AB-900 lesson 11: Administering agents

An agent reaches users through a fixed path: someone creates it, an admin approves it when it is going organisation-wide, and the admin decides who may install it. After that it is monitored, updated and eventually retired. Most of this is handled in the Microsoft 365 admin center under Agents, with the Power Platform admin center covering the environments where Copilot Studio agents live. Only the AI Administrator and Global Administrator roles can approve requests.

Controlling who can use agents

Agent settings live under Agents > Settings. Three controls matter for the exam:

Separately, an individual agent can be installed for everyone or for chosen groups, blocked for the whole tenant, or pinned in users’ Copilot agent lists (up to three).

Creating an agent

Agents are made with several tools: Agent Builder inside Copilot for simple agents, Copilot Studio for more capable ones, SharePoint for agents grounded on a site, and developer tools such as Microsoft Foundry and the Agents Toolkit. A basic agent starts with a description, instructions and knowledge sources. One that a creator shares directly shows in the registry as “Shared by creator”. Creating a SharePoint agent needs a Copilot licence and permission to add files to the site.

From submission to publication

Making an agent available to the whole organisation triggers a request. In Agents > All agents > Requests, the admin sees entries marked pending review, pending update or pending activate. Selecting one shows its owner, data sources, custom actions and permissions. The two outcomes are Publish to store and Reject submission.

Publishing opens a wizard: choose who can install it, optionally who gets it preinstalled, apply a policy template, then review the permissions the agent asks for and grant admin consent. When a developer later submits a change, it waits as pending update, and users keep the old version until the admin approves. An agent submitted for the whole organisation that colleagues cannot find is usually still waiting in the queue; once published, it is labelled “Published by your org”.

Monitoring and lifecycle

The figure above shows the loop. Agents > Overview gives a 30-day snapshot: active users, pending requests, agents without owners, agents at risk and agents with errors. The Registry lists every agent, with filters, and can be exported. Lifecycle actions there include:

• Block or unblock to stop or restore use across the tenant.
• Delete, which is a soft delete; the agent can be restored for 30 days or removed permanently.
• Assign a new owner, needed when the creator leaves and the agent becomes ownerless.

For agents built in Copilot Studio, the Power Platform admin center adds the operations view. Under Copilot, the Copilot Studio page shows message consumption, the number of active agents (those with sessions in the last 28 days), the session success rate and the top ten agents by monthly sessions. It does not include agents built with Agent Builder.

Worked example: an HR policy agent

At a 150-person company, an HR coordinator builds a leave-policy agent in Copilot Studio and submits it for the whole organisation. The admin opens Requests, checks that the knowledge source is the HR site, and publishes it to all users with the default policy template. Later the Overview page shows it among the most-used agents. When the coordinator leaves, it appears under agents without owners, and the admin assigns the new HR lead as owner rather than deleting it. An abandoned, unused agent would instead be blocked, then deleted.

Easy to confuse

• Shared by creator vs Published by your org. The first is a creator’s own sharing; the second has passed admin approval.
• Block vs delete. Block can be reversed instantly; delete is a soft delete with a 30-day window.
• Microsoft 365 admin center vs Power Platform admin center. Inventory, approval and access in the first; Copilot Studio environments and operational insights in the second.

Key points

• Agent settings are under Agents > Settings: user access, agent and plugin access, and sharing.
• Org-wide agents wait under Requests until an AI Administrator or Global Administrator publishes or rejects them.
• Publishing selects users, a policy template and consented permissions.
• The Overview and Registry cover usage and inventory; the Power Platform admin center covers Copilot Studio operations.
• Delete is soft for 30 days, and an ownerless agent needs a new owner.

Check yourself

This lesson covers agent administration in the Copilot and agents domain (25 to 30 percent of AB-900). The compact version is in the Copilot and agent admin recap, and AI agents explained gives the concept behind them.