Should we pin agents for everyone in Microsoft Copilot?

That’s a fair adoption ask — and a governance one in disguise. Pinning is how you steer discovery; it isn’t a substitute for deploy, block, or least privilege.

Here’s what’s going on. In the Microsoft 365 admin centre (Agents → All agents → Manage pinned agents, or the pin icon on an agent’s details), AI Administrators can pin deployed agents into the Copilot Agents list for all users the agent is deployed to, or for specific users/groups. Admins get up to three organisation pin slots and can rank them (move up/down) so lower-priority pins drop off if a user already has three admin pins. End users cannot unpin Microsoft-pinned or administrator-pinned agents; they can still pin/unpin their own extras. Microsoft also pins some first-party experiences by default (those stay fixed). Propagation can take up to about six hours. You can’t pin a blocked agent — unblock and deploy first. Pinning is separate from Available to / Deployed to: pin without deploy and you get a banner telling you to deploy.

Steady before scale here is Pane 07 Cost & Value plus Security: pin what you’ve already approved, owned, and licensed — not every LOB pet project. Schofield’s Third Law (historically attributed) still whispers: the easier the agent is to reach, the more people will invoke it against whatever knowledge and tools it already has.

Options that actually work:

1. Pin at most one or two approved agents per audience. e.g. HR Q&A for everyone, Sales Coach only for Sales. Rank ruthlessly inside the three-slot budget. Best Steady adoption move.
2. Deploy broadly, pin narrowly. Keep discoverability via the store/registry; pin only the Wave 0 must-haves. Less UI clutter; still governed.
3. Pin three vanity agents for “Everyone” before inventory and owner cleanup. Guarantees visible sprawl and support tickets when an ownerless shared agent sits in the chrome.
4. Assume pinning replaces Agent access / sharing controls. It doesn’t — pin only makes a deployed agent hard to miss.

12 Panes action / comms: Tell adoption: pins are a scarce shelf — three slots, six-hour lag, users can’t remove org pins. Tell Security: only pin agents that already passed Block/Deploy review and have a living owner. Leadership: pinned ≠ safe; pinned = promoted.

Benefits / risks: Clear default path lifts intentional usage; locked pins frustrate power users, Microsoft pins consume mental space you don’t control, and ranking fights with user pins for attention. If the agent isn’t deployed to someone, they won’t see the pin anyway.

I’d suggest this week: pick the single agent you’d defend in an audit, confirm it’s deployed (not merely shared), pin it for that deployment audience, leave the other two slots empty until next review. You’ll get adoption without turning Copilot into a billboard.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer