Training / Copilot Studio Enterprise — Architecture, Scale & Governance
Copilot Studio Enterprise — Architecture, Scale & Governance
Govern an agent estate end to end: requirements, zones, enforced policies, a gated pipeline, a release gate, and monitoring that proves it. No agent-building required.
By the end of eighteen hours, every participant has produced a complete governance and delivery framework for an agent estate: documented requirements, a zone and environment model, configured data policies and security roles, a working deployment pipeline with an approval gate, an automated release gate, and an instrumented monitoring estate with retention set to a stated compliance requirement. The output is not an agent. It is the apparatus that lets an organisation run agents safely at scale, and the evidence that it is doing so.
Solution and platform architects who must design zones, environments and promotion paths, and defend them to a review board.
Power Platform and Microsoft 365 administrators who need the whole control surface, and where each control actually lives.
Security, risk and compliance teams who need data boundaries, residency, retention and the evidence trail an auditor will ask for.
Engineering and delivery leads who need release gates and a testing strategy that survives a non-deterministic runtime.
Building agents on any harness. Our Foundations — Standard Harness and Foundations — GitHub Copilot Harness courses cover that.
Generative orchestration, custom connectors or MCP servers. Our Practitioner — Standard Harness course covers those.
Multi-agent design, skills or authoring agent evaluations. Our Practitioner — GitHub Copilot Harness course covers those.
Purview, Sentinel or Entra ID taught end to end, or Power Platform administration beyond what agents need. They are used here at the depth an agent estate requires.
Writing Azure DevOps or GitHub Actions pipelines from scratch. The labs use supplied scaffolds.
- Duration
- 3 days or 9 sessions × 2 hours
- Level
- Enterprise · Any harness
- Delivery
- Remote or on-site
- Group size
- Up to 10
- Price
- Priced per team — ask us
We reply within one working day. No sales sequence.
What your team will be able to do
Outcomes, not topics covered.
By the end, each of these is something they have done rather than watched.
Capture governance requirements across IT, security, compliance and legal, and translate them into concrete controls.
Classify data sensitivity, assess leakage risk, and set naming and documentation standards for an estate.
Design a zoned governance model and place any agent use case in the correct zone.
Design an environment estate with defensible promotion paths.
Apply least-privilege access through Entra ID groups and Dataverse security roles, including who may read conversation transcripts.
Configure data loss prevention at tenant, environment and agent level, and explain what each level can and cannot reach.
Set data residency and cross-region boundaries, and apply network isolation where a use case demands it.
Establish an ALM strategy with solutions, managed exports, environment variables and connection references, and plan for the components that do not travel.
Build a deployment pipeline with approval gates and a rollback plan.
Design a testing strategy spanning development, regression, adversarial, performance and compliance testing.
Instrument an estate for telemetry, alerting, audit and transcript retention.
Plan capacity and licensing across an estate, and attribute cost to the business units consuming it.
What's covered
16 modules, a little under half of it building.
Labs govern rather than build: one fictional estate goes from written requirements to enforced policies, a gated pipeline and live monitoring, and no agent is authored. The labs configure tenant-level controls, so they run in your own tenant, with admin access agreed before booking. The course follows Microsoft's published five-phase governance framework. We publish what each day produces rather than a minute-by-minute timetable.
Provisional — modules may change before the first run.
Day 1
Frame and zone
Leaves with: Documented requirements, and every agent in the estate placed in a zone
-
01
The governance problem
Agents nobody owns, data reaching places it should not, cost as a surprise, and the five-phase framework the course follows.
-
02
Capturing requirements
Stakeholders across IT, security, compliance and legal, data classification and leakage risk, naming standards, and licensing before agents exist.
-
03
Lab 1: Write the governance requirements
A requirements document for the Northwind estate: classified data, compliance obligations as numbers, standards, and a stakeholder conflict resolved with a named approver.
Hands-on -
04
The zoned model
Citizen, partnered and professional zones, the controls each one implies, and placing the contested use cases.
-
05
Lab 2: Design the zone and environment model
Fourteen existing agents placed in zones, an environment estate, and promotion paths with explicit crossing criteria, defended to a partner.
Hands-on
Day 2
Secure and ship
Leaves with: Policies that hold under test, and a pipeline that moves agents without rebuilding them
-
06
Identity, roles and access
Licensing and access by Entra ID group, the Dataverse security roles, and who may read conversation transcripts.
-
07
Data policies and boundaries
Data loss prevention at tenant, environment and agent level, and residency, network isolation and secrets for regulated estates.
-
08
Lab 3: Configure policies and roles
Data policies per environment tier, roles through groups, sharing limits and Zone 3 agent controls, then tested as a restricted maker.
Hands-on -
09
ALM: solutions, environments and pipelines
The six golden rules, solutions and component collections, pipeline options, and the five components that do not travel.
-
10
Lab 4: Build the deployment pipeline
A solution promoted from development to test through an approval gate, with post-deployment steps and a rollback plan.
Hands-on
Day 3
Prove and operate
Leaves with: A release gate that blocks, and monitoring that can prove what happened
-
11
Testing strategy
Eight kinds of testing, three evaluation methods, and testing wired into release as a gate.
-
12
Lab 5: Build the release gate
Checkable release criteria, functional and security tests in the pipeline, a performance baseline, and a non-compliant release blocked.
Hands-on -
13
Monitoring, audit and compliance
Telemetry, Sentinel and admin alerts, Purview audit, transcript retention beyond the thirty-day default, and capacity monitoring.
-
14
Lab 6: Instrument the estate
Telemetry, an operations dashboard, alerts that fire, retention set to the Lab 1 obligation, and a verified audit trail.
Hands-on -
15
Capacity, licensing and cost at estate scale
Capacity by environment, billing models, harness choice as a budget decision, and cost attributed by zone and department.
-
16
The manage checklist and capstone
Microsoft's validation checklist run against the framework and your own organisation, then the capstone.
Upcoming batches
No public batch scheduled yet.
Teams book this course on their own dates. Joining as an individual? Tell us and we'll let you know when the next batch opens.
Before the first day
What we need from you.
Prerequisites
- No agent-building experience. The course assumes only that your organisation is deploying, or preparing to deploy, Copilot Studio agents.
- Microsoft 365 or Power Platform administration experience helps and shortens Day 2, but is not required.
- Admin-level access in your own tenant: creating environments and data policies, Entra ID groups, Dataverse security roles, a pipeline tool and Application Insights.
- Audit log visibility, which depends on your Microsoft 365 licensing.
- Every participant completes an access check 48 hours before day one.
We send a checklist a fortnight ahead and will talk to your platform team directly if access needs arranging.
Next step
Tell us about your team.
Roughly how many people, what they build today, and when you'd want to run it. We come back with dates and a quote.
Check availability