This Company Thought They Had 200 Agents. They Had 3,000.
A customer was convinced they had a couple of hundred agents in their Microsoft 365 tenant. When they looked, there were 3,000. This story from Joy Apple’s live demo of Orchestry‘s new agents dashboard in our video show “Guardians of M365 Gvernance” with Christian Buckley sums up the state of AI governance in 2026: you can’t govern what you can’t see.
Why AI readiness is never “done”
We’ve said “AI readiness” for three years now, and it’s really just a rebrand of governance. Treating it as a 3–6 month project doesn’t work. It has to be continuous improvement. Content-only readiness (sensitivity labels, oversharing, permissions) also overwhelms many organizations, because nobody has time to clean up every site.
The shift: govern from the agent’s perspective too. Which sources does an agent ground on? Make those AI-ready first.
What a useful agent inventory shows
The Orchestry dashboard is phase one. It covers Copilot Studio agents, Agent Builder agents and SharePoint agents, with Foundry and other platforms on the roadmap. What I liked:
- Inventory and growth trends by agent type
- Environments and solutions per agent. The Power Platform is the plumbing for your M365 agents.
- Risk indicators such as autonomous agents with access to public web content
- Grounding sources of risky agents, so you can check labels and DLP on exactly that content
Recommendations
1. Get an agent inventory before you write policies. Start with Copilot Studio, Agent Builder and SharePoint agents, then extend to Foundry and non-Microsoft agents.
2. Use proper environment strategy. Microsoft’s guidance is to stop building in the default environment. Plan Dev, UAT and Production, plus a separate environment for hosting. Agent lifecycle management starts here.
3. Prioritize by risk, not by count. Autonomous agents and agents with broad grounding sources come first. Check labels, oversharing and DLP on those sources.
4. Don’t block shadow AI, bring it into the ecosystem. Customers see too much value to accept blanket blocking. Register non-Microsoft agents (Agent 365) and apply labels and DLP to them.
5. Make cost governance part of the model. Runaway invoices are the number-one concern I hear. The licensing changes of 1 August, with the legacy Copilot Studio experience on Copilot Credits and the new experience on GitHub credits, confuse many customers. Where a simple Power Automate flow does the job, you don’t need an agent. We need more tools that review how an agent is built and ask whether it’s the right model, platform and cost.
6. Don’t throttle experimentation. If every prompt costs money, makers stop testing. Set budgets and sandboxes that keep room to play.
7. Train people on SharePoint skills. They’re easy to overlook. Plan for the roughly 80% common skills and the 20% that is site-specific. The PnP skill gallery web part can serve as an organizational skill library.
It’s a mindset topic
After a full-day workshop in Munich, the CEO told me their biggest challenge isn’t technology or a lack of agents. It’s mindset and skills. His team members will move from doing the work to being product owners of agentic services. The role he needs to hire is a mix of AI specialist, adoption/change expert and service owner who can manage other service owners. Strong business analysts, who understand business and systems, matter more than ever here.
Your next steps
- Run an agent inventory this week.
- Check your environment strategy against the Dev/UAT/Prod model.
- Pick your 5 riskiest agents and review their grounding sources.
- Define a cost-monitoring approach and a sandbox.
- Name owners for agentic services.
Watch our Video here:
PS: Ready to implement proper AI agent governance? Contact me, Ragnar Heil, for a consultation on Agent 365, SharePoint Advanced Management, Microsoft Purview (Information Protection, Data Loss Prevention Policies, DSPM for AI) or Agent 365 deployment strategies tailored to your organization’s needs. Find my calendar here at our HanseVision Governance Landing Page.
