Copilot Agents governance relies on four key controls. First, decide who can create agents. Next, define what data agents can use. Then, control who can share them. Finally, limit what they can do externally. Get those four right and Microsoft Agent 365 becomes a useful productivity layer for your business. Skip them and you create a quiet new oversharing surface that sits on top of all the data your tenant has accumulated since 2018.

Agent 365 reached general availability on 1 May 2026, and Microsoft’s Copilot data loss prevention for web search is rolling out worldwide through June 2026. That makes June the right month to set the rules, before staff start building agents at scale and the first ungoverned one shows up in a client meeting.

What changed with Microsoft Agent 365

Microsoft Agent 365 brings agents into the same identity, security and management plane as users. Agents can hold their own identity and use specific data sources. In addition, they can perform actions across Microsoft 365 and selected third-party systems. However, organisations should govern them with the same controls they use for human accounts.

For an SME already using Microsoft 365 Copilot, this is the point where AI moves from a chat feature to something staff can build with. Copilot Studio lets users assemble agents that summarise weekly inboxes, route customer queries, draft proposals from templates, or trawl SharePoint for an answer. The hard part is no longer building. It is governing.

The four Copilot Agents governance controls every business should set this month

A workable Copilot Agents governance starter pack is four decisions made in writing and enforced in the tenant. Configure them in the Microsoft 365 admin centre, Copilot Studio settings and Microsoft Purview.

Control	What it does	Where it lives
1. Who can create agents	Restricts agent authoring to named users or a security group	Copilot Studio settings
2. What data agents can ground in	Limits which SharePoint sites, OneDrive locations or external sources an agent can use	Sensitivity labels and agent configuration
3. Who agents can be shared with	Controls internal-only, by-team, or cross-tenant sharing	Microsoft 365 admin and Copilot Studio
4. What agents can do externally	DLP rules that prevent sensitive data leaving the tenant via web search or third-party connectors	Microsoft Purview DLP for Copilot

That is the starter pack. It is not the end of governance, but it is the floor.

Control 1: Who can create agents

The default is rarely the answer. If everyone with a Microsoft 365 licence can build agents, agents will appear faster than your IT team can track them. The sensible starting position is to restrict authoring to a named group, typically IT plus a handful of trained power users, and review quarterly.

When a team wants their own agent, the group helps them build it. That keeps the oversight loop in place without turning IT into a bottleneck.

Control 2: What data agents can ground in

This control sits on top of the work you have already done with Microsoft Purview. If your sensitivity labels are healthy, your agents inherit the protection automatically. If they are not, agents will happily pull from any SharePoint site they can reach.

Next, walk through the same logic from our Microsoft Purview starter pack. Then, make sure you apply labels before turning agents loose. Without that base layer, the next control gets harder.

Control 3: Who agents can be shared with

Agents can be shared inside a team, across the tenant, or with external organisations. Each step outward changes the risk profile. Tenant administrators in Agent 365 can now govern who is allowed to share agents created in Copilot. Set the default to internal-only, require approval for external sharing, and audit external-shared agents monthly.

Take particular care with agents that touch customer or finance data. Those should not be shareable outside the team that owns them without a named approver.

Control 4: What agents can do externally

The June 2026 rollout of Copilot DLP for web search is the new control here. It prevents sensitive data from being included in prompts that hit web search, while still letting the agent ground its response in internal data sources. Microsoft documents this in their Copilot blueprint for oversharing.

Set DLP rules for the data classes you already protect in email and Teams: customer records, financial data, payroll, anything regulated. The same rules now apply to agent web actions.

How this connects to what you already have

If your business has worked through the AI readiness check and rolled out Copilot, Agent 365 is the next layer. The Purview labels, conditional access policies and AI acceptable-use guidance you put in place earlier this year still apply. Agent 365 extends them; it does not replace them.

For businesses that have not started yet, the order matters. Labels and DLP first. Copilot second. Agents third. Skipping ahead means governing agents on top of an unlabelled tenant, which is the situation Microsoft’s own guidance describes as the oversharing problem.

A short readiness check

Three questions to ask before you let agents into the business at scale:

• Have we restricted who can author agents in our tenant?
• Are our SharePoint sites labelled with sensitivity that agents will respect?
• Do we have DLP rules that apply to Copilot web search as well as email and Teams?

If two of the three answers are no, get the controls in place this month.

Set the rules before staff build the agents

Microsoft Agent 365 is moving fast. The right time to govern it is before staff start shipping agents into business processes, not after. The four controls above take a working day to set up and a quarterly review to maintain.

If you would like us to audit which agents already exist in your tenant, configure the four-control starter pack and check your Purview foundation, book a Copilot Agents governance review and we will produce a one-page agent inventory and a setup plan tailored to your Microsoft 365 estate.

Microsoft 365 backup is not bundled into any Microsoft 365 subscription. However, Microsoft bundles retention instead: it holds deleted items for a defined window, replicates data across data centres, and protects the platform from its own failures. None of that is the same as backup. If a user empties a deleted-items folder, ransomware encrypts SharePoint files, or an admin deletes the wrong site collection, retention alone may not be enough to bring the data back.

Microsoft does sell a first-party backup product called Microsoft 365 Backup, launched in 2024 and priced per gigabyte stored per month. Most UK SMEs we work with use a third-party backup tool instead because the per-GB pricing scales unpredictably and the feature set is narrower than the established backup market. Either way, the gap below is real: retention by itself does not give you point-in-time recovery.

Where the confusion comes from

Microsoft publishes a shared-responsibility model that splits ownership between platform and customer. Microsoft owns availability and infrastructure. The customer owns the data, the configuration, and the recovery of that data when something goes wrong on the customer’s side.

Most businesses read “the cloud” as “they handle backup”. They do not.

Retention vs backup

Retention is a holding pattern for items that have been deleted or modified, kept for a defined period inside Microsoft 365. Backup is an independent copy of your data, stored outside the live platform, that can be restored to a point in time.

The difference matters when something larger than a single deletion goes wrong.

Scenario	Retention covers it	Backup covers it
User deletes a single email	Yes, within retention window	Yes
User empties deleted items	Sometimes, depending on policy	Yes
Ransomware encrypts OneDrive files	Limited, version history may help	Yes
Admin deletes a SharePoint site	Limited, 93-day recovery window	Yes
Departing employee mailbox archived	Yes, with policy in place	Yes
Restore to a specific point in time	No	Yes
Restore Teams chat history	Limited	Yes
Recover after a full tenant compromise	No	Yes

Retention buys you a window. Backup gives you a copy.

What Microsoft does and does not back up

Microsoft replicates your data across multiple data centres for availability. That protects against hardware failure and regional outages. It does not protect against data your business has deleted, encrypted or corrupted.

The native recycle bins and retention policies are useful, and you should configure them. They are not designed to replace a backup. They will not help you restore last Tuesday’s version of a SharePoint site, roll Teams back to a known clean state after a ransomware event, or recover a mailbox after a long-deleted account has aged out of retention.

The NCSC Small Business Guide on backing up data is unambiguous on the principle: keep an independent copy of important data, and test that you can restore it.

Where Microsoft 365 Backup the product sits

Microsoft launched Microsoft 365 Backup in 2024 as its own paid backup product and built it directly into the Microsoft admin centre. In addition, it covers Exchange, OneDrive and SharePoint, restores items and full sites, and bills storage per gigabyte each month on top of the existing subscription.

Two trade-offs decide whether it suits a UK SME. First, the per-GB pricing is unpredictable for businesses with growing storage estates, where third-party tools usually price per user. Second, the backups sit inside the same Microsoft tenant boundary as the live data, which keeps things convenient but means the backup is not stored outside the blast radius of a major tenant-level incident. Neither trade-off is a deal-breaker. Both are worth knowing before you choose.

What good Microsoft 365 backup looks like

A real Microsoft 365 backup covers Exchange Online, OneDrive, SharePoint and Teams, retains data for a period that suits your business, and supports point-in-time restore at item, folder and site level.

Three operational details separate good from average.

Restore granularity

Can you restore a single email, a specific OneDrive folder, or a SharePoint site as it was on a Tuesday last month? If the answer is “we can restore the whole mailbox”, that is not enough for most real incidents.

Test restores

You cannot trust a backup until you have restored it successfully. Test restores at least quarterly on a sample of data.

Independent credentials and storage

The backup admin account should not share credentials with day-to-day Microsoft 365 admins, and backup data should sit outside the same blast radius as the live tenant. This is the test Microsoft 365 Backup the product does not pass on its own; a third-party tool with separate storage usually does.

This is the same principle we applied in our ransomware downtime guide and our incident response plan template. Backup is the layer that turns a bad week into a recoverable one.

When retention is enough

For some SMEs, retention covers most realistic scenarios. A small team with limited turnover, no regulated data, a stable Microsoft 365 footprint and a clear retention policy may not need third-party backup as a day-one priority.

That changes quickly. Once a business takes on regulated data, hits 20+ users, holds anything an attacker would consider valuable, or carries client contracts that require a documented recovery plan, retention alone becomes a thin layer to rely on.

A short readiness check

Three questions to ask:

• If a user deleted everything in their OneDrive a year ago, could we restore it today?
• If ransomware encrypted our SharePoint sites tomorrow, what would we use to restore them?
• When did we last test a restore on a non-trivial item?

If the answers are “probably not”, “I am not sure”, and “we have not”, retention is doing the work that backup should be doing.

Close the gap before you need to use it

Microsoft 365 retention is a useful tool. It is not a recovery strategy. The businesses we see recovering well from ransomware, mass deletion and account compromise are the ones that closed this gap before they needed to.

If you would like us to check what your current Microsoft 365 setup can restore, book a Microsoft 365 backup gap assessment and we will produce a one-page recovery map covering Exchange, OneDrive, SharePoint and Teams.

The PSTN price increase in 2026 lands hardest on 1 July, when Openreach’s wholesale rental on legacy voice-only PSTN linesrises by a further 40% on top of April’s 20% rise. A third rise of 40% follows on 1 October. By the autumn, the published Openreach pricing path has roughly doubled the cost of a voice-only line compared with early 2025.

Openreach is running a free PSTN migration offer for voice-only lines placed between 8 June and 31 October 2026, on the condition that migrations complete within 30 days of the offer closing. That makes June the practical decision month for most UK SMEs still sitting on legacy lines.

Below: what changes on 1 July, who the Openreach offer covers, what to check before you migrate, and why waiting for the January 2027 switch-off is now the most expensive option on the table.

The PSTN price increase comes in three rises across 2026

Three rises are scheduled across 2026. Openreach has published a phased increase in legacy line rental to reflect rising maintenance costs on a network being retired.

Date	Increase	Cumulative effect
1 April 2026	+20%	1.20x
1 July 2026	+40%	1.68x
1 October 2026	+40%	2.35x

By the time the October rise lands, a voice-only PSTN line will cost more than double what it cost in early 2025. None of that is optional and none of it is reversible. It is the published Openreach pricing path until the network is switched off.

The Openreach free PSTN migration window

Openreach’s free migration offer covers voice-only PSTN lines and is available for migrations placed between 8 June and 31 October 2026. The migration itself must complete within 30 days of the closing date. For a UK SME with one or two analogue lines used only for voice, this is a clean path off the network at no Openreach cost.

The offer is narrower than it first sounds. It does not cover multi-line setups with broadband bonded to the same circuit, lines used for ADSL or FTTC alongside voice, or lines feeding alarms, lift telephones, door entry systems or card terminals. Those need a proper migration plan, not a swap of provider.

Our ISDN switch-off checklist covers the device-by-device audit most businesses skip and then regret on cutover day.

What you migrate to

For a business voice line, the natural replacement is a cloud-hosted phone system running over your existing broadband, or over a SoGEA line if the circuit has been doing both voice and data. A SoGEA broadband connection gives you the same physical link without the underlying voice path, which removes the PSTN cost entirely.

Most SMEs migrating now also bring in unified communications, so calling, chat and meetings sit on one platform. That is a bigger decision than a like-for-like line swap, and it should not be made under deadline pressure. Starting in June gives you the room to make it properly.

What about the January 2027 deadline?

The national PSTN switch-off date is 31 January 2027. Industry coverage of the migration phase reports engineering capacity is already tightening. More than 500,000 UK businesses are still on legacy lines. The closer to the deadline you migrate, the longer you wait for an engineer and the more months you pay an inflated line rental while you wait.

Waiting also rules out the free migration offer, which closes at the end of October 2026.

Two patterns we see across the North East

The first is professional services and clinics with a single back-of-house line that nobody has thought about in a decade. Those are the cleanest candidates for the Openreach offer.

The second is older industrial and hospitality sites with mixed services on the same site: alarm dialler, lift line, card terminal, ordering line. Those sites need a migration plan rather than a phone call to a provider. Get the audit done early.

What to do this month

A practical sequence for June 2026:

1. List every line at every site, including alarms, lifts, door entry and card terminals.
2. Check each line’s contract type and whether it is voice-only or carrying broadband.
3. Identify which lines are eligible for the free Openreach migration and which need replacement hardware.
4. Choose a replacement: hosted phone system, SoGEA plus VoIP, or a full unified communications platform.
5. Schedule the cutover before October to stay inside the offer window.

If that list looks heavier than expected, that is normal. Most businesses underestimate how many devices quietly depend on a line until they walk the site.

Plan the migration before the July price rise

The 1 July rise is the second of three. The Openreach free migration window closes on 31 October. Waiting beyond the autumn means paying more for a line you will need to replace anyway, on a tighter timetable, with less engineering capacity available.

If you would like us to audit your lines and check which qualify for the free Openreach migration, book a phone system migration audit and we will produce a one-page switch plan with eligible lines, replacement options and a cutover date that beats the next price rise.

Four key controls govern Copilot Agents: who can create agents, what data they can access, who can share them, and what actions they can perform externally. Get those four right and Microsoft Agent 365 becomes a useful productivity layer for your business. However, without those controls, you create a quiet new oversharing surface that sits on top of all the data your tenant has accumulated since 2018.

Agent 365 reached general availability on 1 May 2026, and Microsoft’s Copilot data loss prevention for web search is rolling out worldwide through June 2026. For this reason, June is the right time to set the rules. Once staff start building agents at scale, governance becomes much harder to apply consistently.

What changed with Microsoft Agent 365

Microsoft Agent 365 brings agents into the same identity, security and management plane as users. Organisations can give Agents their own identity, assign them to specific data sources, enable them to perform actions across Microsoft 365 and selected third-party systems, and govern them using the same controls as human accounts.

For an SME already using Microsoft 365 Copilot, this is the point where AI moves from a chat feature to something staff can build with. Copilot Studio lets users assemble agents that summarise weekly inboxes, route customer queries, draft proposals from templates, or trawl SharePoint for an answer. The hard part is no longer building. It is governing.

The four Copilot Agents governance controls every business should set this month

A workable Copilot Agents governance starter pack starts with four decisions that organisations document and enforce within the tenant. Configure them in the Microsoft 365 admin centre, Copilot Studio settings and Microsoft Purview.

Control	What it does	Where it lives
1. Who can create agents	Restricts agent authoring to named users or a security group	Copilot Studio settings
2. What data agents can ground in	Limits which SharePoint sites, OneDrive locations or external sources an agent can use	Sensitivity labels and agent configuration
3. Who agents can be shared with	Controls internal-only, by-team, or cross-tenant sharing	Microsoft 365 admin and Copilot Studio
4. What agents can do externally	DLP rules that prevent sensitive data leaving the tenant via web search or third-party connectors	Microsoft Purview DLP for Copilot

That is the starter pack. However, it is not the end of governance; it is the floor.

Control 1: Who can create agents

The default is rarely the answer. If everyone with a Microsoft 365 licence can build agents, they will appear quickly. As a result, your IT team may struggle to track them. Therefore, organisations should start by restricting authoring to a named group, typically IT and a small number of trained power users, before reviewing access quarterly.

When a team wants their own agent, the group helps them build it. That keeps the oversight loop in place without turning IT into a bottleneck.

Control 2: What data agents can ground in

This control sits on top of the work you have already done with Microsoft Purview. When your sensitivity labels are healthy, agents inherit the protection automatically. However, if those labels are weak or inconsistent, agents can pull from any SharePoint site they can reach.

Walk through the same logic we laid out in our Microsoft Purview starter pack and make sure labels are applied before turning agents loose. Without that base layer, the next control gets harder.

Control 3: Who agents can be shared with

Agents can be shared inside a team, across the tenant, or with external organisations. Each step outward changes the risk profile. Tenant administrators in Agent 365 can now govern who is allowed to share agents created in Copilot. Set the default to internal-only, require approval for external sharing, and audit external-shared agents monthly.

Take particular care with agents that touch customer or finance data. Those should not be shareable outside the team that owns them without a named approver.

Control 4: What agents can do externally

The June 2026 rollout of Copilot DLP for web search is the new control here. As a result, it prevents sensitive data from being included in prompts that hit web search. At the same time, it still allows the agent to ground its responses in internal data sources. Microsoft documents this in their Copilot blueprint for oversharing.

Set DLP rules for the data classes you already protect in email and Teams: customer records, financial data, payroll, anything regulated. The same rules now apply to agent web actions.

How this connects to what you already have

If your business has worked through the AI readiness check and rolled out Copilot, Agent 365 is the next layer. Furthermore, the Purview labels, conditional access policies and AI acceptable-use guidance you put in place earlier this year still apply. Agent 365 extends them; it does not replace them.

For businesses that have not started yet, the order matters. Labels and DLP first. Copilot second. Agents third. Skipping ahead means governing agents on top of an unlabelled tenant, which is the situation Microsoft’s own guidance describes as the oversharing problem.

A short readiness check

Three questions to ask before you let agents into the business at scale:

• Have we restricted who can author agents in our tenant?
• Are our SharePoint sites labelled with sensitivity that agents will respect?
• Do we have DLP rules that apply to Copilot web search as well as email and Teams?

If two of the three answers are no, get the controls in place this month.

Set the rules before staff build the agents

Microsoft Agent 365 is moving fast. Therefore, organisations should govern Copilot Agents before staff start shipping them into business processes, not afterwards. The four controls above take a working day to set up and a quarterly review to maintain.

If you would like us to audit which agents already exist in your tenant, configure the four-control starter pack and check your Purview foundation, book a Copilot Agents governance review and we will produce a one-page agent inventory and a setup plan tailored to your Microsoft 365 estate.

Most SMEs have no data classification in place. Microsoft Purview for SMEs can provide essential tools to address these challenges. Files sit in SharePoint and OneDrive with no labels, no restrictions on sharing, and no visibility into what is leaving the organisation. When someone accidentally shares a client contract via a public link, or emails a spreadsheet of employee salary data to the wrong address, there is nothing in place to prevent it or even flag it.

Microsoft Purview provides sensitivity labels and data loss prevention (DLP) rules inside Microsoft 365. If you have a Business Premium or E3 licence, you already have access to the core features. The problem is that most SMEs never configure them because the documentation is designed for enterprise compliance teams, not for a business with 30 users and no dedicated IT security function.

This article gives you a realistic starter configuration: three sensitivity labels, two DLP rules, and a monthly audit routine that an SME can deploy and maintain without a compliance department.

Three Sensitivity Labels to Start With

Sensitivity labels classify your data by how sensitive it is. Once applied, labels can enforce protections such as encryption, watermarks, and sharing restrictions. Start with three labels. You can add more later, but three covers 90% of SME needs without confusing users.

Public. Content that can be shared externally without restriction. Marketing materials, published blog posts, public-facing documents. No encryption, no restrictions. A footer reading “Public” provides a visual marker.

Internal. Content intended for internal use only. Meeting notes, internal policies, project documents, staff communications. No encryption (this avoids friction), but a footer reading “Internal Use Only” reminds staff not to share externally. This should be the default label applied to all new documents automatically, so nothing is created without classification.

Confidential. Content that would cause harm if shared externally. Client contracts, financial data, employee records, supplier pricing, legal correspondence. Apply encryption so only authorised users can open the file. Add a header and footer reading “Confidential.” Restrict external sharing.

Publish these labels through a label policy in the Purview portal and set “Internal” as the default. Users can upgrade to “Confidential” when needed, but nothing is ever created unlabelled.

Two DLP Rules That Prevent the Worst Outcomes

DLP rules monitor for sensitive information leaving the organisation and either warn the user, block the action, or notify an administrator. Start with two rules that cover the highest-risk scenarios.

Rule 1: Block external sharing of Confidential files. When a user tries to share a file labelled “Confidential” via a public SharePoint link, external email, or OneDrive sharing, the DLP rule blocks the action and shows a policy tip explaining why. This single rule prevents the most common accidental data exposure.

Rule 2: Warn on sensitive data in email. Configure a DLP rule that detects common sensitive data types in outbound email: National Insurance numbers, credit card numbers, and bank account details. Instead of blocking, show a policy tip that asks the user to confirm they intend to send this externally. This catches accidental disclosures without blocking legitimate business communication.

Run both rules in audit mode for the first two weeks. Review the matches, check for false positives, and adjust before switching to enforcement. This avoids disrupting your team with unexpected blocks.

A Monthly Audit Routine

Labels and DLP rules only work if someone checks they are being used correctly. Set a monthly 30-minute review.

Check the data classification dashboard in Purview. How much content is labelled? How much is unlabelled? If the unlabelled percentage is growing, your default label policy may not be applied correctly, or new content is being created outside the scope.

Review DLP incident reports. How many policy matches occurred? Were they genuine risks or false positives? Adjust rules if a specific file type or workflow is generating excessive alerts.

Check for label downgrades. If users are routinely changing files from “Confidential” to “Internal” or “Public,” investigate why. It may indicate the label is being applied too broadly by auto-labelling, or that users are bypassing protections for convenience.

How This Supports Copilot and Compliance

If your business uses or plans to use Microsoft 365 Copilot, sensitivity labels become essential. Copilot surfaces content based on user permissions. Labels add a classification layer that tells Copilot (and DLP) how sensitive that content is, regardless of who has permission to access it.

For compliance, labels provide an auditable record of how data is classified, who accessed it, and what protections were applied. This supports cyber insurance evidence requirements and demonstrates proportionate data handling if a regulator asks.

Make It Part of Your Security Programme

If you have Microsoft 365 Business Premium or E3 and have never configured sensitivity labels or DLP, the features are sitting unused in your subscription. Contact The Unite Group and we will set up your starter labels, configure DLP rules for your environment, publish the label policy, and show your team how to use them, all as part of your managed Microsoft 365 service.