Governance and Lifecycle actions for agents available in Microsoft 365 admin center

The Microsoft 365 admin center provides governance and lifecycle management capabilities for agents through the Agent Registry. These capabilities enable administrators to manage agent visibility, access, distribution, and retirement across the tenant.

Agent actions

Install agents

You can install agents across the whole organization or for specific users or groups by using the same controls that work for any other app in the Microsoft 365 admin center.

To install an agent via the Microsoft 365 admin center, follow these steps:

1. Sign in to the Microsoft 365 admin center.

2. Select Agents > All agents.

3. In the All agents page, make sure Registry is selected. Select the Status filter and then select Available.

4. From the list of agents, select an agent that isn't already installed.

5. In the agent details pane that opens, immediately under the agent's name, select Install.

6. In the Deploy agent to selected users pane, decide whether to install the agent to all users or to specific users or groups, and then select Next.

   

7. In the Review permissions pane, review the requested permissions for the agent. If the permissions are acceptable, select Grant admin consent. For more information, see Agent permissions.

8. In the Permissions requested window, select Accept to grant the permissions to the agent, and then select Next.

9. In the Review & finish pane, select Finish deployment.

Installing an agent affects its availability and functionality in Copilot and in the other host products, such as Outlook, Teams, or Microsoft 365.

Uninstall agents

You can uninstall first-party or external agents across the whole organization or for specific users or groups by using the same controls that work for any other agent in the Microsoft 365 admin center.

To uninstall an agent via the Microsoft 365 admin center, follow these steps:

1. Sign in to the Microsoft 365 admin center.

2. Select Agents > All agents.

3. Under Agents, select All agents.

4. In the All agents page, make sure Registry is selected. Select the Status filter and then select Available.

5. Select an installed agent from the list of agents.

6. In the agent details pane that opens, immediately under the agent's name, select Uninstall.

   Note

   If you don't see the Uninstall option, the selected agent might not be installed.

7. In the Remove agent pane, select the Remove agent option, and then select the Uninstall Agent button.

Uninstalling an agent affects its availability and functionality in Copilot and in the other host products, such as Microsoft Outlook, Microsoft Teams, or other Microsoft 365 applications.

Block or unblock agents

Block or unblock agents for the entire organization by using the same controls that work for any other app in the Microsoft 365 admin center.

To block or unblock an agent, follow these steps:

1. Sign in to the Microsoft 365 admin center.

2. Select Agents > All agents.

3. In the All agents page, select an agent from the list of agents.

4. In the agent details pane that opens, immediately under the agent's name, select Block or Unblock.

5. In the Block agent or Unblock agent pane that opens, select either Block agent or Unblock agent, and then select Save.

   

Blocking or unblocking an agent that you created by using Microsoft 365 Copilot Agent Builder and Microsoft 365 Copilot Studio affects its availability and functionality in Microsoft 365 Copilot. It also affects availability and functionality in other host products, such as Microsoft Outlook, Microsoft Teams, or other Microsoft 365 applications. However, blocking an agent that you created by using SharePoint or Microsoft Foundry only impacts its availability in Microsoft 365 Copilot Chat.

Delete agents

You can delete agents created using Microsoft 365 Copilot Agent Builder directly from the Microsoft 365 admin center. Delete permanently removes the agent and its data from the tenant.

To delete an Agent Builder agent, follow these steps:

1. Sign in to the Microsoft 365 admin center.

2. Select Agents > All agents.

3. In the All agents page, from the list of agents find the Agent Builder agent that you want to delete.

   Tip

   To quickly find Agent Builder agents, use the Platform filter in the All agents page and then select Agent Builder in Microsoft 365 Copilot.

4. Next to the Agent Builder agent you want to delete, select the vertical ellipses (⁝) and then select Delete.

When you delete an agent, the following actions occur:

1. Microsoft 365 removes the agent from the inventory.
2. All associated files are deleted.
3. The underlying SharePoint Embedded container is deleted.

This deletion process is irreversible. Once you delete an agent, it might take up to 24 hours for the deletion to reach all users who had access to the agent. During this time, users might still see the agent listed, but they can't interact with it.

Start or stop a Foundary agent

You can Start or Stop the underlying azure infrastructure to govern Foundry agents.

To Start or Stop an agent, use the following steps:

1. Sign in to the Microsoft 365 admin center.
2. Select Agents > All agents.
3. In the All agents page, find and select Microsoft Foundry agent that you want to stop or start.
   The agent details pane is displayed.
4. If required, select Add role to add the Azure AI Owner role to manage Azure infrastructure for the agent.
5. Select Stop or Start to control the underlying Azure infrastructure related to the agent.

Assign new owner to an agent

IT administrators can reassign ownership for agents that are ownerless or active.

To reassign ownership of a shared agent, follow these steps:

1. Sign in to the Microsoft 365 admin center.

2. Select Agents > All agents.

3. In the All agents page, from the list of agents select an Agent Builder or Copilot Studio agent that you want to reassign.

   Tip

   To quickly find Agent Builder or Copilot Studio agents, use the Platform filter in the All agents page and then select either Agent Builder in Microsoft 365 Copilot or Copilot Studio.

4. In the agent details pane, immediately under the agent name, select Assign new owner.

5. In the Assign a new owner pane, enter a new owner from your organization, and then select Assign.

The following changes occur after owner reassignment:

• The new owner gets full edit and delete permissions, plus access to any files the previous owner uploaded.
• The previous owner loses all access, including read rights.

Admin actions fail on agents behind Power Platform Firewall

If an admin action fails and doesn't run on the targeted agent, the agent may live in an environment that's configured with Power Platform Firewall in active enforcement mode.

Admin actions behave differently depending on the firewall mode:

• Active enforcement mode – Admin actions initiated from the Microsoft 365 admin center fail and aren't applied to the agent. The IP address is the upstream service IP rather than the originating admin client IP, so the firewall rejects the request.
• Audit-only mode – Admin actions succeed and only generate an alert in Microsoft Purview.

Check whether the environment is in active enforcement mode

In the Power Platform admin center:

1. Go to Security > Identity and access > IP firewall.
2. Select the environment/environment group that contains the agent.
3. Select the Advanced tab to see additional IP firewall settings.
4. Confirm the following settings:
   • Set IP Firewall to On.
   • Set Turn on IP firewall in audit-only mode to Off.

If Turn on IP firewall in audit-only mode is On, the firewall logs activity but allows requests regardless of IP address, and admin actions from the Microsoft 365 admin center succeed. If it's Off while IP Firewall is On, the environment is in active enforcement mode and admin actions are blocked.

For more information about firewall configuration, see IP firewall in Power Platform environments.

To resolve this issue, run the action directly against the Power Platform API (PPAPI). For more information, see the following resources:

• Reassign ownership of orphaned agents with the Power Platform API
• Quarantine noncompliant agents with the Power Platform API