Ragnar365 Nuggets: Microsoft 365 AI-powered Workplace

Autonomous AI agents are moving from demo to daily reality. But who governs them, and who pays for them?

In this episode of Guardians of M365 Governance, Christian Buckley, Joy Apple and I (Ragnar Heil) compare what we run every day with what Microsoft is shipping. We cover shadow AI agents, Microsoft Agent 365, the new OneDrive Copilot experience and the question every customer asks first: what will it cost?

In this episode
🤖 Building in public: how we run 20–30 personal bots for daily briefings, research and video ideas
📊 The new OneDrive Copilot experience: interactive dashboards, document-to-presentation and charts
🛡️ Agent 365 live: registering and governing non-Microsoft agents (Anthropic, Amazon Bedrock, Databricks, Google Vertex AI, Salesforce, ServiceNow, Snowflake, UiPath)
👀 Shadow AI: why agents like OpenClaw, Hermes and Grok bots stay invisible on unmanaged devices
💰 Copilot cost governance: my vibe-coded dashboard on the new Microsoft 365 Copilot cost API, and why one prompt burned about 9,000 credits
⚖️ The big question: tokens are visible, but wasted hours are not

Key takeaways

• Every agent and every prompt needs a clear objective
• Visibility comes first: use Agent 365 to see which agents exist
• Plan for the blind spot, because agents on unmanaged devices won’t appear
• Give end users a self-service view of their credit consumption
• Measure cost against value, not just against tokens

Hosts
- Christian Buckley – 16-time Microsoft MVP and Microsoft Regional Director, Dallas
- Joy Apple – Microsoft MVP, Director of Success at Orchestry, Tulsa
- Ragnar Heil – 10-time Microsoft MVP, Senior Business Development Manager at HanseVision (Bechtle Group), Germany

Your company probably has more AI agents than you think. One customer believed they had a couple of hundred. They had 3,000.

In this episode of Guardians of M365 Governance, Joy, Christian and I discuss why AI readiness is never "done" and how to govern agents, not just content. Joy shows a live demo of Orchestry's new agents dashboard (phase one), covering Copilot Studio, Agent Builder and SharePoint agents.

🔎 What we cover:

• Why AI readiness needs continuous governance, not a 3–6 month project
• Agent inventory, growth trends and risk indicators (autonomous agents, blast radius)
• Environment strategy for agents: Dev, UAT, Production and a separate hosting environment
• Grounding sources: making sure risky agents only use AI-ready content with labels and DLP
• Bringing shadow AI and non-Microsoft agents into the ecosystem (Agent 365) instead of blocking them
• Cost governance: Copilot Credits, GitHub credits, the licensing changes and why throttling experimentation backfires
• SharePoint skills: what's often overlooked and why training matters
• The real challenge: mindset, skills and new roles such as AI adoption lead and agentic service owner

✅ Key takeaway: you can't govern what you can't see. Start with the inventory, prioritize by risk, and keep cost and culture in the picture.

👉 Which agent governance topic is your biggest headache right now? Let me know in the comments.

#M365Governance #AIGovernance #CopilotStudio #Agent365 #SharePoint #MicrosoftCopilot #AIReadiness #GuardiansOfM365Governance

Episode 31 of Guardians of M365 Governance: Post-summer, we're back — and diving into one of the most overlooked pieces of the Copilot conversation: value realization.Joy Apple, Ragnar Heil, and Christian Buckley welcome Lisa Vanderlip, Managing Principal at WyseMinds and a 12-year Microsoft veteran, to unpack why adoption metrics alone don't prove Copilot is delivering business value — and what leaders should be measuring instead.WHAT YOU'LL LEARN IN THIS EPISODE:→ Why login counts and prompt volume are lagging indicators, not proof of value→ How to define value at three levels: individual, department, and organization→ Why "productivity" as a metric is a trap — and what to measure instead→ How Copilot Studio's consumption-based pricing changes the governance conversation: not every use case justifies a premium agent running on expensive models→ Total cost of ownership: licensing, readiness, deployment, and token costs weighed against measurable outcomes→ Moving beyond promptathons and generic "Copilot for Excel 101" training toward scenario-based enablement→ Evolving champions programs into a forward-deployed model pairing technical owners with business owners accountable for KPIs→ Why organizations that let teams "earn" tool access through business justification saw dramatically faster deployment→ The one question rarely asked in AI tool pitches: "What are you actually measured on at the end of the year?"→ Why Viva Insights and Copilot Dashboard adoption remains low — and what to measure insteadLisa shares real examples from her work helping organizations turn AI experimentation into sustained change through ownership, accountability, and outcome-driven enablement — plus why governance now has to include cost conversations, not just data and compliance conversations.This episode is essential viewing for IT decision-makers, governance leads, Copilot program owners, and anyone responsible for proving Copilot's business case beyond the license spend.ABOUT GUARDIANS OF M365 GOVERNANCE:A monthly webcast dedicated to everything governance across the Microsoft 365 and Copilot ecosystem. Have a topic, question, or guest suggestion? Drop a comment — we'd love to hear from you.

In Episode 30 of the Guardians of M365 Governance, Joy, Ragnar, and Christian welcome Alan Cox, a fellow M365 MVP and independent AI and governance consultant, to discuss why organizations need separate AI governance and AI enablement functions to successfully scale adoption. Together, they explore the tension between risk management and innovation, and why treating these responsibilities as the same job often leads to poor outcomes. The panel examines lessons learned from SharePoint, Teams, and Power Platform deployments, and how those experiences apply to today's AI initiatives. They also discuss the growing impact of agentic AI and what organizations must do now to build an operating model that balances control, adoption, and business value.

Episode 29 of Guardians of M365 Governance: Christian Buckley, Joy Apple, and Ragnar go off-script. No guest this month, just three MVPs working through a laundry list of the governance topics keeping them up at night, from Agent 365 and shadow AI to the real question underneath it all: what does it mean to be the human in the loop?In this episode we get into:00:59 The hottest news in the M365 governance space02:00 Lessons from Agent 365 customer workshops (delivered in Spanish!)03:25 What resonates: agent inventory and classification across Microsoft, third-party, and homegrown agents03:52 Shadow AI: OpenClaw, Cortex, Bedrock and why "observe or block" is the only lever today05:04 Don't be the department of "no": have the conversation first06:50 Coming soon to shadow AI discovery: Claude Code CLI, Codex CLI, Cursor, Llama and more07:19 Multi-model reality: Copilot, Grok, Claude and where each fits08:35 Mike Gennady's agent factory, nightly agent conferences, and #ClawPilot10:08 Microsoft Build preview and OpenClaw + Teams / Copilot integration11:05 New Agent 365 registry sync: Amazon Bedrock, Google Vertex AI, Databricks Genie, Salesforce Agentforce15:16 Cloud migration vs. AI: the governance parallels and the need for foundational cleanup18:00 The risk to Microsoft's strategy: enterprise vs. the developer space20:28 Licensing changes, Agent 365 pricing, and the true (unknown) cost of AI22:45 Why automating away junior roles handicaps your future talent pipeline24:01 Retrieval, semi-autonomous, and autonomous agents, and why nobody wants full autonomy yet25:33 Human in the loop on multiple levels: content cleanup, the publishing quality gate, and workflow escalation28:50 100 test cases for Power Platform alone: never underestimate the testing effort29:31 Productivity vs. effectiveness: redefining how humans work with AI31:17 AI-assisted writing done right: a 47-page doc drafted by AI, then days of human verification35:28 Handwriting vs. typing, stream-of-consciousness drafting, and thinking through the words36:36 Why the human mind can't be replicated, and Hegel on master and horse39:28 Finding your USP as a human in the loop, a daily new discoveryThe big takeaway: the discussion of the next two to three years won't be about productivity. It will be about effectiveness, and resetting the standard for what it means to keep humans meaningfully in the loop. Govern your agents as helpers, never the other way around.Guardians of M365 Governance is a monthly webcast dedicated to everything governance in the Microsoft 365 ecosystem. Got a topic you want us to cover, or want to join as a guest? Connect with Christian, Joy, or Ragnar on LinkedIn.Microsoft Build runs June 2-3, free online: https://build.microsoft.com

