Copilot Agents: Proven Safe Governance and Cost Guide

Copilot agents are the point at which Microsoft’s AI stops being an assistant that answers questions and becomes software that acts on your behalf. That shift is small in the interface and enormous everywhere else. An assistant that drafts an email is a productivity feature. An agent that reads a mailbox, decides something and sends the email is a system with an identity, a permission set, a bill and a blast radius, and almost none of the controls your organisation already owns were designed with it in mind.

This guide covers the three questions that actually decide whether Copilot agents succeed in a UK organisation: what they can reach, who is allowed to build them, and what they cost when real people start using them. Every figure below comes from Microsoft’s own published documentation as it stood in August 2026, and every piece of arithmetic is shown so you can substitute your own numbers.

It is worth being clear about why this matters commercially. Gartner’s much-quoted prediction that over 40 per cent of agentic AI projects will be cancelled by the end of 2027 named exactly three causes — escalating costs, unclear business value and inadequate risk controls. Two of those three are governance failures rather than technology failures, which means the difference between Copilot agents that survive contact with a budget and Copilot agents that get switched off is mostly decided before anyone builds anything.

We publish three companion guides that sit around this one: a Copilot readiness assessment covering the permissions work that must happen first, a Microsoft 365 Copilot security guide for the oversharing problem, and a Microsoft 365 Copilot cost and ROI model for the per-seat licensing question. This article is about the agent layer that sits on top of all three.

Table of contents

What Copilot Agents Actually Are
Why Copilot Agents Change Your Security Model
Governing Copilot Agents Before They Sprawl
What Copilot Agents Actually Cost
Modelling Three Real Copilot Agents
A Rollout Sequence for Copilot Agents
UK Compliance Considerations for Copilot Agents
Frequently Asked Questions
References

What Copilot Agents Actually Are

The word “agent” is doing far too much work in Microsoft’s marketing, and the ambiguity has real consequences: two things called Copilot agents can have completely different security boundaries and completely different bills. Microsoft’s own developer documentation cuts the category cleanly in two.

The two build paths behind every agent

Every agent for Microsoft 365 Copilot is built one of two ways. A declarative agent supplies custom instructions, knowledge and actions, but runs on Copilot’s own orchestrator and foundation models. A custom engine agent brings its own orchestrator and its own models, and needs hosting outside Microsoft 365, typically in Azure, at additional cost. Everything else — Agent Builder, Copilot Studio, the Agents Toolkit — is tooling that produces one of those two shapes.

Declarative agents inherit your existing controls

This is the important part, and it is the reason declarative agents are the sane default. Because they run inside Copilot’s infrastructure, Microsoft states they adhere to the security, compliance and Responsible AI requirements of Microsoft 365. They cannot act proactively, they are designed for individual use, and they run only inside Microsoft 365 applications. That constraint is a feature. A declarative agent is roughly as dangerous as the person invoking it, which is a risk you already understand and already manage.

Custom engine agents are where the risk actually moves

Custom engine agents are a different proposition entirely. They support proactive interactions that trigger without any user input, they can be reached from outside Microsoft 365, they support agent-to-agent delegation, and — in Microsoft’s own words — with a custom engine agent you “must ensure your own compliance, RAI practices, and security measures.” Nothing is inherited. The organisations that get into trouble with Copilot agents are almost always the ones that assumed the second column of this table behaved like the first.

Factor	Declarative agents	Custom engine agents
Orchestrator and model	Copilot’s own	Yours, including model choice
Hosting	Inside Microsoft 365, no extra hosting	External, typically Azure, at additional cost
Proactive or autonomous action	Not supported	Supported, triggers without user input
Reach	Microsoft 365 apps only	Microsoft 365 and external channels
Agent-to-agent delegation	No	Yes
Compliance and security	Inherits Microsoft 365 standards	You must provide your own

Start declarative, escalate deliberately

The practical governance rule that follows is simple. Treat declarative as the default and custom engine as an exception that requires a named owner, a documented business case and a security review. If your first twenty Copilot agents are declarative, you have a manageable estate. If half of them are custom engine agents built by different teams against different models, you have a second IT estate that nobody is patching.

Why Copilot Agents Change Your Security Model

Most security thinking about Microsoft 365 assumes a human at the keyboard. Copilot agents break that assumption in three specific ways, and each one needs a different control.

An agent acts with permissions, not judgement

The single most important sentence in this article: an agent operating under a user’s identity can reach everything that user can reach. It has no sense that a file is sensitive, no instinct that a folder looks like it was shared by mistake, and no hesitation about surfacing a document nobody has opened in four years. Every over-permissive SharePoint site and every “anyone with the link” sharing setting in your tenant becomes reachable at conversational speed. This is why permissions remediation is prerequisite work for Copilot agents rather than a follow-up task, and it is the single most common reason a pilot has to be paused.

Prompt injection is the agent-specific attack

Conventional cybersecurity assumes attackers target systems. With agents, the attacker targets the instructions. Indirect prompt injection hides adversarial text inside content the agent will read — an email, a document, a web page, a calendar invitation — so the agent treats attacker text as a legitimate instruction. The agent then does something harmful using entirely legitimate permissions. No malware, no credential theft, no alert. We cover the assessment method in detail in our prompt injection risk assessment guide, and it belongs in your risk register before any agent touches untrusted content.

What EchoLeak proved about the exposure

EchoLeak, tracked as CVE-2025-32711 and disclosed by Aim Security on 11 June 2025, is the case study worth knowing. It was a zero-click vulnerability in Microsoft 365 Copilot: a single crafted email, with no user interaction whatsoever, could cause Copilot to reach internal files and exfiltrate their contents to an attacker-controlled server. Microsoft rated it Critical at CVSS 9.3, though it is worth knowing that NIST analysts scored the same flaw 7.5 — a gap worth remembering whenever a vendor severity number is quoted at you.

The researchers named the underlying class an “LLM scope violation”: untrusted external input manipulating the model into acting on data it was legitimately allowed to see. Microsoft patched it server-side and reported no exploitation in the wild, but the structural point stands. Any assistant with access to multiple internal data sources has this shape of attack surface, and Copilot agents multiply the number of places untrusted content can enter — every knowledge source and every connector you attach is another doorway.

Agent identity is now mandatory, and that helps

The most useful recent development is that Copilot agents have stopped being anonymous. Microsoft Entra Agent ID gives each agent a first-class identity in your directory, which means Copilot agents can be subject to Conditional Access policies, centralised audit logging and lifecycle management in the same way user accounts are.

The timeline matters for anyone auditing an existing estate. Copilot Studio began creating these identities automatically for all new agents on 18 March 2026, and since July 2026 every new agent must have one — the opt-out is gone. Copilot agents created before that change continue to run on app registrations and are due to be migrated. Finding those legacy agents is a real task rather than a formality, because they are precisely the ones nobody has reviewed.

Governing Copilot Agents Before They Sprawl

Agent sprawl is not a hypothetical. Low-code tooling means the constraint on how many Copilot agents exist in your tenant is enthusiasm, not engineering capacity, and enthusiasm scales quickly.

Check the two defaults that do the damage

Before designing any policy, check what your tenant is already doing, because two Microsoft defaults are more permissive than most administrators expect. First, the agent user-access setting in the Microsoft 365 admin centre defaults to All users — every user in the organisation can access agents unless you change it. Second, SharePoint agents require no activation whatsoever: once a user holds a Copilot licence, those agents become available automatically on every eligible site where that user already has permissions. Neither default is wrong, but both mean Copilot agents are almost certainly live in your tenant already, and the governance question is not whether to start but what is already running.

Decide who may build and who may publish

These are two different permissions and conflating them is the most common governance mistake. Building an agent for personal use is closer to writing an Excel macro. Publishing one to a Teams channel or an external website is closer to deploying an application. Microsoft’s model reflects this: a Copilot Studio user licence is free of charge, but access is gated through either that licence, membership of the Copilot Studio authors security group in the Power Platform admin centre, a Microsoft 365 Copilot licence, or a trial. Set that group deliberately on day one rather than discovering later who has been building.

Use environments as your blast radius boundary

Copilot Studio agents live in Power Platform environments, and environments are the control surface that actually works. Give production agents their own environment with its own data loss prevention policies and its own credit allocation, keep experimentation in a separate one, and apply DLP policies that determine which connectors an agent may combine. A connector policy that prevents an agent from touching a customer database and an outbound email connector in the same flow is worth more than any amount of written guidance.

Inventory every agent, including the abandoned ones

You cannot govern what you cannot enumerate. The Power Platform admin centre reports agents and their credit consumption per environment, and Entra Agent ID gives you the directory-side view. The awkward cases are agents built by someone who has since left, agents nobody uses but which still hold connections to live systems, and agents created before March 2026 that are still running on app registrations. Our AI system inventory template covers the register itself, and it should list an owner, a purpose, a data scope and a review date for every agent.

Risk	Control	Where it is configured
Agent reaches overshared files	Permissions remediation, sensitivity labels, Restricted Content Discovery	SharePoint admin, Purview
Anyone can build and publish	Authors security group, environment maker roles	Power Platform admin centre
Unsafe connector combinations	Data loss prevention connector policies	Power Platform admin centre
No accountability for agent actions	Entra Agent ID, Conditional Access, audit logs	Microsoft Entra admin centre
Runaway consumption	Per-agent monthly credit caps, environment allocation	Power Platform admin centre
Orphaned and abandoned agents	Ownership register, scheduled review, decommissioning	Your own inventory process

Agent 365 is now the control plane, and it is a separate licence

The honest caveat on everything above is that Microsoft has moved the good governance tooling behind a new product. Microsoft Agent 365, generally available since 1 May 2026, is the registry and control plane for Copilot agents — it covers agents with an agent ID, agents you register yourself and discovered shadow agents, and adds lifecycle policies that expire inactive agents and flag ownerless ones. It lists at £11.50 per user per month in the UK, on top of the Copilot seat, and is bundled into the Microsoft 365 E7 SKU.

The catch worth budgeting for is that Entra Agent ID itself is available to all Microsoft Entra customers, but extending Entra’s security features to those agent identities requires Agent 365. In other words, every agent gets an identity for free; doing anything useful with that identity is a paid capability. Decide deliberately whether you are buying it, because the alternative is governing Copilot agents through the free admin-centre settings and your own register, which is workable at small scale and painful beyond it.

Governance is cheaper before deployment than after

Every control above is straightforward to apply to five agents and genuinely difficult to retrofit across two hundred. The organisations that treat this as pre-work spend a fortnight on it. The ones that treat it as a clean-up exercise spend a quarter, and spend it under pressure.

What Copilot Agents Actually Cost

Here is where budgets go wrong, because Copilot agents are not licensed the way the rest of Microsoft 365 is. There is no per-seat price for an agent. Consumption is metered.

Credits, not seats

Microsoft replaced the old “messages” currency with Copilot Credits on 1 September 2025, with no change to the quantity per pack or the pay-as-you-go rate. Capacity is bought as a prepaid pack of 25,000 Copilot Credits at a UK list price of £153.80 per pack per month, or consumed pay-as-you-go through a linked Azure subscription at $0.01 per credit. Two properties of this model matter more than the headline price: capacity is pooled across the tenant, and unused credits do not carry over from month to month.

Prototyping is now billable on the newest runtime

One 2026 change deserves its own warning. Copilot Studio now runs several harnesses, and on the GitHub Copilot harness that reached general availability on 3 August 2026, billing works differently from everything described above. Microsoft’s wording is unambiguous: billing starts when you start building, not when you publish. Creating a solution in natural language, previewing it, testing it and generating evaluations all consume credits. Anyone budgeting for Copilot agents on the assumption that experimentation is free needs to check which harness their makers are using.

The rate card, and why one prompt is not one credit

The instinct that a user question costs a credit is wrong, and it is wrong by a factor that depends entirely on how the agent was built. These are Microsoft’s published rates.

Agent feature	Copilot Credits	Microsoft 365 Copilot licensed user
Classic answer	1	No charge
Generative answer	2	No charge
Agent action	5	No charge
Tenant graph grounding	10	No charge
Agent flow actions, per 100 actions	13	No charge on agent-called flows
Text and generative AI tools, standard, per 10 responses	15	No charge
Text and generative AI tools, premium, per 10 responses	100	No charge
Content processing tools, per page	8	No charge

A single complex prompt against a tenant-graph-grounded agent costs 12 credits — 10 for the grounding plus 2 for the generative answer — which is Microsoft’s own worked example. The gap between the cheapest and dearest way to answer one question is two orders of magnitude.

