Starting Oct. 25, Microsoft 365 administrators can set permissions that determine which users are allowed to upload advanced Copilot agents, giving organizations tighter governance over AI tools.
Microsoft 365 administrators will gain new control over AI deployments, as the platform now lets them restrict which users can upload advanced Copilot agents.
What the new permission does
Starting Oct. 25, admins can toggle a setting in the Microsoft 365 admin center that determines whether a user may upload an advanced Copilot agent. The feature applies to the entire tenant, giving organizations a single point of governance for AI extensions.
Why the change matters
Advanced Copilot agents can execute custom code and access sensitive data, raising compliance and security concerns. By limiting uploads to trusted users, companies can reduce the risk of accidental data exposure or malicious behavior.
The permission works alongside existing role‑based access controls, so administrators can combine it with other policies such as data loss prevention and conditional access.
How to enable the restriction
1. Sign in to the Microsoft 365 admin center.
2. Navigate to Settings → Copilot → Agent management.
3. Turn on Restrict advanced agent uploads and select the users or groups allowed to upload.
- Select specific users or security groups
- Apply the setting tenant‑wide or to individual sites
- Combine with existing compliance policies
For organizations that already enforce strict data governance, the new toggle offers a straightforward way to extend those controls to AI‑driven workloads without requiring custom scripting.
Related coverage: about the broader AI governance roadmap in Microsoft’s Microsoft on Momentum profile and explore related technology stories in the Technology section.
Simon Carter’s analysis of Microsoft 365 admin controls for Copilot agents