Not a slide deck — a living sweep with evidence
Every check has a status, a finding, an action with owner and due date — and a screenshot as evidence. Your team sees the released state any time in the read-only customer view.
Agents are built faster than anyone governs them
Copilot Studio makes building an agent a matter of minutes. Five things we find in almost every tenant we look at:
Shadow agents in the default environment
In the default environment every user is a maker. Agents appear there that IT never hears about — until one of them answers a customer.
Identities and connectors without a rule
If an agent runs with its maker's credentials, every user sees what the maker sees. Connectors, knowledge sources and sharing need a policy, not a habit.
MCP servers and external agents
Custom connectors to MCP servers and third-party agents enter the tenant without review or DLP classification — a new data path nobody signed off.
Credits without a cap
Copilot Credits pay for authoring and operations alike. Without allocation and stop-usage rules you notice the consumption on the invoice.
Preview becomes GA
Microsoft ships new agent features every month. A review from today is incomplete in three months — which is why this is a service, not a one-off.
You cannot govern what you have not inventoried — and an inventory from last quarter is already wrong.
48 checks in 7 areas
Every check names where to look in the admin center, what to verify and which Microsoft documentation applies — so your admin can follow every finding.
Inventory & Ownership
What exists, who owns it, which harness it runs on. No inventory, no governance.
- Agent inventory in the Power Platform Admin Center
- Ownerless and inactive agents
- Default environment and shadow agents
- Autonomous agents and event triggers
Identity & Access
Who may build agents, which identity they run under, who may use them.
- Copilot Studio authors and publishing rights
- Blocking viral trials
- Entra Agent ID and Conditional Access
- Unauthenticated agents, sharing controls, PIM
Data, Connectors, MCP
Which data and endpoints an agent can reach — and whether anyone controls that.
- DLP policies for Copilot Studio connectors
- Custom connectors, MCP servers and external agents
- Knowledge sources and SharePoint permissions
- Sensitivity labels, Purview DLP, web search
Models & AI settings
Which model computes where, and what the agent remembers.
- Primary model per agent
- External models and data processing location
- Memory and content moderation
- Generative AI features and data movement
Cost / Credits
Copilot Credits are the currency for everything — authoring included.
- Credit consumption per agent
- Overage notification
- Allocation and stop usage
- Azure budgets and alerts
Monitoring & Compliance
What agents really do — operationally and from a compliance angle.
- Transcripts and Purview audit log
- DSPM for AI and Communication Compliance
- Agent status and evaluations
- Defender: AI agent inventory
ALM & Process
So the sweep does not start from scratch again in three months.
- Environment strategy and Managed Environments
- Pipelines and deploy from Git
- Intake and approval process
- Kill switch and incident response
Platform sweep: apps, flows, data
39 further checks in the same seven areas for the rest of the Power Platform: app and flow inventory, sharing and security roles, DLP coverage, tenant isolation, capacity and licences, auditing, ALM. Switched on per customer when a tenant needs more than agent governance.
One sweep to start, then it stays current
Three building blocks, priced in writing after the intro call. Scope and rhythm follow your tenant, not a package.
Initial sweep
All 48 checks, together with your IT. Result: a status per check, findings, and an action plan with owner, priority and due date — in the customer portal and as a protocol.
Recurring re-sweep
Typically quarterly: progress on the actions, new agents and connectors, new Microsoft features (preview to GA). The portal stays the current state — no new audit from scratch.
Support between sweeps
Intake and approval process for new agents, a kill-switch runbook, a contact for your teams' questions — and the evidence when your auditor asks.
The customer portal, built for audits
Each finding is recorded where it is made — during the sweep session, not afterwards from notes.
Status per check
Open, OK, action needed or not applicable — at a glance per area, with progress across all 48 checks.
Finding & action
What was found, what will be done, who does it and by when — with a priority for every action.
Evidence as screenshot
For every check the screenshot from the admin center — for your ISMS or your auditor.
Protected customer link
Only the e-mail addresses you approve see the state — after verification, read-only.
Protocol export
The whole protocol as Markdown — into your ticketing, wiki or audit report.
German, English, French
Interface and checks in three languages — for teams across Switzerland.
From intro call to a current portal
We never change a setting without your approval. The actions are implemented by your team — or by us, on request.
Intro call (30 min, free)
We clarify tenant, environments, number of agents and your compliance requirements — and you receive a written quote for the initial sweep and the re-sweeps.
Sweep session with your admin
Together on screen through the 48 checks: Power Platform Admin Center, Microsoft 365 Admin Center, Entra ID, Purview. Every finding is recorded on the spot, every action gets an owner and a due date.
Portal release & re-sweep
Your team receives the protected link to the current state. At the next sweep we check progress and what is new — and keep the state current.
Power Platform consulting
Power Apps, Power Automate, Power BI and Power Pages on Dataverse — with governance and DLP from the start.
Copilot Studio consulting
Consulting, development and operation of AI agents — grounded in your data, with response policies and human escalation.
Managed Security for Microsoft 365
Identities and devices monitored around the clock — the operational counterpart to the governance sweep.
Common questions about Power Platform compliance
Do you know how many agents run in your tenant today?
In 30 minutes we clarify scope and rhythm — and you receive a written quote. No obligation.