Copilot Credits consumed per interaction, by feature type

Classic answer 1 credit

Generative answer 2 credits

Agent action 5 credits

Tenant graph grounding 10 credits

Agent flow actions, per 100 13 credits

Where a Microsoft 365 Copilot licence makes agents free

This is the most valuable clause in the whole pricing model and the most widely missed. Employee-facing use of Copilot agents is zero-rated when the user holds a Microsoft 365 Copilot licence and the agent operates under that authenticated identity. Classic answers, generative answers, agent actions and tenant graph grounding all cost nothing in that scenario, subject to fair usage limits.

The consequence is stark. Internal Copilot agents used by licensed staff can be effectively free, while identical Copilot agents exposed to unlicensed users or to the public meter every single interaction. Two carve-outs are worth knowing — computer-using agents are excluded from the inclusion, and agent flows are only zero-rated when triggered by the agent itself rather than by another trigger.

Modelling Three Real Copilot Agents

Microsoft publishes three worked billing examples, which is unusually helpful. Extending each to a full month and then to whole prepaid packs shows the shape of the problem better than any general advice, because packs are bought in units of 25,000 credits at £153.80 each.

Monthly Copilot Credits for Microsoft’s three published example agents (30 days)

Public support agent, 900 customers a day 216,000 credits

Graph-grounded sales agent, 100 unlicensed users 144,000 credits

Internal autonomous order agent 600 credits

The three-hundred-fold spread

Read those three bars again, because all three are Copilot agents. The customer support agent answers four classic and two generative questions per conversation for 900 people a day: 7,200 credits daily and 216,000 a month, which needs nine packs at roughly £1,384 a month. The graph-grounded sales agent serves 50 licensed and 100 unlicensed users, but only the unlicensed 100 are billable at 48 credits each, giving 4,800 a day, 144,000 a month, six packs and about £923 a month.

The third is the interesting one. The autonomous order-processing agent fires four agent actions per order: 20 credits a day and 600 a month, which is a few pounds on a pay-as-you-go meter. So the cheapest of these Copilot agents costs a rounding error while the dearest costs over £16,000 a year, and the difference is design and audience rather than sophistication.

Grounding and audience are the two cost levers

Both expensive agents are expensive for reasons visible at design time. Tenant graph grounding at 10 credits is five times a generative answer, so switching it on for an agent that does not need tenant-wide retrieval multiplies the bill for no benefit. And exposing an agent to unlicensed or public users removes the zero-rating entirely. Deciding those two things deliberately is most of cost control; the rest is monitoring. The same discipline we describe in our AI cost governance guide applies directly.

Overage enforcement stops agents, it does not just bill you

This deserves emphasis because it is an availability risk, not merely a financial one. Enforcement triggers when a tenant reaches 125 per cent of prepaid capacity, at which point custom Copilot agents are disabled. Ongoing conversations finish, but subsequent attempts are rejected and users see either “There is a billing issue” or “This agent is currently unavailable. It has reached its usage limit.”

Agent flows behave differently again: once prepaid capacity is exhausted, new flow runs are blocked while the parent agent keeps answering non-flow questions. If customer-facing Copilot agents matter to your operation, either link a pay-as-you-go meter so overage bills instead of blocking, or set per-agent monthly caps in the Power Platform admin centre well below the enforcement threshold.

A Rollout Sequence for Copilot Agents

The sequence below front-loads the work that is cheap now and expensive later.

Phase one: fix permissions and set the boundaries

Before a single agent is built, run the permissions remediation, review broad sharing links, apply sensitivity labels to the material that matters, and decide who sits in the Copilot Studio authors group. Create separate production and experimentation environments and attach DLP connector policies to both. This phase produces no visible agents and is the phase that determines whether the rest works.

Phase two: two declarative agents, one owner each

Pick two narrow, genuinely useful jobs — a policy question-answering agent over a curated document set is the reliable starting point — and build them as declarative agents. Give each a named owner, a written purpose and a review date. Deliberately leave tenant graph grounding off unless the use case demands it, then measure consumption in the Power Platform admin centre for a full month before deciding anything.

Phase three: measure, cap, then expand

With a month of real consumption data you can extrapolate honestly rather than guess. Set per-agent monthly credit caps at a defensible multiple of observed usage. Only now consider a custom engine agent, and only with a security review attached. If you are contemplating genuinely autonomous agents, our work on autonomous AI agents sets out where they fit and where they do not.

UK Compliance Considerations for Copilot Agents

UK organisations have obligations here that the product documentation does not cover, and agents make several of them sharper.

Accountability does not transfer to the vendor

Under UK GDPR your organisation remains the controller for personal data an agent processes. If Copilot agents surface personal data to staff who should not see it, that is your breach, not Microsoft’s. The practical implication is that agent access decisions need the same documentation as any other access decision, and the inventory register is what makes that defensible.

The automated decision-making rules changed in February 2026

This is the compliance point most likely to catch people out, because the law moved recently and in a counter-intuitive direction. The Data (Use and Access) Act 2025 replaced UK GDPR Article 22 with new Articles 22A to 22D with effect from 5 February 2026. The old default prohibited solely automated decisions with legal or similarly significant effects unless an exception applied. The new default permits them for non-special-category data, provided you implement and document safeguards: transparency before the decision, a right to human review and a right to contest.

That is a liberalisation, but it is a conditional one, and autonomous Copilot agents are exactly the technology it contemplates. An agent that drafts an assessment for a person to approve sits comfortably outside the regime. An agent that approves, refuses or prices without meaningful human review sits squarely inside it and needs those safeguards documented before deployment rather than after. The ICO published its own early thinking in “Tech futures: agentic AI” in January 2026, and is explicit that the paper is not formal guidance — its automated decision-making guidance is still being updated in light of the Act.

Follow the NCSC’s advice, because it is agent-specific

The National Cyber Security Centre published guidance on adopting agentic AI in May 2026, summarising the first Five Eyes joint publication on the subject. Its four named risks map almost exactly onto this article: agents get broader access to external systems, data and tools; they behave unpredictably when goals are interpreted in unexpected ways; problems surface faster than humans can review them; and their actions are harder to explain after the fact. The NCSC’s core advice is to start small, restrict early deployments to low-risk tasks, and apply zero trust, defence in depth and least privilege from the outset rather than retrofitting them.

Records, retention and the audit trail

Agent interactions are records. They are discoverable, they may contain personal data, and they need a retention position consistent with the rest of your Microsoft 365 estate. Entra Agent ID improves this materially by giving each agent a directory identity that audit logs can attribute actions to — which is exactly the evidence a regulator, an ISO 27001 auditor or a Cyber Essentials assessor will ask for.

Frequently Asked Questions

Do Copilot agents need a Microsoft 365 Copilot licence?

Not to exist, but the licence changes the economics completely. Employee-facing agent use by a Microsoft 365 Copilot licensed user, running under that user’s authenticated identity, is zero-rated for classic answers, generative answers, agent actions and tenant graph grounding. Unlicensed and external users meter everything.

What does an agent actually cost to run?

It depends almost entirely on grounding and audience. Microsoft’s published examples range from 600 credits a month for an internal autonomous agent to 216,000 for a public support agent handling 900 customers a day — a few pounds against roughly £1,384 a month once you round up to whole prepaid packs.

Can someone build an agent without IT knowing?

That is precisely the risk low-code tooling creates. Control it through the Copilot Studio authors security group and environment maker roles in the Power Platform admin centre, and audit against the agent list and Entra Agent ID rather than relying on people to tell you.

Is prompt injection actually a real threat?

EchoLeak, CVE-2025-32711, was a zero-click prompt injection in Microsoft 365 Copilot with a CVSS score of 9.3 that could exfiltrate internal data from a single crafted email. Microsoft patched it and reported no exploitation in the wild, but the attack class is structural to any assistant reading untrusted content.

What happens if we run out of credits?

At 125 per cent of prepaid capacity, custom agents are disabled and users are told the agent is unavailable. Agent flows are blocked as soon as capacity is exhausted. A pay-as-you-go meter converts that outage into a bill, which is usually the outcome you want for anything customer-facing.

How many agents should we start with?

Two, both declarative, both with a named owner and a defined document scope. That is enough to produce real consumption data and real user feedback inside a month without creating an estate you cannot inventory.