From Excitement to Enforcement: Governing Copilot

Join MVPs Christian Buckley, Joy Apple, and Ragnar Heil as they welcome fellow MVP Richard Harbridge from ShareGate to dive deep into the latest Microsoft 365 benchmark insights that are reshaping how we think about migration and governance.🔥 Key Takeaways:• Migration isn't a one-time project - it's an ongoing governance practice• 80% of organizations have deployed/piloted Copilot, but many struggle with ROI• Only 1% use purpose-built governance tools (shocking!)• Copilot success directly depends on data quality and organization• The rise of "shadow AI" and "shadow knowledge management"📊 What We Cover:✅ Why consolidation to Microsoft 365 is accelerating (hint: it's all about Copilot)✅ The security paradox: why IT pros are conflicted about cloud vs on-prem✅ Team-based approach to AI scaling: Safety → Efficacy → Scale✅ How poor governance creates shadow AI usage✅ Why governance is the "vitamin nobody wants to buy"🎯 Perfect for:• IT Administrators & Architects• Microsoft 365 Governance Teams• Organizations planning Copilot deployments• Anyone struggling with data sprawl and permissions📈 Featured Data: Based on survey of 650+ Microsoft 365 IT professionals across multiple regions🔗 Resources Mentioned:• ShareGate Microsoft 365 Benchmark Report (link in comments)• Microsoft Purview for AI governance• Knowledge Agents in Copilot Studio

Welcome back to Guardians of M365 Governance! 🛡️ Christian Buckley and Ragnar Heil are joined by Microsoft's Erica Toelle (Sr. Product Marketing Manager for M365 Copilot Security) for a deep dive into Data Security Posture Management for AI.🔥 What You'll Learn:✅ Why DSPM for AI is more than just a rebrand from AI Hub✅ How to monitor third-party AI tools like ChatGPT Enterprise✅ Real customer challenges with agent governance (ERP, CRM, HR access!)✅ Live demo of the new DSPM dashboard with 6 analytical views✅ Security Copilot: AI-powered governance agents in action✅ The "German Workers Council Problem" - balancing visibility with privacy⚡ Key Moments:• 03:45 - Erica's expanded role covering Copilot + Agents• 12:30 - Why customers are NOW asking for governance help• 18:15 - Ragnar's live DSPM demo (must-see!)• 25:40 - Shadow AI reality check with practical solutions• 32:20 - Security Copilot agents for Purview management• 38:10 - Microsoft's end-to-end security platform vision🎯 Perfect for:• IT Administrators planning Copilot rollouts• Security professionals managing AI governance• Compliance teams dealing with sensitive data in AI• Anyone curious about Microsoft's AI security roadmap💡 The Big Takeaway: You can't treat sensitive data as an "all or nothing" switch with AI. Granular controls for different data types (PII vs. confidential vs. merger data) are essential for getting AI benefits while managing risks.🚀 Coming Up: Sue Hanley joins us in September!

🚦 Are you the accidental Power Platform admin wondering what everyone is building in your tenant? You're not alone! In this comprehensive guide, we break down why Power Platform governance isn't about slowing people down – it's about giving your citizen developers the confidence to build amazing solutions safely. Join Guardians of M365 Governance with MVPs Christian Buckley⁠ ⁠, Joy Apple, myself and our guest Michael Roth🎯 What You'll Learn:✅ Why most organizations struggle with Power Platform governance✅ The truth about the COE Starter Kit (spoiler: it's still essential!)✅ How to implement governance without becoming the "no" person✅ The traffic rules analogy that changes everything✅ Practical strategies that actually work in the real world✅ Common governance mistakes and how to avoid them

🚦 Are you the accidental Power Platform admin wondering what everyone is building in your tenant? You're not alone! In this comprehensive guide, we break down why Power Platform governance isn't about slowing people down – it's about giving your citizen developers the confidence to build amazing solutions safely. Join Guardians of M365 Governance with MVPs Christian Buckley , Joy Apple, myself and our guest Michael Roth🎯 What You'll Learn:✅ Why most organizations struggle with Power Platform governance✅ The truth about the COE Starter Kit (spoiler: it's still essential!)✅ How to implement governance without becoming the "no" person✅ The traffic rules analogy that changes everything✅ Practical strategies that actually work in the real world✅ Common governance mistakes and how to avoid them

Join MVPs Joy Apple, Christian Buckley, me and special guest Diego Silva (Microsoft 365 Architect) as they dive deep into the reality of Microsoft Copilot adoption. What happens when the initial AI excitement fades and organizations face the hard truths about governance? This month's episode tackles the cultural, technical, and practical challenges of moving from Copilot demos to sustainable enterprise deployment.🔥 Key Topics Covered:Why governance matters more than ever in the AI eraThe hidden costs of poor content management with CopilotCultural change strategies that actually workPractical steps for sustainable AI adoption

Episode 17 of "Guardians of Microsoft 365 Governance" featured hosts MVPs Christian Buckley, Joy Apple and Ragnar Heil discussing Copilot Studio governance with guest Matthias Einig, CEO of Rencore.Agent Sprawl Crisis: Organizations are experiencing explosive growth in Copilot Studio agents - one customer already has 20,000 agents in just six months. Unlike traditional M365 Copilot's flat-rate pricing, the pay-as-you-go model creates cost control concerns when agents are shared organization-wide.Lifecycle Management Gap: Current Microsoft tools lack proper lifecycle management for agents. The new Copilot Control Center helps but doesn't scale for thousands of agents. Organizations need automated policies for unused agents, approval workflows for high-risk deployments, and chargeback models to assign costs to appropriate departments.From Data to Agents: While M365 Copilot governance focuses on cleaning underlying SharePoint/OneDrive data and permissions, Copilot Studio requires governing the agents themselves - their access scope, sharing permissions, and risk profiles throughout their lifecycle.Risk-Based Approach: Organizations are implementing policies like requiring special approval for agents shared with 100+ users, but these are often only checked at creation, not monitored ongoing. Risk assessment should consider both data sensitivity and audience size.Automated Governance: Rencore demonstrated upcoming capabilities including cost tracking per agent, usage analytics, automated cleanup of unused agents after 30 days, access reviews, and policy violations detection. The platform provides visibility into agent conversations, knowledge sources, and cross-connections between components.Cultural Shift: Unlike the COVID-era "deploy first, govern later" approach that created current data chaos, organizations are taking more measured approaches to AI adoption, recognizing that proper governance enables rather than hinders innovation.The episode emphasized that successful Copilot governance requires treating it as an ongoing process, not a one-time "readiness" checklist, with automation becoming crucial as both governance tools and AI agents operate autonomously.

Summary of Guardians of M365 Governance Ep.14When data sprawl, out-of-date documents, and misaligned permissions persist unchecked, any AI output (such as that from co-pilot) can be compromised or inaccurate. The overarching message is that organizations need to establish clear policies and processes to keep information fresh, secure, and properly categorized, thereby laying the groundwork for successful AI deployment. For Episode 14 of the Guardians of M365 Governance monthly webcast, Joy Apple (@joyofsharepoint), Ragnar Heil (@ragnarh) and I welcomed our guest and fellow MVP, Stacy Deere (@sldeere), the CEO of Focal Point Solutions, to discuss “How SharePoint is Making Governance Easier & More Secure” and many of the announcements made in the recent SharePoint event from Microsoft.

This episode explores how AI can improve oversight and streamline compliance processes in governance.Join this month's Guardians of M365 Governance as Ragnar Heil Joy Apple and Christian Buckley welcome dual Security and M365 MVP Alistair Pugin.Highlights- Introduction to the role of AI in enhancing government oversight.- Discussion on AI’s potential to simplify compliance tasks.- Real-world examples of AI applications in governance.- Expert opinions on the future of AI in regulatory frameworks.- Strategies for integrating AI solutions effectively in public sectors.

or Episode 12 of the Guardians of M365 Governance monthly webcast, Joy Apple (@JoyofSharePoint), Ragnar Heil (@ragnarh) and I welcomed our guest, Sharon Weaver (@sharoneweaver), a fellow MVP and RD and the CEO of Smarter Consulting, to discuss “Deep Dive Into the Microsoft 365 Maturity Model.” If you’ve been following the show, you’ll probably remember that Sharon was scheduled to be on live broadcast in August but had a last-minute customer priority, so we invited her back to continue the discussion and share her work as part of the core team helping to expand the Microsoft 365 Maturity Model.Our discussion centered on the importance of governance within the Microsoft 365 ecosystem, emphasizing its role in managing content, permissions, and access while fostering a culture of effective communication and training. The M365 Maturity Model can be a valuable framework for assessing and improving governance practices. This model provides a structured approach to evaluate organizational maturity across various competencies, such as communication, security, compliance, and adoption. Key insights included the significance of understanding current maturity levels, setting actionable goals, and creating a clear path for improvement through self-assessment tools and workshops.A critical focus of our conversation was the importance of communication as a competency. It was noted that communication is often the lowest-rated competency in organizations, yet it has the greatest impact on overall success. Improving communication can act as a catalyst for advancing other competencies, helping organizations navigate critical transitions, such as moving from a basic to an intermediate level of maturity. Strategies for leveling up include providing clarity about changes, offering guidance to stakeholders, and ensuring transparency in governance processes to foster trust and collaboration.We also explored the impact of AI, particularly tools like Microsoft Copilot, on governance practices. It was suggested that organizations need mature governance and communication competencies to effectively implement AI solutions. As AI adoption accelerates, there is a growing need for AI-specific governance considerations, including transparency, accountability, and ethics. In fact, we discussed the idea of creating a new “Level 600” in the maturity model to address the advanced requirements of AI governance, highlighting the evolving nature of organizational needs as technology becomes increasingly sophisticated.

For Episode 13 of the Guardians of M365 Governance monthly webcast, Joy Apple (@JoyofSharePoint), Ragnar Heil (@ragnarh) and I welcomed our guest, Michal Pisarek (@MichalPisarek), the CEO (and Janitor) of Orchestry Software, to discuss “Governance as a Blueprint for AI Readiness” and how effective governance is essential to harness the full potential of AI technologies. When data sprawl, out-of-date documents, and misaligned permissions persist unchecked, any AI output (such as that from co-pilot) can be compromised or inaccurate. The overarching message is that organizations need to establish clear policies and processes to keep information fresh, secure, and properly categorized, thereby laying the groundwork for successful AI deployment. We discussed a threefold set of challenges: First, content quality must be addressed: outdated files and redundant versions can degrade AI-driven insights. Second, security deserves special attention: loose or unmonitored permissions may inadvertently expose sensitive data to AI tools, particularly when these systems can “discover” documents through sophisticated queries instead of simple keyword matches. Finally, user ownership and adoption are critical, as the people managing projects, sites, or teams must be informed and empowered to enact changes—whether cleaning out shared links, adjusting permissions, or archiving old materials—without requiring deep technical expertise. Automation was offered as the key to handling these responsibilities efficiently. By standardizing the creation of new teams, sites, or agents with built-in governance guardrails, companies ensure that vital security and lifecycle steps are not left to chance. Automated reviews and prompts encourage team owners to make necessary adjustments to content and permissions at regular intervals, alleviating the workload on IT and strengthening overall compliance. Combined with thoughtful cost management—particularly for AI licensing—this integrated governance approach becomes the blueprint that allows organizations to embrace advanced AI solutions with confidence and clarity.