Not a slide deck — a living sweep with evidence
Every check has a status, a finding, an action with owner and due date — and a screenshot as evidence. Your team sees the released state any time in the read-only customer view.
Agents are built faster than anyone governs them
Copilot Studio makes building an agent a matter of minutes. Five things we find in almost every tenant we look at:
Shadow agents in the default environment
In the default environment every user is a maker. Agents appear there that IT never hears about — until one of them answers a customer.
Identities and connectors without a rule
If an agent runs with its maker's credentials, every user sees what the maker sees. Connectors, knowledge sources and sharing need a policy, not a habit.
MCP servers and external agents
Custom connectors to MCP servers and third-party agents enter the tenant without review or DLP classification — a new data path nobody signed off.
Credits without a cap
Copilot Credits pay for authoring and operations alike. Without allocation and stop-usage rules you notice the consumption on the invoice.
Preview becomes GA
Agents and platform features change. Optional recurring reviews help track new risks and progress after the initial assessment.
You cannot govern what you have not inventoried — and an inventory from last quarter is already wrong.
48 checks in 7 areas
Every check names where to look in the admin center, what to verify and which Microsoft documentation applies — so your admin can follow every finding.
Inventory & Ownership
What exists, who owns it, which harness it runs on. No inventory, no governance.
- Agent inventory in the Power Platform Admin Center
- Ownerless and inactive agents
- Default environment and shadow agents
- Autonomous agents and event triggers
Identity & Access
Who may build agents, which identity they run under, who may use them.
- Copilot Studio authors and publishing rights
- Blocking viral trials
- Entra Agent ID and Conditional Access
- Unauthenticated agents, sharing controls, PIM
Data, Connectors, MCP
Which data and endpoints an agent can reach — and whether anyone controls that.
- DLP policies for Copilot Studio connectors
- Custom connectors, MCP servers and external agents
- Knowledge sources and SharePoint permissions
- Sensitivity labels, Purview DLP, web search
Models & AI settings
Which model computes where, and what the agent remembers.
- Primary model per agent
- External models and data processing location
- Memory and content moderation
- Generative AI features and data movement
Cost / Credits
Copilot Credits are the currency for everything — authoring included.
- Credit consumption per agent
- Overage notification
- Allocation and stop usage
- Azure budgets and alerts
Monitoring & Compliance
What agents really do — operationally and from a compliance angle.
- Transcripts and Purview audit log
- DSPM for AI and Communication Compliance
- Agent status and evaluations
- Defender: AI agent inventory
ALM & Process
So the sweep does not start from scratch again in three months.
- Environment strategy and Managed Environments
- Pipelines and deploy from Git
- Intake and approval process
- Kill switch and incident response
Platform sweep: apps, flows, data
39 further checks in the same seven areas for the rest of the Power Platform: app and flow inventory, sharing and security roles, DLP coverage, tenant isolation, capacity and licences, auditing, ALM. Quoted separately when a tenant needs more than the 48 baseline agent-governance checks.
An assessment to start, optional follow-up services
The initial assessment has a defined baseline scope. Remediation, extensions and recurring reviews are separate engagements.
Initial sweep
48 baseline checks for one tenant, one environment and up to 5 Copilot Studio agents, with your IT. Includes findings, an action plan, a closing discussion, a protected results view and a Markdown protocol.
Optional recurring review
Quoted separately: review progress on actions, new agents, connectors and platform features at an agreed interval, for example quarterly.
Optional remediation & support
Remediation, larger scopes and the 39 additional platform checks receive a separate quote. Ongoing support and further implementation are optional.
The customer portal, built for audits
Each finding is recorded where it is made — during the sweep session, not afterwards from notes.
Status per check
Open, OK, action needed or not applicable — at a glance per area, with progress across all 48 checks.
Finding & action
What was found, what will be done, who does it and by when — with a priority for every action.
Evidence as screenshot
For every check the screenshot from the admin center — for your ISMS or your auditor.
Protected customer link
Only the e-mail addresses you approve see the state — after verification, read-only.
Protocol export
The whole protocol as Markdown — into your ticketing, wiki or audit report.
German, English, French
Interface and checks in three languages — for teams across Switzerland.
From intro call to a current portal
We never change a setting without your approval. The actions are implemented by your team — or by us, on request.
Intro call (30 min, free)
We clarify tenant, environment, agent count and requirements. You receive the final fixed price and schedule for the assessment in writing; any additional work is quoted separately.
Sweep session with your admin
Together on screen through the 48 checks: Power Platform Admin Center, Microsoft 365 Admin Center, Entra ID, Purview. Every finding is recorded on the spot, every action gets an owner and a due date.
Closing discussion & handover
We discuss findings and the action plan with your team, then hand over the protected results view and Markdown protocol. Remediation or recurring reviews can be commissioned separately.
Power Platform consulting
Power Apps, Power Automate, Power BI and Power Pages on Dataverse — with governance and DLP from the start.
Copilot Studio consulting
Consulting, development and operation of AI agents — grounded in your data, with response policies and human escalation.
Managed Security for Microsoft 365
Identities and devices monitored around the clock — the operational counterpart to the governance sweep.
Common questions about Power Platform compliance
Do you know how many agents run in your tenant today?
In free scoping we clarify the assessment and any optional follow-up. You then receive the final fixed-price quote in writing, without obligation.