The Copilot Studio Agent Engagement

1 · The Answer, On One Page

Your customer is on Business Premium, has bought zero Copilot seats, and wants an agent. Everything below assumes that as the starting condition.

1.1 · The three ways partners lose this deal

1.2 · The seven phases at a glance

Read across, not down. Paper names the shape of the commercial instrument, never a rate — rates live in section 10 of the Frontier Partner Playbook. Week ranges for phases 2–5 are the build-side clock published in section 4 of the Ops Companion; phases 0, 1 and 6 have no equivalent there.

2 · Phase 0 · Standing and Visibility

2.1 · The six opening questions

The first two decide whether phase 1 has a finding in it. The last two decide whether phase 2 has an owner. If neither pair produces a satisfying answer, this is an education conversation, not a deal.

1. “Who here has already built an agent?” In most SMB tenants the honest answer is “several people, in Copilot Chat or Teams or Agent Builder, and nobody wrote them down.” That is the phase 1 finding, and it is live rather than theoretical.
2. “What happens to an agent when the person who made it leaves?” Risks 5 and 10 in section 3 — dormant and orphaned agents — are unfixable without a named owner, and no build-time control creates one.
3. “Do you have a Power Platform DLP policy separating Business from Non-Business connectors?” If not, the agent's real safety boundary does not exist yet. That is a phase 3 deliverable you have just scoped in one question.
4. “Has anyone ever set a spend cap on any of this?” Nobody has. It is the day-one control almost nobody sets — and it costs nothing.
5. “If I could automate exactly one process, which one would you name?” Phase 2 needs one named workflow, not a portfolio. A customer who names three has not chosen.
6. “Who owns that process, and can they give me two hours?” If the process owner is not available, phase 2 has no baseline, and the renewal conversation two years out has no evidence in it.

3 · Phase 1 · The Agent Governance Baseline

This is the assessment that earns the rest of the engagement. It audits what already exists. Section 5 prepares to build something new. Collapse the two and you have given away the billable assessment.

3.1 · Three settings decide the blast radius

Microsoft's framing is that agents are secure by default and makers change those defaults “for valid scenarios without knowing the risk.” Copilot Studio runs an automatic security scan and warns the maker before publishing. It warns. It does not stop them.

3.2 · Microsoft's top ten — the checklist, already written

Published by Microsoft's security organisation in February 2026. This is the phase 1 checklist and nobody in the channel had to invent it.

Items 5 and 10 are the argument for the retainer, and they come from Microsoft's security organisation rather than its marketing. A dormant agent and an orphaned agent are not build defects — at build time neither condition exists. They come into being through the passage of time and the movement of people, and the only thing that finds them is a recurring review. Section 8.

3.3 · Why this is a better wedge than the Copilot readiness assessment

4 · Phase 2 · Candidate and Baseline

This phase sits before the build sections for one reason: the baseline cannot be captured retroactively. A partner who reaches the end of a build and then starts thinking about measurement has already lost the argument they will need at renewal.

4.1 · Four value drivers, each with Microsoft's own formula

You do not have to defend a home-made ROI model in front of a sceptical finance person. The model is Microsoft's, the defaults are sourced, and the report computes it.

Agent Assisted Hours — the published formula

Agent Assisted Hours = (Knowledge references + Weighted sessions without knowledge references) × Time savings multiplier ÷ 60Microsoft Learn — Measure the impact of your agents

• Each knowledge source reference counts once and is multiplied by the time savings multiplier.
• Sessions without knowledge references are weighted by outcome: resolved counts as 1.0, escalated or abandoned as 0.7.
• The default time savings multiplier is 6 minutes, sourced by Microsoft to its own research on information retrieval tasks.
• Agent Assisted Value = Agent Assisted Hours × hourly rate. The default hourly rate is $72 MS list, sourced by Microsoft to US Bureau of Labor Statistics employer-cost data, and editable in the report's calculator.

4.2 · Where each metric is actually read

4.3 · The three failure patterns — and the slide they retire

Pattern 3 is aimed squarely at the channel's current pitch. The “X hours per week × headcount × salary” slide is the thing Microsoft is warning against — and you can now retire it internally with a vendor citation rather than an opinion.

5 · Phase 3 · Prerequisites and Harness

Section 3 audited what exists. This is what has to be in place before anything new is published — five layers in dependency order, and one choice that sets the price of everything after it.

5.1 · Choose the harness — it sets capability, publishing and the bill

A harness is the runtime between your agent design and the model: it decides when to call the model, what to send it, how to interpret the answer, and which tools to call. Microsoft lists four things it determines. Three are capability questions a maker cares about. The fourth is how your usage is billed — and that one is the partner's problem, not the maker's.

5.2 · The five layers, in dependency order

1. Who can make an agent at all. Restrict environment creation. Decide who holds a maker role. Adopt the zoned model Microsoft describes at maturity level 300 — environments designated safe, supported and IT managed, each with different controls. Present the zoned model as a named deliverable: it is one of the few governance artefacts a non-technical sponsor can actually picture.
2. What the agent can connect to. A Power Platform DLP data policy separating Business from Non-Business connectors is the agent's real safety boundary; Microsoft names failing to treat it as one a universal anti-pattern. Restrict raw HTTP actions and unreviewed MCP tools by policy — risks 3 and 8. Prefer an approval workflow (Power Shield) over a silent block.
3. Who the agent acts as. End-user credentials, authentication on — the two settings from section 3. For an agent that acts on its own rather than as a signed-in user, it gets its own identity in Entra, making it a new principal subject to conditional access and identity governance. Microsoft also recommends PIM for just-in-time activation of the AI Administrator and Search Administrator roles.
4. What it can read. Scope the 25 SharePoint sites deliberately and assess those. Microsoft frames knowledge readiness as four dimensions: source scope, permissions, source authority and ownership. Source authority is the one nobody checks — not can the agent read this but is this approved, current, and the version the business actually follows. An agent grounded in a superseded policy is confidently, fluently wrong, and no permissions review catches it.
5. What is recorded, and who owns it. Purview treats agents as auditable entities — interactions auditable, prompts and responses discoverable, retention applying to AI prompts and outputs. How much of that is reachable on Business Premium is an open question that guide leaves open too. Then the cheapest control on the list: a named accountable owner for every agent. Risks 5 and 10 are unfixable without one.

6 · Phase 4 · Economics — The Skipped One

This is the spine of the guide. It resolves the margin trap, it takes two to three days, and it is the phase that turns a metered cost base from a risk into the recurring service.

6.1 · Vocabulary, and how credits are actually bought

The billing unit is the Copilot Credit. Capacity is pooled at the tenant and allocable per environment. Channel material still talking about “messages” is working from pre-rename documentation — though the older vocabulary survives inside Microsoft's own tables, where the tenant billing capability column still reads “prepaid message packs.” The terms map; the material around them usually does not.

6.2 · The rate card

6.3 · Overage enforcement — the thing that will burn you

This is not a billing footnote. It is a service-availability event with no user-facing warning, and it belongs in the managed-service agreement.

6.4 · The day-one control almost nobody sets

Per-agent monthly consumption limits. They cost nothing, take minutes, and convert an uncontrolled tenant-wide kill switch into a per-agent budget. Microsoft's own framing is that they cap usage before enforcement is triggered. Set them during phase 4, on every agent, before launch.

6.5 · The four-step loop — this is the recurring service

Four steps, recurring, tool-supported, and every one of them is labour and judgement rather than a licence resale. That is the answer to the margin trap: you do not fix a metered cost base by pricing around it, you fix it by selling the management of the meter. What to charge is settled in section 10 of the Frontier Partner Playbook, not here.

6.6 · The build-burn clause

Billing starts when you start building. Unlike the standard harness, which starts billing after publish, the GitHub Copilot harness charges credits from the moment you start building. Experiences such as creating an automated solution with natural language, previewing and testing the agent, and generating and creating agent evaluations all consume credits.Microsoft Learn — Overview of usage-based billing (GitHub Copilot harness)

Read that as a partner. On this harness your own development, testing and QA consume the customer's credits, before anything is published and before anything works. Every SOW that selects the GitHub Copilot harness needs a clause naming who funds development consumption, and a cap on it. Almost none in the channel currently have one.

How big is the burn? Nobody has published a number — which makes the clause a warning rather than a negotiating position. One afternoon of testing would convert it into a figure; see TT-2 in section 13.

7 · Phase 5 · Build and Deploy

The part that looks like the project, and the part most at risk of commoditisation. Prebuilt agent galleries already do a large share of it. That is an argument for this engagement shape, not a threat to it.

7.1 · Buying the first 80% — what arrives, and what does not

A prebuilt agent gallery is an AI use case gallery: production-intent use cases with case study, demo and proof-of-concept actions, filterable by industry and solution area. The reasoning below applies to any such vendor. ExampleUnifyCloud's CloudAtlas AI Factory is on the TD SYNNEX line card and resellable today — stated on the line card's authority, not a public source. Confirm current availability with your rep before quoting it.

7.2 · Two cautions

7.3 · Five questions to put to any prebuilt-agent vendor

1. Which harness do the packaged agents target? Determines the billing model and whether build burn reaches the customer — §5, §6.
2. How are they delivered — solution import, template, or managed deployment? Does the ALM knowledge gap apply, meaning knowledge sources must be reconfigured per environment?
3. When you update a template, what happens to a deployed instance? The versioning question above.
4. Does the agent arrive instrumented? Is there a baseline and a measurement surface, or does the partner add that — §4?
5. What is the commercial shape for partners — per POC, subscription, or bundled with an assessment?

None of the five have publicly documented answers for any vendor reviewed here. Asking them is a five-minute call that changes what you can safely commit to.

8 · Phase 6 · Managed AgentOps

Where it stops being a project. The claim is not a sales position invented here — Microsoft says it in four places, none of them a marketing page, and two of the ten security risks in section 3 are failures that cannot exist until time has passed.

8.1 · Table 1 — the six ways an agent ages

A taxonomy is only useful if each entry comes with a way of seeing it. The third column is what turns this from a slide into a service.

8.2 · Table 2 — the failure register

This is the artefact. Named failure, the surface it becomes visible on, the free tool that shows it, and who is accountable. Fill in the fourth column for a live customer; every row you cannot fill is the retainer.

Every tool in the third column is free and open source, from Microsoft's Power CAT team. That is the commercial argument as well as the technical one: the tooling costs nothing, so the margin is entirely in the labour and the judgement. A partner who says “we license a governance platform” is beaten by one who says “we run the Compliance Hub, we set the thresholds, we own the SLA timer.”

8.3 · Microsoft's own support for the thesis

9 · Limits, Traps and Capacity

Reference material for phase 3 and phase 5. The traps have one property in common: nothing errors. The status says Ready. The agent answers. The answer is just missing something.

9.1 · Three traps that report success

9.2 · The capacity trap — why pilots pass and launches fail

Generative AI rate limits are set per Dataverse environment and scale with how much capacity the tenant owns.

9.3 · Structural limits worth knowing before you scope

None of these are traps — they are documented, findable and hard. They are here because a partner who meets one mid-build is having a scope conversation instead of a design one.

10 · Agent 365 — Trigger Logic

Agent 365 is the escalation, not the entry ticket. This section is the qualification logic — what to use before it, and the four conditions that turn the dial up. Where it sits commercially is settled in section 10 of the Frontier Partner Playbook.

10.1 · What changed on 1 July 2026

Effective July 1, 2026, AI agent security capabilities for Microsoft Copilot Studio and Microsoft Foundry agents require a Microsoft Agent 365 license. These capabilities are no longer covered by existing Defender for Cloud Apps or Defender for Cloud licenses.Microsoft Learn — Transition Copilot Studio and Foundry agent security capabilities to Microsoft Agent 365

For Copilot Studio agents, a tenant without an eligible licence lost agent discovery and posture, agent threat detection and real-time protection, and investigation of agent activity in Advanced Hunting.

Three further changes break things quietly:

10.2 · The overlap map — what an SMB actually needs on day one

10.3 · Four honest triggers

10.4 · The sales mechanic, and the two numbers to resolve first

Agent 365 admin-led trials are 25 seats for 30 days. The admin center shows a banner with remaining trial days, and admins with billing permissions can view details and purchase directly from it. That is a natural paid discovery engagement: run the registry across the tenant, produce the findings, and let the expiry force a decision that would otherwise drift. Do not let it lapse silently — a trial that ends with nobody watching is worse than never having run one, because the customer now believes they looked.

11 · The Toolchain Register

Everything below already exists, most of it is free, and almost all of it is published by Microsoft. This is tools you use; the long-form guide's reference library is sources cited. They overlap and they are not the same list.

