Can we run Copilot Studio agents from the default environment?

You’re not being slow — you’re catching the classic “quick POC in Default” trap before it becomes production debt. Default feels free because every licensed user already has maker rights there. That convenience is the governance problem.

Here’s what’s going on. Microsoft’s Copilot Studio environment guidance is blunt for anything you intend to deploy seriously: use a non-default production environment for agents you want in production. The Default environment is the shared personal-productivity space — every employee is effectively a maker, isolation is weak, and chargeback for consumption is a nightmare. Power Platform pay-as-you-go links Azure subscriptions to environments via billing plans; Learn documents PAYG for production and sandbox environments. Admins and makers commonly find Default awkward or impossible to treat as a clean PAYG landing zone, which matches what you’re seeing when the billing plan won’t select it. Separate from SharePoint-agent / Copilot Chat PAYG in the Microsoft 365 admin centre, Studio capacity and meters live in the Power Platform admin centre — different console, same need for a named environment and owner.

Environment routing exists precisely so new makers land in personal developer environments instead of piling into Default. Managed environments, DLP, sharing limits, and security groups are how you govern the dedicated space once you create it.

Practical options:

1. Dedicated sandbox or production + PAYG (or prepaid credits) for the pilot. Create the environment, attach a security group, link the Azure billing plan, give makers Environment Maker / Bot Contributor only there, keep Default for light Microsoft 365 personal productivity. Best path for almost every org.
2. Developer environments via environment routing for tinkering; promote via solutions to a managed prod environment. Good ALM discipline when you already have CoE habits.
3. Stay in Default “just for the proof.” You’ll fight billing, ownership, and “who broke whose agent” forever — and migration later is worse under spotlight. I’d avoid shipping anything real from Default.

12 Panes action / comms: Tell Finance and makers the same sentence: pilots need a named environment and a billing owner before the first demo to leadership. Pane 07 Licence / Cost owns the Azure subscription link; Pane 04 Security owns DLP and who may publish channels. Don’t frame the move as red tape — frame Default as the shared kitchen where nobody owns the fire extinguisher.

Benefits / risks: Dedicated environments give FinOps a meter they can see, Security a boundary, and makers a place that won’t vanish under someone else’s DLP experiment. Default pilots that “work” often can’t be linked, costed, or locked down without a rewrite.

I’d suggest creating the dedicated environment this week, republishing the agent there, and only then inviting the wider pilot cohort. You’ll sleep better when PAYG and permissions match the environment you’re actually defending.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer