microsoft Agent 365 as a control plane rather than another admin console. It shows up inside the Microsoft 365 admin center, Entra, Purview, and Defender, and it works across Copilot Studio, Microsoft Foundry, AWS Bedrock, and Google Vertex AI. 758 We go through the three pillars in order.

See what you have. The central agent registry, sync across clouds, the agent map that shows how agents relate to each other, live adoption and health signals, and discovery of local agents running on real laptops.

Set the rules. The three building blocks in Entra Agent ID (blueprint, agent identity, agent user account), how an agent signs in with federated credentials over OAuth 2.0 and OIDC so no secret sits on the agent, Conditional Access for autonomous agents versus on-behalf-of agents, inherited permissions so new agents start narrow, and a five-stage lifecycle that includes what to do when a sponsor leaves.

Protect the data and catch the threats. Purview DSPM for AI, sensitivity labels that follow agent output, the unified audit log and eDiscovery for agent activity, insider risk policies for risky agents, then Defender for Cloud posture and AI bill of materials, Defender for Cloud Apps runtime protection for low-code agents, and the agent inventory and hunting table in Defender XDR for KQL investigation.

We finish with the parts most sessions leave out. Licensing explained SKU by SKU, including what the fleet math really means and where people get caught out. Power Platform environments as your actual security boundary. A maturity model so you can place yourself honestly.

1. Length. Built for 45 minutes plus 10 minutes of questions. Can run to 60 or 75 minutes with the Conditional Access and licensing sections expanded, or cut to 30 minutes for an executive audience.

2. Format. Slides plus live walkthroughs of the agent registry in the Microsoft 365 admin center, blueprint setup in Copilot Studio, and Defender XDR configuration. Recorded versions are ready if the venue network is unreliable.

3. Language. English or Norwegian. Full speaker notes exist in both.
Not a sales pitch. Technical content with sources listed. Coverage includes AWS Bedrock and Google Vertex AI, not only Microsoft platforms.

4. Kept current. Product status is checked before each delivery, and preview features are labelled as preview.

GitHub Copilot Harness in Copilot Studio: Build, Evaluate, Budget

Copilot Studio now runs three harnesses. The GitHub Copilot harness, generally available since 3 August 2026, replaces topic-based authoring with instructions and goal-driven orchestration, and replaces per-message licensing with Copilot Credits consumed from the moment you start building. Agents cannot be transferred between harnesses in either direction. This is a rebuild decision, not an upgrade.

This session covers the mechanics.

Component model. How behaviour is distributed across instructions, knowledge, tools, memory, skills, and connected agents, and what goes wrong when the split is off. Skills are Markdown files with YAML front matter, invoked by the orchestrator on description match, portable as a SKILL.md or as a ZIP with supporting scripts and templates. We write one, then pull a second from the CAT skills gallery and adapt it.

Memory. Per-user stores in Microsoft-managed storage, invisible to the maker, deleted after 28 days of user inactivity, disabled in Teams channels and group chats, and not deleted when the toggle goes off. What that means for any agent for which continuity is a requirement, and how users inspect and clear their own memories.

Rebuild path. Live demo using Microsoft's copilot-studio-plugin with Power Platform CLI 2.9.3 to pull a standard harness agent, analyse its structure, and generate a proposed architecture on the new harness. We then review that proposal critically. Mapping every topic to a skill and every variable to memory reproduces the old design in new syntax, which is the failure mode worth naming out loud.

Evaluation and deployment. The Evaluate tab with handwritten, generated, and CSV test sets. Reading reasoning traces and error codes in Preview to diagnose failures rather than guess at them. Publishing and reading per-agent credit consumption in Monitor.

Cost. What consumes credits: LLM tokens, tools, knowledge, MCP calls, and the harness itself. Why authoring, previewing, and evaluation bill before you publish. Why a Microsoft 365 Copilot licence does not cover this harness. Capacity pack economics with no monthly rollover, the shared tenant-level credit pool, and enforcement behaviour when a tenant runs dry mid-process. Worked figures from agents I run in production.

Attendees leave with a harness selection framework, a rebuild checklist, and a cost model they can take to their own finance function.

Target audience: Copilot Studio makers, Power Platform and solution architects, AI leads, and anyone responsible for agents already running in production. Level 300.

Prerequisites: Familiarity with the classic Copilot Studio experience is helpful but not required. No coding required, though we will read Markdown skill files and run a terminal-based upgrade workflow.

Preferred duration: 45 minutes.

Demos: All live in my own tenant, against agents I run. Includes Microsoft's experimental Copilot Studio plugin for AI coding assistants (requires Power Platform CLI 2.9.3 or later). The plugin is a research project rather than a supported product, and the session treats its output accordingly. Full recorded fallback available.

Technical requirements: None if the attendees will not be building and testing

First public delivery: [fill in, or note "not yet delivered"]

Note: This platform is changing month to month. Content is verified against current Microsoft documentation ahead of every delivery, and consumption figures come from agents I run rather than from published estimates.