Key takeaways
AI agents are quickly becoming part of everyday work in Microsoft 365. Teams build them in Copilot Studio, SharePoint, and Agent Builder to answer questions, find documents, and work with company content, often in minutes and without involving IT. Most of them are genuinely useful. But every agent is another way into your Microsoft 365 data, and agents rarely get retired when the project, or the person who built them, moves on.
Here’s how that typically plays out.
A financial analyst builds a Copilot Studio agent to answer budget questions. It’s grounded on a Finance SharePoint site that, at some point, was shared with “Everyone except external users.” Then the analyst leaves the company. The agent keeps running. It has no owner, nobody reviews it, and anyone in the organization who finds it can ask it about budgets and forecasts.
That’s how agent sprawl usually starts: not with one big mistake, but with one agent nobody is watching. As AI spreads across Microsoft 365, IT needs to know which AI agents and assistants exist, what they can access, and what they actually do.
The pace of growth makes that harder. Microsoft reports that active agents in Microsoft 365 grew 15x year over year, and 18x in large enterprises.
IT needs a solution to govern AI access to Microsoft 365, one that brings Microsoft agents and external AI assistants connected through enterprise apps (e.g. ChatGPT and Claude) into the same view. You can identify what needs attention, review access and activity, and take action from Syskit Point.
AI agents and assistants operate within the access granted to their users and identities. When those permissions are too broad, AI can make sensitive information easier and faster to find.
A document shared too widely already presents a permission risk. An agent that can access it can make that information easier to surface in response to a request. As more agents appear across platforms, the number of access paths and ownership decisions grows with them.
Most organizations underestimate that risk. Syskit research shows that 91% are confident AI tools would surface only authorized content. Yet 58% admit confidential content is accessible to departments that should not see it, and 99% acknowledge at least one live oversharing scenario in their own environment right now.
Gartner predicts the average global Fortune 500 enterprise will have over 150,000 agents by 2028, up from fewer than 15 in 2025.
IT needs visibility into what accesses Microsoft 365, management actions to address agents and apps that need attention, and audit logs to review their activity. Syskit Point provides these capabilities in one platform.
Tracking agents in one admin center and enterprise assistants in another makes it difficult to understand AI access across your tenant. Syskit Point brings two inventories into one platform – Agents and Entra Apps, including AI assistants.
Agents Inventory: SharePoint, Copilot Studio, and Agent Builder agents.
Entra Apps Inventory: AI assistants, agent identities, and other enterprise apps.
Microsoft does give you ways to see agents. The Microsoft 365 admin center lists agents in your tenant, Copilot Studio shows the agents built there, and Entra lists enterprise apps and agent identities. Microsoft Agent 365 brings much of this into one control plane, but it requires additional licensing.
What these views don’t connect is the Microsoft 365 permission picture behind each agent: which content it can reach, who else has access to that content, and whether that access was ever reviewed. Syskit Point shows agents and apps alongside the permission, ownership, and usage data you already use to govern Microsoft 365.
IBM reports that only 18% of organizations maintain a current, complete AI inventory. In a separate OutSystems survey of 1,900 global IT leaders, just 12% have a centralized platform to manage agent sprawl.
With a consolidated view, IT can identify agents without clear owners and investigate which agents or apps have access that needs review, without starting a separate search in each admin center.
Visibility gives IT a starting point. Syskit Point helps you focus on orphaned, shared, or sensitive agents and apps, then decide what to do about them.
When you open an individual agent or app from the inventory, management actions let you:
Back to the Finance agent. In Syskit Point, it shows up as orphaned, with a SharePoint site open to everyone in the organization as its knowledge source. IT can review who has access to that site, then decide: assign a new owner in Finance if the agent is still useful, block it while the site’s permissions are fixed, or delete it if nobody needs it anymore. These actions help you reduce unmanaged access directly from Point.
Gartner shared that 80% of organizations say they lack the governance controls to deploy agents at scale. 68% are worried about agent sprawl. 86% of Microsoft 365 leaders are blocking or limiting Copilot Studio agents, which kills innovation.
A clear way to identify and manage agents helps IT address specific issues as they arise and support adoption with more informed decisions about access.
Permissions show what an agent or assistant can access. Audit data helps you understand how it uses that access.
EMA found that 46% of organizations cannot produce a complete 30-day audit trail of what their agents did.
Syskit Point provides audit logs for AI agents and assistants, helping IT review recorded activity and spot anomalies that may warrant investigation.
Audit logs can also reveal activity that needs a closer look. For example, an agent repeatedly opening files in a site that holds HR or financial data, or an agent pulling answers from drafts and unapproved copies instead of the final versions. When that happens, IT can investigate and act on it with the same management actions, directly from the agent’s page.
AI governance belongs alongside the governance of the Microsoft 365 data agents and assistants use. Clear ownership, appropriate permissions, and visibility into activity help IT support adoption while reducing unmanaged access and potential exposure of sensitive data.
See how Syskit Point brings AI inventories, management actions, and audit data together. Book a demo to explore AI governance for your Microsoft 365 environment.