Die AgentinNICOLENDERS.COM
DEEN
← Dispatches

ReferenceTHE CONNECTORTHE BUILDER

Building it is not distributing it

Published

A fully assembled steel apparatus on a workbench beside an empty flatbed trolley, with a workshop doorway in the background that is narrower than the trolley.AI generated
Share agents with other usersMicrosoft Learn

The sentence I hear most often in workshops comes right after the demo: "So how do we get this to people?" Building an agent in Copilot Studio takes an afternoon these days. Distributing it takes longer, because distribution is not a feature but a chain of roles, channels, licences and an approval in an admin centre. This dispatch is the map of that chain. I keep it current rather than filing it away.

Five ways to hand an agent over

Route

What the recipient can do

Who sets it up

What the recipient needs

Co-authoring

open, edit, test

maker, through Share

Environment Maker role in Dataverse, granted along with the share

Chat sharing

talk to the agent, not edit it

maker, sharing with a security group or the whole organisation

membership of that group

Channel publishing

agent appears in Teams and Microsoft 365 Copilot

maker, through Channels, then an install link or the Teams app store

nothing extra on the classic route

Agent Store, "Built by your org"

agent is discoverable for everyone

maker submits, admin reviews and approves

nothing extra

Run-only sharing

use autonomous agents without maker access

maker, once available

open, see below

The first row is where most teams get stuck. Co-authoring is not a simple share: the second person needs the Environment Maker role in Dataverse, and if they do not have it yet, the person sharing has to be allowed to assign it. That requires the prvAssignRole privilege, which sits in the System Administrator role. Anyone who has watched a share dialogue quietly do nothing has met exactly this.

The asymmetry nobody expects

For editing, you share with individual people. For chatting, you share with a security group or the entire organisation, but not with individuals and not with Microsoft 365 groups. Individual access is therefore managed through group membership.

That is not an obstacle course, it is consistent: editing is a role assignment in Dataverse, use is a permission on the published object. For your operating model it still means you need a security group per agent before you put it into production. Create it before you build the agent, not afterwards.

Where the admin sits

Three places where distribution is stopped or allowed.

Data policies decide which channels can be published to at all. The lever is connectors: block the Direct Line connector and you remove the demo website, custom websites and the mobile app in one move. Block the Skills connector and agents that use skills cannot be published.

The Agents page in the Microsoft 365 admin center maintains an Agent Registry of every shared agent, with name, creator, creation date, host products and availability status, plus the option to block an agent. The capability is on by default in every Copilot-licensed tenant. You already have that list, whether or not anyone looks at it.

Submission is the new part. Agents from Agent Builder are published to the Agent Store under "Built by your org" after review and approval in the Microsoft 365 admin center. For Copilot Studio agents the review happens in the Teams admin center or the Microsoft 365 admin center. For the first time there is a clean path from "someone built something useful" to "the organisation can find it".

Two things that hurt in operations

Publishing is not instant. After an update it can take up to an hour before users receive the new version. In channels with persistent conversations such as Teams, the command "start over" resets the session and pulls the current version immediately. Tell your testers, otherwise they spend an hour testing the old version and reporting bugs that no longer exist.

And publishing itself can be blocked. In environments where an admin has disabled agent user provisioning, an autopilot cannot be published, while already provisioned agents keep running. An agent that could be published yesterday can fail today without anything about the agent having changed.

Where the sources diverge

On user licensing Microsoft says two different things, and both are true.

The classic licensing page says users of your agents need no special licence: anyone who can reach the published agent can interact with it. The sharing page for the newer agents experience built on the GitHub Copilot harness assumes instead that the people you share with hold a Microsoft Copilot Studio per-user licence, and points to a trial otherwise.

My reading: these are two authoring experiences with two distribution models, not one contradiction inside one model. For you it means the answer to "do our users need a licence" depends on which surface the agent was built in. Ask that before you budget.

Run-only sharing

The route that would close the chain: handing autonomous, event-driven agents to many employees without giving them maker access. Per the roadmap, preview lands in August 2026 and general availability in January 2027. That comes from a secondary source citing the roadmap and I could not confirm it on Microsoft Learn. Treat it as a planning assumption rather than a commitment.

If it arrives as described, the most uncomfortable compromise of the past two years disappears, namely handing out maker rights so that people are allowed to use something.

My recommendation

Decide the distribution route before you create the first topic. It determines whether you need a security group, whether an admin approval sits in the path and whether your users need a licence. Changing it later means, in practice, lifting the agent into a different environment.

For handover to operations, four lines per agent are enough: distribution route, security group, the person who approves in the admin centre, and the business contact. If one of those lines is empty, the agent is a prototype, however well it runs.

And take one look at the Agent Registry in the Microsoft 365 admin center before you write your next governance concept. The list is already there. The only question is whether you like what it says.

Sources

Copilot Studio · Governance & Compliance