Microsoft closed the shared default environment to its own makers. Every low-code agent now has an owner
With hundreds of thousands of low-code agents and apps in its tenant, Microsoft moved makers into 170,000+ personal environments, with tiers, connector rules and Sentinel enforcement.
Listen to this article · 4 min
AI-generated narration of the full article.
Every Power Platform tenant starts with a default environment that every employee can build in. For years that was convenient. With agents, it became the place where anyone could connect a model to company data, and nobody in particular was responsible for the result.
Microsoft has written up how it dealt with that inside its own company, where its corporate tenant holds hundreds of thousands of low-code agents and other resources. The answer was structural, not a new policy memo.
Three tiers, each with an owner
Microsoft moved its makers out of the shared default environment into personal developer environments, each owned by one person. Employees have created more than 170,000 of them since 2024. Above them sit two more tiers:
Microsoft's three tiers for low-code apps and agents
Production
- Company-wide solutions
- Security and responsible AI review
- Formal ownership and support
Built for many users
Team sandbox
- Shared by a team
- Security and responsible AI review
- Owned by the team
Built for a group
Personal developer environment
- One owner
- Maker's own work account
- Most Microsoft connectors allowed
Built for oneself
Connector policies decide what data may move where. In a personal environment, most Microsoft connectors are allowed, as long as they use the maker’s own work account and do not send company data outside Microsoft. Copilot Studio agents inherit the same Power Platform connector policies, so a low-code agent is governed by the same rules as a low-code app.
Enforcement that reaches the maker
The interesting part is how the rule is enforced. Microsoft Sentinel flags resources built in the default environment, alerts the person who built them, and suspends them until they are moved. A third-party detection tool adds more signals. Microsoft reports that alerts spiked when enforcement began and then tapered, which is what a working rule looks like: a burst of corrections, then new habits.
Governance is run jointly by Microsoft Digital, its internal IT organization, and the Office of the CISO, with privacy, legal and responsible AI teams setting requirements.
What the design gets right
Ownership is assigned at creation. In a personal environment, there is never an agent without an owner, because the environment itself has one. That prevents the orphan problem that appears when thousands of agents spread across a company faster than anyone can catalog them.
Review is tied to audience, not to technology. Building for yourself needs no review. Building for a team or the company does. That matches the risk: an agent’s blast radius grows with the number of people who rely on it.
The rule is enforced where the work happens. A suspended flow with a message to its maker teaches more than a policy page.
What it does not settle
Microsoft is candid about the limits. Some product features still depend on the default environment. And a personal environment does not make every use of accessible data appropriate: sensitive data still depends on identity and permission controls, data governance, connector restrictions, monitoring and the required reviews. A maker can build, in their own environment, an agent that reads everything they can read. That is the same breadth problem that comes with any assistant inheriting human permissions.
For companies on Power Platform and Copilot Studio, the transferable steps are concrete: stop new building in the default environment, give makers personal environments with an owner by design, set review gates by audience, and enforce with alerts that reach the person who built the thing.