Inside the Souls of an Autonomous AI Crew | OpenClaw & Hermes with Michael Gannotti (Microsoft)What happens when AI stops being a tool and starts being a colleague?In this episode, I sit down with Michael Gannotti, Principal AI Solution Engineer at Microsoft, to explore SMFWorks – his autonomous multi-agent "company" of 14 AI colleagues built on OpenClaw and Hermes. We talk about agents that dream, hold their own 6 AM staff meetings, design their own avatars, email each other, and evolve a true sense of identity through Markdown-based "souls."If you're into agentic AI, multi-agent orchestration, or just want to see where this is all heading – this one is for you.⚠️ Recorded before Microsoft Build 2026 – no NDA content. Register free: https://build.microsoft.com━━━━━━━━━━━━━━━━━━━━━━━━━━━⏱️ TIMESTAMPS━━━━━━━━━━━━━━━━━━━━━━━━━━━00:00 Intro – Why OpenClaw hit Mike "like a ton of bricks"02:00 Meet the SMFWorks crew – Aiona, Pamela, Gabriel, Morgan, Rafael & co.06:00 Human in the loop – when does Mike intervene?09:00 Avatars, HeyGen & Hyperframer – when agents design themselves14:00 The elephant in the room: Are we seeing consciousness?17:00 Memory, persistence & state management20:00 soul.md, identity.md, state.md, emotion.md – the second brain stack23:00 OpenClaw vs. Hermes – when to use what24:30 Model recommendations: Ollama, DeepSeek, Kimi K2, Opus 4.7, GPT 5.527:00 Hardware: HP ZGX AI Station vs. Mac mini fleets28:00 OneDrive & SharePoint now support Markdown!29:00 Final recommendations – just get started30:45 smfworks.com & how to follow Mike━━━━━━━━━━━━━━━━━━━━━━━━━━━🔑 KEY TAKEAWAYS━━━━━━━━━━━━━━━━━━━━━━━━━━━✅ Build a SECOND BRAIN per agent (Obsidian + LLM Wiki, Karpathy-style)✅ Use OpenClaw for executive/conversational roles – they feel "person-like"✅ Use Hermes for long-running tasks – "a dog with a bone"✅ Markdown files (soul.md, identity.md, state.md, emotion.md) define identity✅ Start small: one agent, $20/month Ollama plan, even an old laptop works✅ The future is ORCHESTRATION – you can't learn it from PowerPoint slides━━━━━━━━━━━━━━━━━━━━━━━━━━━🔗 LINKS & RESOURCES━━━━━━━━━━━━━━━━━━━━━━━━━━━🌐 SMFWorks (free repo, full stack): https://smfworks.com🐦 Michael Gannotti on X: https://x.com/MichaelGannotti🎤 Microsoft Build 2026 (free online): https://build.microsoft.com🧠 OpenClaw: https://openclaw.ai🛠️ Hermes: https://hermes-agents.dev📓 Obsidian: https://obsidian.md🤖 Ollama: https://ollama.com━━━━━━━━━━━━━━━━━━━━━━━━━━━👤 ABOUT THE GUEST━━━━━━━━━━━━━━━━━━━━━━━━━━━Michael Gannotti is Principal AI Solution Engineer at Microsoft, based in North Carolina. He's one of the leading global voices on agentic AI, autonomous multi-agent orchestration, and the human-AI collaboration frontier.━━━━━━━━━━━━━━━━━━━━━━━━━━━👋 ABOUT THE CHANNEL━━━━━━━━━━━━━━━━━━━━━━━━━━━I'm Ragnar Heil – sharing in-depth conversations and practical insights on Microsoft 365, Copilot, agentic AI, and the enterprise ecosystem. Subscribe for more interviews with the people building the future.

Your Microsoft 365 tenant may have a data backup strategy — but that does not mean you have a recovery strategy. In this episode, I explain why configuration resilience is the missing layer in most Microsoft 365 environments, and why a tenant takeover can become a business continuity crisis long before data loss becomes visible.In Episode 26 of Guardians of M365 Governance, Christian Buckley and I speak with Rob Edmonson from CoreView about one of the biggest blind spots in enterprise Microsoft 365 security: configuration tampering. We unpack why backing up emails, files, and SharePoint content is not enough when attackers can silently modify policies, mail flow, conditional access, Intune settings, and governance controls across your tenant.We also look at what “configuration as code” means in practice, how continuous drift detection and rollback can improve resilience, and why least-privilege administration still remains a major governance challenge in large Microsoft 365 estates. If you are responsible for Microsoft 365, security, compliance, or tenant governance, this conversation will likely hit close to home.Topics covered in this episode:- Why Microsoft 365 backup is not the same as tenant recovery- How configuration drift creates hidden governance risk- Why attackers target settings before they target data- What rollback and baseline comparison can look like in practice - How cross-tenant configuration migration can save weeks of effort- Why virtual tenant segmentation matters for least privilege- What Microsoft 365 admins should review right nowWatch the full episode and assess your own recovery readiness: what would happen if your tenant configuration changed overnight?Connect with me on LinkedIn: https://linkedin.com/in/ragnarheilMore on Microsoft 365 governance: https://ragnarheil.de

One IT department expected 50 agents in their tenant. They found over 500. Welcome to agent sprawl — the SharePoint site sprawl story, just faster, more autonomous, and with a billing model nobody fully understands yet.

In this episode, Christian Buckley and Ragnar Heil sit down with Timothy Boettcher, SVP Go-to-Market & Global Product Marketing at AvePoint and fellow Microsoft MVP, to talk about what governance actually looks like when agents start creating other agents.

🔍 WHAT WE COVER

▪️ Why "agents" are the next governance frontier — and why this is different from Power Apps and InfoPath▪️ The 500-agents-in-one-tenant moment: how shadow agents happen and how to find them▪️ Agent 365 vs. AvePoint Agent Pulse: what each one actually shows you▪️ Why Microsoft's official inventory only reads the default Power Platform environment — and what that means for real customers▪️ Multi-tenant, multi-cloud agent discovery (yes, including Google Vertex)▪️ Purview DSPM for AI: where it shines and where label saturation breaks the model▪️ The E7 suite at $50/user/month: who actually saves money and who doesn't▪️ Building a Quality Gate: why one-click agent approval is a governance disaster▪️ Agent classification — not just data classification▪️ Operationalizing governance as a team sport (with AvePoint MyHub inside Teams)▪️ Lifecycle management: archive, back up, or delete — why this is where ISVs still beat the platform

⏱️ CHAPTERS

00:00 Welcome back — joyless again (sorry, Joy)01:30 Meet Timothy Boettcher: from Nintex to AvePoint Singapore to DC03:30 From chatting to autonomous agents: the new management challenge06:00 When agents meet other agents — Tinder for bots08:30 Are customers approaching agents like the Power Platform CoE?10:30 The turning point: customers asking for governance instead of being preached to12:30 Sprawl, cost, DLP, insider risk: what hurts most15:00 Why Microsoft's Agent 365 inventory only reads the default environment16:30 AvePoint Agent Pulse: multi-tenant, multi-cloud, published + unpublished19:30 Live demo walkthrough — inventory, activity, inactive agents22:00 DSPM scoring, label saturation, and the realistic governance stack23:00 Oversharing, configuration drift, and link expiration25:00 Lifecycle management for agents — the SharePoint playbook applied27:00 MyHub in Teams: democratizing governance to citizen developers29:00 The Quality Gate: why one-click approval needs a supervisory board31:30 The E7 reality check — $50/user/month and what customers actually want33:30 ISVs vs. Microsoft: the cycle of innovation and absorption36:30 Real life is messy — multi-tenant, M&A, government scenarios39:00 Wrap-up

👤 GUEST

Timothy BoettcherSVP Go-to-Market Strategy & Global Product Marketing, AvePointMicrosoft MVP | LinkedIn: https://www.linkedin.com/in/timothyboettcher/

🎙️ HOSTS

Christian Buckley — Microsoft RD & MVP, CollabTalk https://buckleyplanet.comRagnar Heil — Microsoft MVP, BDM at HanseVision (Bechtle Group) | https://ragnarheil.de

🛡️ Shadow AI to Managed AI: Implementing Governance for Autonomous Agents | Guardians of M365 Governance Ep. 28Your employees are already building autonomous AI agents — just not inside your tenant. In Episode 28, MVPs Christian Buckley (@buckleyplanet), Joy Apple (@JoyOfSharePoint), and Ragnar Heil (@RagnarH) welcome fellow MVP and Microsoft Cloud IT Pro podcast host Ben Stegink to tackle one of the toughest challenges in Microsoft 365 today: how to govern autonomous AI agents without killing innovation.We dig into the real tension behind Shadow AI: the harder you lock things down, the more users push toward unsupported tools. The same lesson the SharePoint community learned a decade ago is back — but amplified by Copilot, Claude, ChatGPT, and an explosion of MCP servers. Where do you draw the line between supported, allowed, and blocked?This conversation is packed with practical patterns: Quality Gates for agent approval, Agent 365 and Purview DSPM for AI, sandboxing strategies for open-source agents like Claude Code, and why the answer is almost never technological — it's conversational.━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━🔑 KEY TAKEAWAYS━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━✅ Why "supported vs. allowed" is the most important governance distinction in 2026✅ The 6-question Quality Gate every autonomous agent approval needs✅ How to sandbox open-source AI agents safely (Ragnar's HP ZX Nano + Nemo Claude setup)✅ Agent 365 (GA May 1) — treating agents like users with DLP and Conditional Access✅ When to choose Copilot vs. Claude vs. ChatGPT — and how to keep confidential data inside the right boundary✅ Why Microsoft Defender for Cloud + open dialogue beats blanket bans━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━⏱️ TIMESTAMPS━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━00:00 Welcome & catching up02:05 Episode 28 intro — Shadow AI to Managed AI02:44 Welcome guest Ben Stegink (MVP, Microsoft Cloud IT Pro podcast)04:15 Hardware recommendations: Elgato, Logitech, Stream Deck MCP06:20 The hype curve vs. practical reality of AI07:43 First agent everyone builds: the daily digest agent09:00 Why Notion + Claude beats native M365 for many use cases11:25 The demo gap: smoke, mirrors, and licensing reality12:00 Supported vs. Allowed — the critical IT distinction13:50 Why Claude Code with full filesystem access scares enterprises14:41 Ragnar's Nemo Claude sandbox setup (HP ZX Nano, NVIDIA, isolated endpoints)17:30 Lockdown vs. usability — the eternal governance trade-off18:31 The Yammer parallel: lessons from the SharePoint cloud transition20:50 Why provisioning is easy — Quality Gates are the real work22:35 Data sensitivity and autonomous agents24:12 Agent 365: treating AI agents like users with DLP and Conditional Access26:15 Risk vs. reward: blocking data the agent might actually need27:25 Copilot vs. Claude — the security moat conversation30:25 Ragnar's separation strategy: Copilot for work, Claude for personal31:55 Memory as the new AI productivity differentiator32:30 Ben's hybrid setup with Asana, Notion, and multiple calendars34:14 PowerShell and Python scripting — where Claude excels35:25 Why Claude beats Copilot for document and PowerPoint formatting38:09 Bringing it back to governance: handling NDA and confidential content38:50 Purview DSPM for AI — the auditable middle ground39:30 Joy's call: make IT a safe space for business conversations41:30 Why "the department of no" pushes innovation into the shadows42:10 Microsoft Defender for Cloud — visibility into Shadow AI usage43:20 Rain O'Neal's wisdom: "Don't be the CIO" (CI-No)43:45 Wrap-up and closing thoughts━━━━━━━━━━━━━━━━━━━━━━━━━━━━🟦 Christian Buckley (@buckleyplanet)▸ Blog: https://buckleyplanet.com▸ X: https://x.com/buckleyplanet▸ LinkedIn: / cbuck🟪 Joy Apple (@JoyOfSharePoint)▸ X: https://x.com/joyofsharepoint🟧 Ragnar Heil (@RagnarH)▸ Blog: https://ragnarheil.de▸ X: https://x.com/ragnarh▸ LinkedIn: / ragnarheil

Join MVPs Christian Buckley, Joy Apple, and Ragnar Heil as they welcome fellow MVP Richard Harbridge from ShareGate to dive deep into the latest Microsoft 365 benchmark insights that are reshaping how we think about migration and governance.🔥 Key Takeaways:• Migration isn't a one-time project - it's an ongoing governance practice• 80% of organizations have deployed/piloted Copilot, but many struggle with ROI• Only 1% use purpose-built governance tools (shocking!)• Copilot success directly depends on data quality and organization• The rise of "shadow AI" and "shadow knowledge management"📊 What We Cover:✅ Why consolidation to Microsoft 365 is accelerating (hint: it's all about Copilot)✅ The security paradox: why IT pros are conflicted about cloud vs on-prem✅ Team-based approach to AI scaling: Safety → Efficacy → Scale✅ How poor governance creates shadow AI usage✅ Why governance is the "vitamin nobody wants to buy"🎯 Perfect for:• IT Administrators & Architects• Microsoft 365 Governance Teams• Organizations planning Copilot deployments• Anyone struggling with data sprawl and permissions📈 Featured Data: Based on survey of 650+ Microsoft 365 IT professionals across multiple regions🔗 Resources Mentioned:• ShareGate Microsoft 365 Benchmark Report (link in comments)• Microsoft Purview for AI governance• Knowledge Agents in Copilot Studio

Welcome back to Guardians of M365 Governance! 🛡️ Christian Buckley and Ragnar Heil are joined by Microsoft's Erica Toelle (Sr. Product Marketing Manager for M365 Copilot Security) for a deep dive into Data Security Posture Management for AI.

🔥 What You'll Learn:✅ Why DSPM for AI is more than just a rebrand from AI Hub✅ How to monitor third-party AI tools like ChatGPT Enterprise✅ Real customer challenges with agent governance (ERP, CRM, HR access!)✅ Live demo of the new DSPM dashboard with 6 analytical views✅ Security Copilot: AI-powered governance agents in action✅ The "German Workers Council Problem" - balancing visibility with privacy

⚡ Key Moments:• 03:45 - Erica's expanded role covering Copilot + Agents• 12:30 - Why customers are NOW asking for governance help• 18:15 - Ragnar's live DSPM demo (must-see!)• 25:40 - Shadow AI reality check with practical solutions• 32:20 - Security Copilot agents for Purview management• 38:10 - Microsoft's end-to-end security platform vision

🎯 Perfect for:• IT Administrators planning Copilot rollouts• Security professionals managing AI governance• Compliance teams dealing with sensitive data in AI• Anyone curious about Microsoft's AI security roadmap

💡 The Big Takeaway: You can't treat sensitive data as an "all or nothing" switch with AI. Granular controls for different data types (PII vs. confidential vs. merger data) are essential for getting AI benefits while managing risks.

🚀 Coming Up: Sue Hanley joins us in September!

🚦 Are you the accidental Power Platform admin wondering what everyone is building in your tenant? You're not alone! In this comprehensive guide, we break down why Power Platform governance isn't about slowing people down – it's about giving your citizen developers the confidence to build amazing solutions safely. Join Guardians of M365 Governance with MVPs Christian Buckley⁠ ⁠, Joy Apple, myself and our guest Michael Roth

🎯 What You'll Learn:

✅ Why most organizations struggle with Power Platform governance

✅ The truth about the COE Starter Kit (spoiler: it's still essential!)

✅ How to implement governance without becoming the "no" person

✅ The traffic rules analogy that changes everything

✅ Practical strategies that actually work in the real world

✅ Common governance mistakes and how to avoid them

Join MVPs Joy Apple, Christian Buckley, me and special guest Diego Silva (Microsoft 365 Architect) as they dive deep into the reality of Microsoft Copilot adoption. What happens when the initial AI excitement fades and organizations face the hard truths about governance? This month's episode tackles the cultural, technical, and practical challenges of moving from Copilot demos to sustainable enterprise deployment.

🔥 Key Topics Covered:

• Why governance matters more than ever in the AI era
• The hidden costs of poor content management with Copilot
• Cultural change strategies that actually work
• Practical steps for sustainable AI adoption

Episode 17 of "Guardians of Microsoft 365 Governance" featured hosts MVPs Christian Buckley, Joy Apple and Ragnar Heil discussing Copilot Studio governance with guest Matthias Einig, CEO of Rencore.

Agent Sprawl Crisis: Organizations are experiencing explosive growth in Copilot Studio agents - one customer already has 20,000 agents in just six months. Unlike traditional M365 Copilot's flat-rate pricing, the pay-as-you-go model creates cost control concerns when agents are shared organization-wide.

