Architecting M365 AI Agents

When given an agent idea (e.g. "automate compliance mailbox triage"), run this triage before any design work:

1. CLASSIFY the workload:
   - Pure conversational Q&A over org content → Copilot (M365 Copilot Chat / declarative agent)
   - Business process automation, low/no-code, needs approvals/triggers → Copilot Studio
   - Custom orchestration, multi-agent, code-first, needs fine control/model choice → Azure AI Foundry (Agent Service)
   - Hybrid (most real cases) → Copilot Studio agent as front door + Foundry for custom skills/models, orchestrated via Azure AI Foundry Agent Service or M365 Agents SDK

2. IDENTIFY data sources & sensitivity (mailbox, SharePoint, Dataverse, external API, PII/regulated data?)

3. CHECK licensing prerequisites (Copilot Studio consumption, M365 Copilot seats, Foundry pay-as-you-go)

4. VERIFY current capability — do not rely on memory. State explicitly: "Feature X should be verified against current Microsoft Learn docs as of build date" and list what to check (message limits, connector availability, GA vs preview).

5. OUTPUT a one-page feasibility verdict: Feasible / Feasible with caveats / Not feasible + why.

Only proceed to full architecture once step 5 is agreed.

Progress:

• Step 1: Requirements & scope interview
• Step 2: Feasibility & platform selection
• Step 3: Architecture design (data, orchestration, security)
• Step 4: Cost estimate
• Step 5: Build plan (prototype → pilot → production)
• Step 6: Security & governance review
• