Microsoft 365 is rolling out a significant new admin control feature in mid-September 2025 that will enable IT administrators to manage organization-wide sharing permissions for user-built Copilot agents. The update directly addresses rising enterprise concerns around governance and security in AI agent deployment.
Highlights:
A. A new tenant-level control is coming to the Microsoft 365 admin center for Copilot agent sharing.
B. Admins will be able to set policies that apply to all users, no users, or selected groups.
C. Default behavior will remain unchanged unless customized.
Enhanced Governance Controls
The new control will be accessible through the Microsoft 365 admin center under Copilot > Settings > Data access > Agents. With this feature, administrators can define exactly which users or groups are allowed to create organization-wide sharing links for Copilot agents built using Microsoft Copilot Studio Agent Builder.
This introduces a more policy-driven model, aligning with internal governance structures and compliance requirements.
By default, existing sharing behaviors will remain the same, ensuring no immediate disruption for organizations not ready to adopt the new settings.
Admins will soon be able to configure three distinct permission levels:
- Allow all users to create sharing links
- Block all users from creating links
- Restrict access through role-based access control (RBAC) for specific users or groups
The update marks a major step in Microsoft’s enterprise AI governance framework, strengthening security while maintaining flexibility for approved teams.
Rollout Timeline
This Microsoft 365 new admin feature, Availability (Worldwide), will begin mid-September 2025, with a full rollout expected by late September 2025.
The phased deployment is designed to minimize disruption while giving organizations time to review their current Copilot agent policies and prepare necessary adjustments.
Impact of this Roll Out
From a technical perspective, the feature addresses critical concerns about data governance and information security in AI-powered collaboration.
Organizations will gain new tools to prevent unauthorized distribution of proprietary AI agents while enabling secure sharing for approved users.
The mechanism integrates seamlessly with existing Microsoft 365 security frameworks, leveraging Azure Active Directory identity management systems for enforcement.
Microsoft recommends that organizations proactively evaluate their existing sharing policies and update them in line with governance and compliance needs.
As enterprises increasingly adopt custom Copilot agents for sensitive processes and proprietary data analysis, these new administrative controls signal a more strategic approach to AI agent management.