Can we export Agent Dashboard metrics without creating a privacy incident?

You’re right to slow this down. “Just export the agent usage CSV for the steering pack” is how personal data quietly leaves the dashboard and lands in an unmanaged SharePoint folder.

Here’s what’s going on. In Viva Insights → Agent Dashboard, with the All agents toggle on (Agent 365 view), eligible users can Export data as a point-in-time .zip of CSVs — day-level (up to ~28 days) or week-level (up to ~six months) — covering agent metadata and person–agent activity metrics. Prerequisites are real: typically ≥50 Microsoft Copilot licences, ≥ one Agent 365 licence, and ≥ one active agent, plus global dashboard access (senior leaders and delegates, Global Viva Insights Analysts, Microsoft 365 Global Admins, Viva Insights AI Admins). Team-level manager views cannot export. Two VFAM controls in Microsoft 365 admin centre (Settings → Viva → Feature access management) matter: AgentMetricsExport (export on/off — on by default for eligible tenants/users) and IdentifiableExport (off by default). De-identified exports use protected person IDs plus PeopleMetadata organisational attributes; identifiable exports can include UPN and Microsoft Entra ID when an admin explicitly enables identification for approved roles. Identification is a separate Copilot Analytics capability for known-user outputs and is only for Global/AI Admins to policy. Exclusion policies still apply — excluded agents or users won’t appear. Don’t join Agent Dashboard Agent IDs to Microsoft 365 admin centre inventory IDs as if they were the same key; Learn says the identifier systems often differ.

Steady before scale puts Pane 05 GRC ahead of Pane 07 vanity adoption charts. Schofield’s First Law (historically attributed): don’t put named usage into a spreadsheet unless you can see how it comes back under retention, access control, and purpose limitation.

Options that actually work:

1. Keep identifiable export off; use de-identified week-level exports for steering. Pair with org attributes (Organisation / FunctionType) for cohort stories without naming individuals. Best Steady default.
2. Enable IdentifiableExport for a tiny Entra group (e.g. Copilot programme office + Privacy) with a written purpose, retention, and “no forward to managers” rule. Good when you truly need champions lists or targeted training.
3. Turn export on for every dashboard delegate “for transparency.” Delegates of global-access users inherit export unless VFAM blocks them — that’s a privacy design decision, not a free lunch.
4. Assume admin-centre agent usage reports already give named user–agent pairs for every publisher. They don’t cover the same surfaces; use the right report for the question and don’t invent joins.

12 Panes action / comms: Tell Privacy: IdentifiableExport is off by default — leave it there until there’s a DPIA-style note. Tell AI Admins: VFAM is the gate; allow up to 24 hours for policy changes. Leadership: De-identified trends answer most board questions; named lists need a reason.

Benefits / risks: Exports unlock portfolio and FinOps storytelling; preview features change; exports can take up to ~30 minutes and may lag the live dashboard; identifiable columns are personal data under UK GDPR-minded programmes. Product names and eligibility thresholds will keep moving — verify Learn for your tenant.

I’d suggest this week: confirm AgentMetricsExport scope, leave IdentifiableExport off (or pilot one privacy-approved group), document where CSVs may live, and put week-level de-identified export on the FinOps/Adoption monthly. You’ll have evidence without a privacy incident dressed as a Power BI win.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer