How do we stop everyone creating Copilot Studio agents?

You’re not alone — this is the classic seat-spray hangover. Copilot licences arrive, the default environment already has Environment Maker sprawl, and suddenly “agents for everyone” means agents by everyone.

Here’s the awkward truth from Microsoft’s own Copilot Studio security FAQ: you can’t flip one tenant switch that disables agent creation. The documented guidance leans on data policies (so people can’t usefully chat with risky agents), plus the usual Power Platform controls. Creation is constrained by who can author, not by a global “Studio off” button.

What’s really going on is layered control:

• Licence / trial gates — Copilot Studio User (or Microsoft 365 Copilot where it grants authoring), and whether self-service trials are allowed.
• Environment access — security groups on environments; keep makers out of Default and Production until they earn a managed sandpit.
• Security roles — Environment Maker (and related bot author roles) on Dataverse tables for agents; assign via Entra group teams, not “everyone by accident.”
• Feature / DLP controls — tenant and environment data policies on connectors, knowledge sources, channels; options to limit publishing of generative AI agents.
• Downstream install — even if someone builds, Microsoft 365 Agent settings and the Requests queue still decide what lands in Copilot for the workforce.

Practical options:

1. Zoned makers, not tenant panic. Create a managed maker environment, security-group it, assign Environment Maker only to an approved makers group, strip Default of casual maker rights where your tenant allows, enforce DLP that blocks the connectors you don’t want in agents. Best Steady path for most organisations.
2. Licence + trial hygiene. Stop self-service Studio trials, assign Studio / authoring capacity only through Entra groups, and treat capacity packs / PAYG as a second gate (you’ve already asked about credits vs seats — keep those meters scoped).
3. Publish and share brakes. Managed Environment sharing limits, admin approval into Microsoft 365 Copilot / Teams, and Allowed agent types / User access so unapproved org agents never reach the store. Creation may still happen; blast radius shrinks.
4. Believe “disable creation” exists as one checkbox. It doesn’t — chasing it wastes a week while makers keep building.

The caution: Default environment quirks are real (admins often can’t script role cleanup the way they can elsewhere). DLP doesn’t stop creation; it constrains what an agent can touch and whether people can talk to it usefully. And locking Studio while leaving Agent Builder / SharePoint agent creation wide open only moves the sprawl.

I’d suggest a Wave 0 maker memo: who may author, which environment, which DLP profile, how publish reaches Copilot, and who owns the Requests queue. That is Steady Licence and GRC before maker freedom — Second Law territory too: if you don’t keep a register of who can create, you don’t really have control.

You’re asking the right question before the default environment becomes the agent landfill.