Forum Discussion
Prevent members from building agents in my team?
We are piloting Copilot with a small group of users, and I've discovered that someone in the pilot who happens to be a member of one of my "get support for Collaboration Tools" teams created an agent...
Hello,
Short answer: No.
Long answer:
Unfortunately, it's not possible for Teams owners (whether referring to organizational teams or individual Teams workspaces) to "dont let sharing" agents if users are allowed to create them.
What you can do is view all created agents from the Microsoft 365 admin center by navigating to Settings > Integrated apps > Shared agents, and then block any agent that has been shared to Teams.
Another important thing what you can do is communicate about this. Rolling out Copilot is not a technical task, it's more about change management. Clear communication plays a crucial role in a successful Copilot deployment. It's also essential to create AI usage guidelines within your organization so that everyone understands what is allowed and what is not.
Although you can edit through Teams admin center that who can access to get the agent:
Also you can control how apps are made available to a user with the Teams app in Teams Admin Center, but that's totally different, unfortunately.
Unfortunately that doesn't solve my use case at all - I don't want or need to prevent individual users from creating or sharing agents in the org at large, and I don't need specific bots to be blocked from access by other users, I just want to prevent them from creating agents in my team. I already have the Microsoft Team itself set up so that members cannot add apps, tabs, or connections to the team, which I am hoping is at least successfully preventing them from "adding the agent to this team" from an end user UI perspective (it hasn't happened so far at least) but since I own the Team, the SharePoint site, and the M365 group associated with all of the above, it seems like an egregious breach of permissions to let members convert my Team to a Power Platform environment and build copilot agents in it, without any kind of approvals required from the group/team owner, when they can't do anything else with adding apps. They don't even have "edit" permissions on the sharepoint site itself - I changed the default so they can only "edit" within the two folders associated with channels they can post into.
And while I personally do happen to have access to the Teams Admin role on an as-needed basis for support, the vast majority of Team owners in my org do not; I need a solution that allows them to continue to maintain control of their own teams!
