At CollabDays Finland 2025, Microsoft MVP Mikko Koskinen delivered a session that tackled one of the most pressing challenges in the Power Platform ecosystem: how to govern, deploy, and scale Copilot Studio agents responsibly (session slides).

With a background in enterprise architecture and hands-on experience with Copilot Studio, Mikko walked attendees through the real-world complexities of managing AI agents across environments, users, and organizational boundaries.

🧠 Understanding What “Agent” Really Means

Mikko began by clarifying a common misconception: not all agents are created equal. When someone says “I have an agent,” the first question should be:

“Where was it created, and what kind of agent is it?”

This matters because agents can live in different administrative layers—Power Platform, Microsoft 365, or even SharePoint—and each has its own governance model. Mikko emphasized the importance of knowing where to look, who owns the agent, and what permissions are required.

🔐 Access Control & Licensing

One of the key takeaways was how to control access to Copilot Studio:

  • Use security groups to define who can enter the Studio
  • Assign Copilot Studio Maker licenses automatically via group membership
  • Avoid manual license assignment—group-based access is cleaner and scalable

Mikko demonstrated how a new user, upon first accessing Copilot Studio, is automatically provisioned a development environment. This simplifies onboarding and ensures that users start in a safe, isolated space.

🧪 Development vs. Production Environments

Mikko outlined a clear environment strategy:

  • Development: For experimentation and learning
  • QA/Test: For validation and review
  • Production: For publishing agents to end users

He showed how to use environment routing, security roles, and DLP policies to ensure that agents are only published when they meet compliance standards. This includes blocking unauthenticated users and controlling external data connections.

“You don’t want users creating agents that bypass authentication. It’s possible—but it should be intentional and governed.”

📦 Deployment Pipelines & COE Integration

Mikko highlighted the importance of pipelines for moving agents from dev to production. While manual deployment is still common, pipelines offer:

  • Consistency
  • Auditability
  • Speed

He also introduced the Copilot Studio Kit, a companion to the Power Platform Center of Excellence (COE), which provides:

  • Agent inventory
  • Trigger and flow visibility
  • Admin-level insights without needing to open each agent manually

This tool helps organizations track agent usage, ownership, and configuration across tenants.

🧩 Real-World Scenarios & Lessons Learned

Throughout the session, Mikko shared practical examples:

  • How to onboard users safely
  • How to manage agent publishing rights
  • How to handle licensing and environment provisioning
  • How to prevent agents from being shared across tenants without oversight

He also addressed common pain points, like why publishing sometimes fails, and how admin approval processes can be streamlined.

“Governance isn’t just about control—it’s about enabling responsible innovation.”

Whether you’re an admin, architect, or developer, the message was clear:
Start with structure. Scale with confidence. Govern with purpose.