11.1 · If you bookmark one link

• Microsoft Agent Resources hub
  Microsoft's curated resource centre for agentic transformation, from the Copilot Acceleration Team. Five hubs plus an Agent Platform Advisor. This is the index the rest of this register is drawn from.

11.2 · The AgentOps console, at zero licence cost

• Copilot Agent Kit (Power CAT Copilot Studio Kit)
  The single most valuable link in this register after the hub. Agent Inventory (tenant-wide registry), Compliance Hub (policies, thresholds, SLA timers, quarantine), Agent Insights Hub (telemetry), Agent Debugger (step-by-step inspection with timing and token usage), Agent Review Tool (anti-pattern scan), Agent Change Tracker, Power Shield (approval-based DLP workflow), Conversation Analyzer, Rubrics Refinement, Prompt Advisor, Conversation KPI, Agent Library and batch testing. Why it matters: it fills almost every column of the overlap map in §10 for free, which is what makes “Agent 365 is the escalation” true. Note its prerequisites — Dataverse, a system administrator role, and Power Platform licensing including premium connectors. Free is not the same as zero-dependency.
• microsoft/CopilotStudioSamples
  Samples and artefacts from Microsoft. Starting points that shorten phase 5 without the commercial commitment of a gallery.
• Automatic security scan in Copilot Studio
  Built in, free, runs at publish. It warns; it does not block. Knowing exactly what it warns about is how you audit a tenant for the three settings in §3.

11.3 · Phase 4 runs on these

• Copilot Studio agent usage estimator
  Microsoft's official estimator, linked from the billing documentation. Inputs are agent type, traffic, orchestration, knowledge and tools. It is the artefact the phase 4 forecast is built on — and the gap between its output and the invoice is the reconciliation retainer in §6.
• Billing rates and management
  The rate card, the reasoning-model double meter, and the full overage enforcement policy. Check it before every quote. It carries an ms.date and a 180-day update cycle, and the channel commentary about it is frequently wrong.
• Usage-based billing (GitHub Copilot harness)
  The separate billing model for the newest harness. This is the page that says billing starts when you start building — the source of the SOW clause in §6.
• Power Platform admin center — Licensing → Copilot Studio
  Environments for actual consumption per environment; Manage Agents for per-agent monthly caps. The caps are the day-one control most partners never set, and the consumption grid is where the true-up happens.

11.4 · Planning, limits and lifecycle

• Harnesses in Copilot Studio
  The three harnesses and how they differ. This is the scoping decision that sets the billing model — §5.
• Quotas and limits
  Rate limits per Dataverse environment, knowledge source limits, and the sensitivity-label and ALM notes. The 10 RPM developer-environment trap and the silent knowledge failures both live here — §9.
• Plan agent deployments for throughput and rate limits
  Estimating peak traffic, how throttling affects users, designing to reduce throughput pressure, requesting a limit increase. The pre-launch capacity conversation, already written.
• Establish an ALM strategy
  Environment and solution lifecycle for Copilot Studio. Read it alongside the ALM knowledge gap in §9, which it does not solve.
• Agent development lifecycle
  Five phases ending in operational steady state. The vendor citation for “there is no complete phase” — §8.
• Agentic AI maturity model — AI governance and security
  Five levels with named anti-patterns at each. The zoned environment model (safe / supported / IT managed) at level 300 is a sellable deliverable, and the universal anti-patterns are a ready-made gap assessment.

11.5 · Assessment, measurement and training

• Detecting and mitigating common agent misconfigurations
  Microsoft Security Blog, 12 February 2026 — the ten agent misconfigurations. It is the phase 1 assessment checklist and you did not have to write it — §3.
• Measure the impact of your agents
  Four value drivers with pricing formulas, the Agent Assisted Hours formula and its sourced constants, and the three measurement failure patterns. The ROI model you no longer have to defend — §4.
• Transition agent security capabilities to Microsoft Agent 365
  Check licenceWhat moved behind an Agent 365 licence on 1 July 2026, and the migration steps. The Advanced Hunting community queries the February blog recommends now require Agent 365 — check a tenant's licence before promising this capability. §10.
• Microsoft Agent 365 overview
  Observe, govern, secure; availability and prerequisites. Also the page that hedges on E5 as a prerequisite, which is why the Business Premium question in §13 is still open.
• Microsoft Copilot Agents Labs
  Hands-on lab modules and instructor-led bootcamp material, beginner through advanced. The cheapest way to get a delivery team from “we have seen a demo” to “we can build this,” and it is free.

12 · Language — Lines and Objections

12.1 · The whole licensing conversation, in five sentences

12.2 · The four objections that actually end deals

12.3 · Where the containment argument stops

13 · Claims Discipline and the Open Register

13.1 · Do not repeat these

1. “An autonomous agent action costs 25+ credits.” Several 2026 channel blogs say so. Microsoft Learn says an agent action is 5. Budgeting on the blog number over-quotes the run rate by 5×.
2. “Capacity packs can be bought with no Azure subscription at all.” Circulating in the channel and not asserted here. What Microsoft Learn states is narrower: prepaid credits are managed through the Power Platform admin center, and it is pay-as-you-go that requires linking an Azure subscription billing plan.
3. “Agent 365 requires E5.” Microsoft's wording is “works best when using Microsoft E5 as a pre-requisite” — hedged, not a requirement. Do not convert the hedge into either a yes or a no.
4. Any SMB Copilot Studio outcome number you cannot attribute. Vivid figures circulate — a boutique retailer cutting tickets by two thirds, a solo practice recovering nine hours a week — and they trace to marketing blogs with no named customer. Laundering an unattributed number into a benchmark is precisely the time-savings trap Microsoft names in section 4.
5. GitHub Copilot credit complaints as evidence about Copilot Studio. Different product, different meter. Admissible for exactly one thing: how customers react when metered AI billing surprises them. The reaction is not a renegotiation — it is a loss of trust in whoever sold it.

13.2 · The open register — confirm these before you quote

None of these has been tested for this guide. Each is cheap. A section resting on an open test ships with the uncertainty stated, or it does not ship — it never ships with a guess.

TT-1, TT-7 and TT-8 are the three most likely to repeat a known failure. The Copilot Readiness Engagement, section 9 documents what happens when one hedged Microsoft licensing page gets read two ways: two internally consistent conclusions, in opposite directions, both wrong to act on.

13.3 · Provenance legend

This page carries one currency figure — Microsoft's default $72 hourly rate in the Agent Assisted Value formula. Everything else about consumption is expressed in Copilot Credits, which are a unit of usage rather than money and need no provenance tag.

14 · The Room — 60 Minutes

A working session for a partner team, not a customer pitch. It decides which phase of the arc your practice is currently giving away, and which open test you run first. Every visual it needs is already on this page — run it from the page, no deck.

15 · Related Guides

15.1 · Run it on yourself first

You are the first tenant. Run phase 1 against your own Power Platform environments before you sell it — Agent Inventory takes an afternoon, and the findings from your own tenant are the only ones you can show without a customer's permission. That is also the honest answer to the missing case study in section 13.

15.2 · Where this sits

• The Agent Is Never Done — long-form background reference
  The same material with the reasoning, the evidence and its weaknesses: the Gartner cancellation data, the margin-trap case, the structural argument for the plumbing swap, and the full source apparatus. Read it when you need to defend a claim rather than use one.
• Frontier Partner Playbook — section 10, the revenue runway
  What to charge. The AgentOps tiers, their components, and the commercial architecture this guide deliberately does not restate.
• Frontier Partner Playbook — section 9, the agent maturity model
  A six-stage ladder measuring your practice as it matures across many customers. A different staircase from the seven phases here, which are one customer's engagement.
• Ops Companion — section 4, the Agent Build Engagement Worklist
  Discover, Design, Build & Test, Deploy & Train, AgentOps — the internal delivery instrument to hand a delivery lead on day one of a build. Narrower than this arc at both ends: no phases 0 and 1, and no credit-management layer.
• The Copilot Readiness & Governance Engagement — field guide
  The companion motion: seven phases of tenant readiness and Purview stand-up for a Business Premium customer buying Copilot seats. Where this guide swaps the plumbing, that one does it.
• Copilot Readiness Engagement — section 9, the SharePoint Advanced Management licence wall
  Why the tenant-wide readiness path does not execute on Business Premium, and the worked example of one hedged licensing page read two ways.
• Shadow AI Assessment Guide
  The discovery-led opening for phase 0 when unsanctioned AI use is the visible symptom.
• Frontier Partner Playbook — section 12, the competitive battle card
  How this positions against other vendors, including prebuilt-agent galleries.