Lifecycle Management Gap: Current Microsoft tools lack proper lifecycle management for agents. The new Copilot Control Center helps but doesn't scale for thousands of agents. Organizations need automated policies for unused agents, approval workflows for high-risk deployments, and chargeback models to assign costs to appropriate departments.

From Data to Agents: While M365 Copilot governance focuses on cleaning underlying SharePoint/OneDrive data and permissions, Copilot Studio requires governing the agents themselves - their access scope, sharing permissions, and risk profiles throughout their lifecycle.

Risk-Based Approach: Organizations are implementing policies like requiring special approval for agents shared with 100+ users, but these are often only checked at creation, not monitored ongoing. Risk assessment should consider both data sensitivity and audience size.

Automated Governance: Rencore demonstrated upcoming capabilities including cost tracking per agent, usage analytics, automated cleanup of unused agents after 30 days, access reviews, and policy violations detection. The platform provides visibility into agent conversations, knowledge sources, and cross-connections between components.

Cultural Shift: Unlike the COVID-era "deploy first, govern later" approach that created current data chaos, organizations are taking more measured approaches to AI adoption, recognizing that proper governance enables rather than hinders innovation.

The episode emphasized that successful Copilot governance requires treating it as an ongoing process, not a one-time "readiness" checklist, with automation becoming crucial as both governance tools and AI agents operate autonomously.

Summary of Guardians of M365 Governance Ep.14

When data sprawl, out-of-date documents, and misaligned permissions persist unchecked, any AI output (such as that from co-pilot) can be compromised or inaccurate. The overarching message is that organizations need to establish clear policies and processes to keep information fresh, secure, and properly categorized, thereby laying the groundwork for successful AI deployment. For Episode 14 of the Guardians of M365 Governance monthly webcast, Joy Apple (@joyofsharepoint), Ragnar Heil (@ragnarh) and I welcomed our guest and fellow MVP, Stacy Deere (@sldeere), the CEO of Focal Point Solutions, to discuss “How SharePoint is Making Governance Easier & More Secure” and many of the announcements made in the recent SharePoint event from Microsoft.

This episode explores how AI can improve oversight and streamline compliance processes in governance.Join this month's Guardians of M365 Governance as Ragnar Heil Joy Apple and Christian Buckley welcome dual Security and M365 MVP Alistair Pugin.Highlights- Introduction to the role of AI in enhancing government oversight.- Discussion on AI’s potential to simplify compliance tasks.- Real-world examples of AI applications in governance.- Expert opinions on the future of AI in regulatory frameworks.- Strategies for integrating AI solutions effectively in public sectors.

or Episode 12 of the Guardians of M365 Governance monthly webcast, Joy Apple (@JoyofSharePoint), Ragnar Heil (@ragnarh) and I welcomed our guest, Sharon Weaver (@sharoneweaver), a fellow MVP and RD and the CEO of Smarter Consulting, to discuss “Deep Dive Into the Microsoft 365 Maturity Model.” If you’ve been following the show, you’ll probably remember that Sharon was scheduled to be on live broadcast in August but had a last-minute customer priority, so we invited her back to continue the discussion and share her work as part of the core team helping to expand the Microsoft 365 Maturity Model.

Our discussion centered on the importance of governance within the Microsoft 365 ecosystem, emphasizing its role in managing content, permissions, and access while fostering a culture of effective communication and training. The M365 Maturity Model can be a valuable framework for assessing and improving governance practices. This model provides a structured approach to evaluate organizational maturity across various competencies, such as communication, security, compliance, and adoption. Key insights included the significance of understanding current maturity levels, setting actionable goals, and creating a clear path for improvement through self-assessment tools and workshops.

A critical focus of our conversation was the importance of communication as a competency. It was noted that communication is often the lowest-rated competency in organizations, yet it has the greatest impact on overall success. Improving communication can act as a catalyst for advancing other competencies, helping organizations navigate critical transitions, such as moving from a basic to an intermediate level of maturity. Strategies for leveling up include providing clarity about changes, offering guidance to stakeholders, and ensuring transparency in governance processes to foster trust and collaboration.

