Autonomous agents are no longer a conference demo. In the latest episode of Guardians of M365 Governance, Christian Buckley, Joy Apple and I compared what we actually run day to day with what Microsoft is shipping. The same tension came up again and again: the easier agents get to use, the harder they get to govern.

Building in public: the agents are already here

All three of us believe in working out loud, and “building in public” is the modern version of that. People show the process, not just the result, and that is where the learning happens.

My own setup is simple. I run around 20 to 25 personal bots, and most of them deliver daily or evening briefings. One scans Reddit, official blogs and YouTube for Microsoft Copilot news. Another uses the vidIQ MCP server to find YouTube topics with high search demand and low competition. It proposes ten video ideas, I pick one, and it writes the script. The prompt always starts with an objective, because an agent without a goal is just a chat window.

OneDrive: simpler on the front, harder behind it

Microsoft’s latest Copilot announcements brought a new OneDrive experience. You can now create interactive dashboards from the KPIs in your files, turn a document into a presentation, and generate image charts, all without leaving OneDrive.

Christian pointed out a lesson from his Pacific Bell days: the simpler the front end, the more complex the back end. A OneDrive that looks and feels like SharePoint lowers the barrier to collaboration. It also raises the governance stakes, especially around oversharing drafts and old data.

Agent 365: seeing the agents you didn’t deploy

This was my part of the show. I built a to-do agent on Anthropic’s platform and then looked for it in Microsoft Agent 365. It was there, registered and visible. Agent 365 is not limited to Microsoft agents. It can also cover:

• Amazon Bedrock
• Databricks Genie
• Google Vertex AI
• Salesforce Agentforce
• ServiceNow
• Snowflake
• UiPath

The shadow AI view is more sobering. New agents such as OpenClaw, Hermes and personal bots show up almost every week, but only if they run on a managed device. I run mine on a cheap virtual server, so they stay invisible to Microsoft’s tooling. For the ones Agent 365 does see, the only technical action today is to block.

Christian’s answer was that visibility alone is still worth having. It tells you what people actually use, and it opens the conversation about what you can support inside your managed stack.

The bill arrives: Copilot cost governance

My customers want to move on to Copilot Code, Cowork and the upcoming Autopilot. Their first question is always about cost. I vibe-coded a dashboard on the new Microsoft 365 Copilot cost API. An admin enters a user principal name and sees pay-as-you-go credits, prepaid balance and consumption by workload. The workloads include Copilot Code, Notebooks, Cowork (still called Scout, soon to be renamed), Work IQ and the Teams agents.

The most striking number came from the dashboard itself. Building it burned about 9,000 credits in a single prompt. I expect Microsoft to announce end-user views of credit consumption at Ignite. Employees need to see how many credits they have left this month, or IT will drown in support tickets.

Christian added a counterpoint. The cost already exists in salaries. Would you rather have people spend five times longer on a task? We are moving from flat-rate software to a metered world, and nobody has the usage patterns figured out yet, including the vendors.

I have vibe-codes an Dashboard to control sprawl of Copilot Cost, using latest Copilot Cost Management API. Read more here.

Key takeaways

1. Start with objectives. Every agent and every prompt needs a clear goal.
2. Make agents visible. Use Agent 365 to find out what already exists, including non-Microsoft agents.
3. Plan for the blind spot. Agents on unmanaged devices won’t show up, so policy and conversation matter as much as tooling.
4. Give users their own consumption view. Self-service dashboards keep IT out of the credit-counting business.
5. Measure cost against value. Tokens are visible, but wasted hours aren’t.

Governance has been on the agenda since SharePoint 2007. With autonomous agents and metered AI, it has never mattered more. Customers don’t just ask “how do we build agents?” any more. They ask “how do we build them safely and affordably?”

Watch the full episode of Guardians of M365 Governance on my YouTube channel.

---

PS: Ready to implement proper AI agent governance? Contact me, Ragnar Heil, for a consultation on Agent 365, SharePoint Advanced Management, Microsoft Purview (Information Protection, Data Loss Prevention Policies, DSPM for AI), EasyLife365 Collaboration, Solutions2Share, Rencore Governance, ShareGate Protect, Data&More or Agent 365 deployment strategies tailored to your organization’s needs. Find my calendar here at our HanseVision Governance Landing Page. Pssst… I am also offering an exquisite M365 Copilot & Agents MasterClass. Find out more here.