12 Panes · Digital Skill Works Ltd
You ask, we answer
Practical advice on organisational Copilot, agents, permissions, and oversharing — Steady before scale. Inspired by Schofield’s Laws of Computing and the clarity of classic tech advice columns. This is not Ask Jack and not The Guardian.
Ask
Ask a question
Thank you
We’ve got your question. Selected answers appear here; private replies go to the email you left, from hello@twelvepanes.com.
Recent answers
-
If we remove someone's access in ServiceNow, how long before Copilot stops showing it?
MRC 503570 is Launched: Copilot connectors can now sync missed permission changes during incremental crawls, not just the daily full crawl. What that changes, what the connector docs still say, and how to test your own revocation window.
copilotconnectorspermissionssecuritygovernance -
Copilot now has legal plugins. Should our lawyers be using them?
MRC 571884 is Rolling out: legal plugins for Copilot in Word (on by default for Copilot-licensed users) and Legal for Cowork (users add it). Where admins control each, the third-party legal sources question, and a Steady pilot for legal teams.
copilotcoworklegalpluginsgovernance -
Should Teams announce out loud when recording or transcription starts?
MRC 559609 is In development (GA December 2026): a policy to play an audio announcement when Teams recording or transcription starts, tenant-wide or by group. How it sits alongside custom banners, explicit consent and Copilot's transcript settings.
teamscopilottranscriptionprivacymeetings -
People are sharing Copilot chats by link. Who can see them, and should we turn it off?
MRC 562353 Launched: Microsoft Copilot session and response sharing. What recipients see, why files stay protected, the one admin switch, Purview audit, and where the real oversharing risk sits.
copilotsharingoversharinggovernancepurview -
Staff can't upload Confidential files to our Copilot Studio agent. Is that about to change, and should we be pleased?
MRC 571305 vs Learn file-upload docs: Copilot Studio agents on the Microsoft 365 channel will accept MPIP-labelled files with protections enforced. What changes, what stays blocked, and the Steady checks to do first.
copilot-studiosensitivity-labelspurviewagentssecurity -
Does our Copilot DLP policy cover Cowork, or do we need a second one?
MRC 570845 is Rolling out: Purview DLP extends to Copilot Cowork through the existing Microsoft 365 Copilot and Copilot Chat location. What carries over, what licence each control needs, and the uploaded-file gap.
coworkpurviewdlpsecurityagents -
Can we see agent reporting in the Agent 365 Dashboard without buying Agent 365?
MRC 575292 vs Learn Agent Dashboard licensing: platform-agent reporting without Agent 365, VFAM controls, minimum group size — Steady Value evidence before buying the control plane.
agentsanalyticslicenceviva-insightsgovernance -
We’ve paid for Copilot connectors to ServiceNow and Jira — how do we prove anyone uses them?
MRC 519571 / Learn Copilot Connectors usage report: what counts as active, connector vs user tables, names hidden by default — Steady Value before renewing connector work.
copilotconnectorsanalyticsadminvalue -
Our agents need Dataverse access — do we give them a service account or an Entra agent user?
MRC 576843 / Learn Dataverse agent users (preview): Entra agent identity, security roles, audit — Steady Identity instead of over-privileged app users.
agentsdataverseidentityentrapower-platform -
Edge Watermarking is coming — does a ‘Confidential’ overlay actually stop exfiltration?
MRC 547827 / Learn Edge Watermarking: overlay tied to DLP restriction actions, not labels alone — Steady deterrence, not a substitute for Purview blocks.
edgesecuritydlppurviewwave-0 -
Facilitator will warn about meeting scams — is that the same as Teams phishing detection, and should Security rely on it?
MRC 573450 Facilitator protection skill: transcript-based scam warnings in meetings with Facilitator present — layer on process, don’t replace lobby and Defender controls.
teamsfacilitatorsecurityphishingwave-0 -
Copilot Search is coming to SharePoint and OneDrive — does that amplify oversharing before we’ve finished Wave 0?
MRC 573696 Copilot Search in SharePoint/OneDrive: NL search and summaries amplify what users can already see — Steady RCD/SAM before Preview.
sharepointonedrivecopilot-searchoversharingwave-0 -
Copilot can now cite the memories that shaped an answer — what should Privacy tell staff before we leave Memory on?
MRC 574111 Copilot Memory citations: Personalization tab under Sources — Steady privacy brief for mailbox-stored memory while Enhanced personalization stays on.
copilot-chatprivacygovernancepersonalizationwave-0 -
Teams now scores third-party apps and agents against our trust criteria — do we still need a human approval gate?
MRC 532720 Organization Evaluation Score for Apps and Agents: configure trust criteria once, score third-party apps — Steady GRC still owns allow/block.
teamsagentsgovernancesecuritywave-0 -
Teams is adding AI phishing detection for risky chats — does that replace Safe Links and Defender for Office 365?
MRC 575288 Teams phishing detection in messaging: conversation-context warnings for higher-risk external first-contact — layer on URL protection and Defender, don’t replace them.
teamssecurityphishinggovernancewave-0 -
Outlook Copilot Chat is coming to shared and delegate mailboxes — who sees what before we roll it to EAs?
MRC 573698 Outlook Copilot Chat in shared and delegate mailboxes: Full Access and folder permissions amplify grounding — Steady GRC before EA and shared-inbox roll-out.
outlookcopilot-chatshared-mailboxesgovernancewave-0 -
Purview DLP admin units are coming for Copilot and Cowork — can BU security own policies without tenant-wide rights?
MRC 575287 Purview DLP Administrative Units for Copilot, Copilot Chat and Cowork: optional AU-scoped policy management with tenant-wide policies still applying — Steady Security for multi-BU tenants.
purviewdlpadmin-unitscopilotgovernance -
SharePoint’s Agent chat web part will put any M365 Copilot agent on a modern page — how do we stop intranet sprawl?
MRC 575298 SharePoint Agent chat web part: page editors embedding M365 Copilot agents — Steady Adoption before page sprawl, with agent and knowledge-source permissions as the real control.
sharepointagentsweb-partsadoptiongovernance -
Purview network DLP via Entra GSA will cover all websites — do we finally close the ChatGPT paste gap?
Purview Network Data Security + Entra GSA: all-websites scope, unmanaged AI, licensing (E7 or Purview E5 + Internet Access), Steady Security before blanket block.
purviewdlpsecurityentrawave-0 -
Sales Development agent can write to Salesforce via MCP — do we let it qualify leads on its own?
Sales Development agent + Salesforce MCP: Rolling out October 2026, CRM writes, MCP approval, autonomous outreach limits — Steady Security before sales automation.
copilotsalesagentssalesforcewave-0 -
Work IQ will let agents upload files into SharePoint and OneDrive — how do we stop that becoming silent sprawl?
Work IQ Upload and SharePoint/OneDrive MCP file tools: 5 MB limits, user permissions, admin MCP registry and tool-level controls — Steady Security before agents write files.
work-iqagentssharepointgovernancewave-0 -
Will our old Teams-and-Copilot retention policy stop covering Copilot prompts?
Legacy Teams+Copilot retention becoming Teams-only, Microsoft Copilot Experiences location, and how to keep prompts discoverable — Steady GRC before the split lands.
copilotpurviewcompliancegovernancewave-0 -
Federated Copilot connectors can write to ServiceNow and CRM — how do we stop that becoming a free-for-all?
Federated MCP connectors: write/update/delete with user confirmation, admin enable/disable and staging — Steady Security before Copilot acts in your line-of-business apps.
copilotconnectorssecuritygovernancewave-0 -
We need Copilot proofreading in Word with Track Changes — and one shared prompt for the whole org. Is that possible?
Copilot in Word edit-by-default, reviewable changes, organisational prompts vs agents for proofreading — Steady Adoption before another shadow prompt library.
copilotwordadoptiongovernancewave-0 -
Copilot in Excel edits by default — can we make it plan first on finance workbooks?
Copilot in Excel’s edit, plan and chat modes, why there’s no per-mode admin switch, and how version history and a plan-first habit keep finance workbooks safe — Steady before scale.
copilotgovernancefinopssharepointwave-0 -
Will the Workforce Insights agent let managers ask Copilot about their staff?
Workforce Insights agent: organisational data, access policies, delegation and admin controls — decide what people data Copilot can see before managers start asking.
copilotagentsprivacygovernancewave-0 -
Will Microsoft 365 Copilot now show everyone our Dataverse and CRM data?
Dataverse data in Microsoft 365 Copilot: tenant setting, environment switches and security roles — the Steady way to open business data to Copilot.
dataversecopilotpower-platformgovernancewave-0 -
Can Teams stop a deepfake ‘CFO’ on a call before someone pays?
Teams impersonation protection and deepfake detection are coming; external access, lobby and process controls are what you have today.
securityteamsai-riskgovernancewave-0 -
Will premium models in Copilot Chat run up a bill we didn’t plan for?
Usage-billed models in the Copilot Chat model selector: spending policies, credit requests and limits — Steady Cost before anyone picks the expensive model.
finopscopilotmodelsgovernancewave-0 -
Should agents pause for a human before sending mail or closing tickets?
Per-tool human approval for agent tool calls, agent-flow multistage/AI approvals — Steady Security before autonomous side effects.
agentscopilot-studiogovernancesecuritywave-0 -
How do makers see agent credit cost before Finance sees the invoice?
Estimated credits in Preview/Evaluate/Monitor, PPAC capacity and agent limits — Steady Cost before silent test burn.
finopsagentscopilot-studiogovernancewave-0 -
Should we standardise agents with a Skills catalog — or is that more sprawl?
Agent skills vs tools/sub-agents, Skills catalog reuse and share — Steady Adoption before skill sprawl.
agentscopilot-studiogovernanceadoptionwave-0 -
Should makers clear Agent Readiness before we let them publish?
Agent Readiness Review, blocking vs warning issues, Maker guidance custom messages — Steady publish hygiene before agent scale.
agentscopilot-studiogovernanceadminwave-0 -
Should Copilot Studio agents get their own mailbox and Teams identity?
Persistent agent accounts vs Entra Agent ID, Agentic-User mode, Frontier preview — Steady Identity before AI teammates with mailboxes.
agentsidentityentracopilot-studiosecuritywave-0 -
Can Copilot Studio agents ‘self-learn’ — and who approves the changes?
Self-learning recommendations, maker-accepted refined copies, cost control — Steady Improve before unsupervised agent rewrites.
agentscopilot-studiogovernancecostwave-0 -
Can we export Agent Dashboard metrics without creating a privacy incident?
Agent Dashboard export, VFAM AgentMetricsExport / IdentifiableExport, de-identified vs named — Steady privacy before adoption CSVs.
agentsgovernanceprivacyfinopswave-0 -
Should we enrol everyone in Copilot Frontier for Excel Agent Mode?
Copilot Frontier opt-in, No access default, Agent Store (Frontier) tags, Insider vs Frontier — Steady pilot before preview sprawl.
copilotagentsgovernanceadminwave-0 -
Who should publish organisational Copilot prompts — and can we delegate?
Organisational prompts, pin/import/analytics, and delegated publishing — Steady Adoption with GRC oversight.
copilotgovernanceadminadoptionwave-0 -
How do we stop agents using the wrong MCP tools?
Agent Tools registry, BYO MCP approve/block, runtime enforcement, connectors view — Steady Security before tool sprawl.
agentsgovernancesecurityagent-365wave-0 -
Where do Copilot Pages and Notebooks live — and can we govern them?
SharePoint Embedded Loop container, Cloud Policy create/view, IB gap, leavers lifecycle — Steady Security before Pages sprawl.
copilotgovernancesecuritypurviewwave-0 -
Does Purview Copilot DLP cover Copilot Studio agents?
Copilot DLP location vs Studio agents, SharePoint knowledge label restriction, Power Platform DLP — Steady Security without false comfort.
agentssecuritypurviewcopilot-studiowave-0 -
Does turning off agent Sharing stop Agent Builder sprawl?
Sharing setting is Agent Builder only; No users blocks org-wide links, not 1:1 share; existing access stays — Steady.
agentsgovernanceagent-builderadminoversharing -
What's the difference between Available to and Deployed to?
Available to = discover/install; Installed for/Deployed to = preinstall — independent levers, Steady rollout.
agentsgovernanceadmincopilotwave-0 -
Do Copilot Studio agents always need admin approval?
Studio → Teams/Copilot hits Requests; other channels need environment strategy — Steady before catalog.
agentsgovernancecopilot-studioadminwave-0 -
Must we allow Move data across regions for Copilot Studio?
Power Platform Generative AI features, Move data across regions, UK/EU capacity, flex routing — Steady residency before scale.
governancecopilot-studiocomplianceagentswave-0 -
Why can’t Facilitator join our Teams channel meetings?
Facilitator vs channel meetings, Teams admin Allow/Block, Loop notes, roadmap 568936 — Steady meeting AI before scale.
teamsagentscopilotgovernancewave-0 -
Why do Researcher and Analyst ignore our agent settings?
Researcher and Analyst are core Copilot experiences — agent settings don’t hide them; Block is tenant-wide; Steady before scale.
agentsgovernancecopilotadminwave-0 -
Should we turn on ‘AI experiences enabled by usage-based billing’?
Discovery setting vs Cost Management access — Steady before advertising a meter.
copilotfinopsadoptiongovernancewave-0 -
Do new Copilot Studio agents get Entra Agent IDs automatically?
May 2026 automatic Entra Agent ID, no opt-out, optional migration — Steady Identity before agent scale.
agentsidentityentracopilot-studiosecuritywave-0 -
How do spending policies stop runaway Copilot Credits?
Cost Management spending policies, limits, alerts, and auto-apply — Steady Cost before metered AI discovery.
finopscopilotagentsgovernancewave-0 -
Do we need a Conditional Access policy just for Microsoft Copilot?
Copilot honors Conditional Access and MFA; Zero Trust identity baseline — Steady Security before AI-specific theatre.
copilotsecurityconditional-accessidentitywave-0 -
Should we pin agents for everyone in Microsoft Copilot?
Admin-pinned agents, three-slot limit, Microsoft vs user pins — Steady adoption without pinning theatre.
agentsadoptionadmincopilotwave-0 -
Should we let users connect their own Jira and Confluence to Copilot?
Self-serve sync connectors, seven-day admin review, staged rollout — Steady Security before personal grounding sprawl.
copilotconnectorssecuritygovernancewave-0 -
Why does Copilot Studio block Knowledge uploads with a data policy error?
Knowledge source connectors, Business vs Blocked groups, Channels download — Steady Security before maker blame.
agentsgovernancesecuritycopilot-studiowave-0 -
Should we route Copilot Studio makers out of the Default environment?
Environment routing, managed developer environments, sharing limits — Steady before Default becomes the agent landfill.
agentsgovernancecopilot-studioadminwave-0 -
How do we see which agents are reading our SharePoint sites?
Agent access insights, SAM prerequisites, RCD/RAC from the report — Steady Security before agent sprawl.
agentsoversharingsecuritysharepointwave-0 -
Why does Agents → All agents suddenly show a hundred entries?
Agent inventory, Allowed agent types, block/unblock, Available to — Steady Security before Agent Store sprawl.
agentsgovernancesecurityadminwave-0 -
Can we set monthly Copilot Credit caps per agent?
Manage Agents monthly limits, notifications, hard stop — Steady Cost before an open meter.
agentsfinopscopilot-studiogovernancewave-0 -
Does a Microsoft 365 Copilot seat cover GitHub Copilot harness agents?
GitHub harness always bills Copilot Credits; standard harness B2E inclusion; developer/trial billing from Sep 2026 — Steady Cost before harness marketing.
agentsfinopslicencecopilot-studiowave-0 -
Should we allow ChatGPT or Claude connectors into Outlook?
Third-party AI apps vs Copilot subprocessors — DSPM, Defender for Cloud Apps, Entra assignment — Steady Security before convenience connectors.
securityconnectorsgovernancecopilotwave-0 -
Should we block maker credentials on Copilot Studio agents?
Control maker credential options, end-user auth, autonomous-agent impact — Steady Security before convenient identity borrowing.
agentssecuritycopilot-studiogovernancewave-0 -
Can we run Copilot Studio agents from the default environment?
Non-default production for real agents, PAYG on production/sandbox, environment routing — Steady Licence and GRC before Default sprawl.
copilot-studioenvironmentspay-as-you-gogovernancewave-0 -
Do we need Agent 365 if we already bought Microsoft 365 Copilot?
Registry and basic lifecycle on eligible M365 plans vs Agent 365 / E7 advanced observability, tools, Purview and Defender agent controls — Steady Licence before buying the control plane twice.
agentslicencegovernancefinopsadmin -
How do we stop makers publishing anonymous Copilot Studio agents?
Block Chat without Entra authentication via data policy, plus the preview Authentication for agents control — Steady Identity before public links.
agentscopilot-studiosecuritygovernanceadmin -
Should we block Direct Line and external Copilot Studio channels by default?
Data policies for Direct Line, Facebook, WhatsApp and friends, plus preview Agent access channels — Steady GRC before the agent leaves Microsoft surfaces.
agentscopilot-studiogovernancesecurityadmin -
Should we allow Anthropic Claude models inside Copilot?
AI providers as Microsoft subprocessors, EU/UK default off, EU Data Boundary exclusion, and Data Retention model traps — Steady GRC before model shopping.
copilotgovernanceprivacyadminwave-0 -
Are Copilot Graph connectors safe to turn on?
Synced Copilot connectors, ACLs into Graph, admin enablement, and federated vs indexed trust — Steady Security before enterprise-wide grounding.
copilotsecuritygovernanceconnectorswave-0 -
Can we audit and retain Copilot prompts and responses?
DSPM for AI, unified audit, retention on Microsoft Copilot Experiences, and eDiscovery on mailbox-held AI interactions — Steady GRC before seat spray.
purviewgovernancecopilotcompliancewave-0 -
Can we block Copilot agents by default until IT approves?
Agent settings, allowed types, user access, and the requests queue — Steady GRC before the Agent Store fills itself.
agentsgovernancecopilotadminwave-0 -
What does ‘prepare our org for agents’ mean for IAM?
Agent 365 observe–govern–secure, Entra Agent ID, sponsors, Conditional Access — Steady Identity before agent scale.
agentsidentityentragovernancesecurity -
How do we stop everyone creating Copilot Studio agents?
No single off switch — licences, environments, roles, DLP, and publish controls — Steady Licence and GRC before maker spray.
agentscopilot-studiogovernancelicencepower-platform -
Do Copilot Studio credits burn when staff already have Copilot seats?
Zero-rated B2E usage vs credits for unlicensed, external, autonomous, and CUA — Steady Cost before maker freedom.
agentsfinopslicencecopilot-studio -
Can we turn off Copilot’s web search grounding?
Cloud Policy Allow web search in Copilot, user Web content toggle, what leaves the boundary — Steady GRC before convenience.
copilotsecurityprivacygovernance -
Restricted SharePoint Search is retiring — what do we do?
RSS retirement timeline, no auto-migration, RCD as the per-site successor — Steady Security before the allow-list vanishes.
oversharingsecuritycopilotsharepointwave-0 -
What do we do with dormant Copilot seats?
Enabled vs active users, usage reports, reclaim with Steady Cost — not vanity seat spray.
copilotfinopsadoptionlicence -
Can guests use our Copilot agents?
Guests and cross-tenant Copilot licensing, SharePoint agents, MTO B2B — Steady Licence before external scale.
copilotagentslicenceguestssharepoint -
Do sensitivity labels stop Copilot reading files?
Purview DLP for Copilot, labels vs SITs, citations still appear — Steady Security before scale.
copilotsecuritypurviewsensitivity-labels -
What do we do about ownerless agents?
Ownerless agents, Agent Registry, Entra sponsors — Second Law for accountability before scale.
agentsgovernancesecurityagent-registry -
Should we turn on pay-as-you-go for SharePoint agents?
PAYGO meters, security-group scoping, budgets that alert but don’t stop — Steady Cost before maker freedom.
agentsfinopspay-as-you-gosharepoint -
How much permission should an agent get?
Delegated vs app permissions, Entra Agent ID, DLP connectors — Steady before autonomy.
agentssecuritypermissions -
Who actually needs a Microsoft Copilot licence?
Chat vs Premium, eligible base licences, and Steady before seat spray — grounded in Microsoft Learn.
copilotlicencewave-0 -
Must we fix oversharing before turning on Copilot?
Amplification risk, Restricted Content Discovery, SAM and Purview — Steady before seats.
oversharingsecuritycopilotwave-0