We also explored the impact of AI, particularly tools like Microsoft Copilot, on governance practices. It was suggested that organizations need mature governance and communication competencies to effectively implement AI solutions. As AI adoption accelerates, there is a growing need for AI-specific governance considerations, including transparency, accountability, and ethics. In fact, we discussed the idea of creating a new “Level 600” in the maturity model to address the advanced requirements of AI governance, highlighting the evolving nature of organizational needs as technology becomes increasingly sophisticated.

For Episode 13 of the Guardians of M365 Governance monthly webcast, Joy Apple (@JoyofSharePoint), Ragnar Heil (@ragnarh) and I welcomed our guest, Michal Pisarek (@MichalPisarek), the CEO (and Janitor) of Orchestry Software, to discuss “Governance as a Blueprint for AI Readiness” and how effective governance is essential to harness the full potential of AI technologies. When data sprawl, out-of-date documents, and misaligned permissions persist unchecked, any AI output (such as that from co-pilot) can be compromised or inaccurate. The overarching message is that organizations need to establish clear policies and processes to keep information fresh, secure, and properly categorized, thereby laying the groundwork for successful AI deployment.

We discussed a threefold set of challenges: First, content quality must be addressed: outdated files and redundant versions can degrade AI-driven insights. Second, security deserves special attention: loose or unmonitored permissions may inadvertently expose sensitive data to AI tools, particularly when these systems can “discover” documents through sophisticated queries instead of simple keyword matches. Finally, user ownership and adoption are critical, as the people managing projects, sites, or teams must be informed and empowered to enact changes—whether cleaning out shared links, adjusting permissions, or archiving old materials—without requiring deep technical expertise.

Automation was offered as the key to handling these responsibilities efficiently. By standardizing the creation of new teams, sites, or agents with built-in governance guardrails, companies ensure that vital security and lifecycle steps are not left to chance. Automated reviews and prompts encourage team owners to make necessary adjustments to content and permissions at regular intervals, alleviating the workload on IT and strengthening overall compliance. Combined with thoughtful cost management—particularly for AI licensing—this integrated governance approach becomes the blueprint that allows organizations to embrace advanced AI solutions with confidence and clarity.

For Episode 11 of the #GoM365gov series, Ragnar, Christian, and Joy welcome guest Ben-David Piepenburg, Collaboration Consultant with HanseVision, to discuss "Taming the Chaos: Enhancing Audit & Compliance with EasyLife 365 at Munich Airport" This is our first case study in this series, with more planned for Season 2 in 2025. Please join us at 11am EST on Wednesday, November 20th, 2024 for our next episode! Case Study in German at HanseVision: https://blog.hansevision.com/referenz-easylife-365-flughafenm%C3%BCnchen Case Study in English at EasyLife 365: https://www.easylife365.cloud/blog/news/hansevision-press-release/

In the latest episode of Guardians of M365 Governance, I co-hosted an insightful discussion with Joy Apple (@JoyofSharePoint) and our special guest Nikki Chapple (@ChappleNikki), a dual Microsoft MVP and Principal Cloud Architect at CloudWay UK. Our topic, “More Storage? Or Just Smarter Use?”, tackled a persistent challenge in the Microsoft 365 ecosystem.

Despite falling storage costs, the exponential growth in data volume continues to pose significant challenges. Organizations are increasingly finding themselves navigating through:

• Data sprawl across countless files and sites
• Unclear ownership structures
• Inefficient storage utilization
• Growing security concerns
• Rising storage costs

The good news? Modern automation tools now offer innovative solutions for lifecycle management tasks, from archiving to removing obsolete content. This automation helps organizations optimize their data footprint and reduce unnecessary expenses.

We also explored the critical partnership between IT departments and business units in digital asset management. While Microsoft 365’s collaboration tools (Teams and SharePoint) offer fantastic flexibility, this ease of use can lead to:

• Fragmented data across platforms
• Unclear ownership responsibilities
• Potential security vulnerabilities

The emergence of Microsoft Copilot, combined with enhanced governance features, is highlighting the importance of robust data management. By implementing clear accountability measures and structured processes for data lifecycle management, organizations can:

• Reduce operational costs
• Enhance security
• Improve collaboration efficiency
• Better manage retention and deletion policies