How do we see which agents are reading our SharePoint sites?

That’s a genuine concern, and you’re asking for the right artefact. An agent inventory tells you what exists; access insights tell you what is touching content.

Here’s what’s going on. In the SharePoint admin centre under Reports → Agent insights → Agent access, SharePoint admins can create an agent access insights report for the past 1, 7, 14, or 28 days. It covers registered and activated agents — SharePoint-built, declarative, custom, and more — using Microsoft 365 unified audit logs for read/search/interact signals across SharePoint and OneDrive. From the report you can review top sites by agent activity, open a site for its top 20 agents, and view distribution across site templates. You can also generate and export via SharePoint Online Management Shell (Start-SPOM365AgentAccessInsightsReport, Get- / Export-SPOM365AgentAccessInsightsReport). From the same surface you can apply Restricted Access Control or Restricted Content Discovery to hotspot sites. SharePoint Advanced Management (or Copilot licensing per Learn’s shell note) and data-collection prerequisites apply; without SAM you may need to enable audit data collection and wait ~24 hours. Data rolls off after 28 days; collection can pause if you don’t generate a report at least once in three months.

This is Second Law for governance evidence: a single chat anecdote isn’t a register. Steady before scale puts Pane 04 Security on a recurring report before leadership asks “who read Finance?” under spotlight.

Options that actually work:

1. Weekly 28-day report + hotspot list. Create/run Agent access, export, tag sites that need RCD or RAC, assign owners. Best Wave 0 habit.
2. Pair with DAG / oversharing reports. Use agent access for who touched, Data Access Governance for why the ACL is wide. Complementary, not duplicates.
3. Rely only on M365 admin centre agent inventory. Useful for Block/Deploy; weak on SharePoint content paths. Don’t stop there if Security asked for access evidence.
4. Enable collection once and forget. Reports go stale; collection may pause. Put a calendar reminder.

12 Panes action / comms: One slide for the AI board: top sites by unique agents, actions taken (RCD/RAC), next review date. Message to site owners: visibility of agent traffic is how we keep Copilot useful without amplifying overshare.

Benefits / risks: Evidence-based RCD beats panic freezes; audit-based reports may miss some events, large tenants can take up to 48 hours, and only one report per duration window exists at a time — download before regenerating. Policy status on an old report doesn’t refresh after you apply RCD — check Active sites.

I’d suggest this sprint: confirm SAM/Copilot prerequisites, run a 28-day Agent access report, export it, and apply RCD only to named high-risk sites with owners and exit dates. You’ll sleep better when “which agents?” has a spreadsheet answer.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer