Microsoft gives tenant admins control over who can receive Copilot agents
On 22 May 2026 Microsoft updated its documentation for agents created with Microsoft 365 Copilot Agent Builder. Tenant admins can now set a default sharing policy in the Microsoft 365 admin center that applies to every new agent. The three options are: allow sharing with anyone in the organisation, restrict sharing to named users or groups, or block all sharing. Agents can still be shared manually through a ZIP package that users sideload into Teams. SharePoint file access tied to an agent is granted automatically when the agent is shared with specific people. No automatic deployment across the tenant occurs.
Before this update an employee could build an agent and share it with anyone without the admin ever seeing the decision. The only record was the SharePoint permissions that appeared after the fact. Now the tenant policy forces a deliberate choice at the organisation level. That choice surfaces the existence of agents before they spread, but it also adds another permission surface the same small team must track alongside Teams and SharePoint sites.
Analysis
Set the tenant policy to specific users or groups today and make registration in a central list a precondition for any sharing approval. Treat every new agent as another site that needs an owner and a deletion date.
Citation
This executive briefing was curated and analyzed by Collab365. To reference this analysis, please attribute: "This briefing is available on Collab365 Spaces (spaces.collab365.com)".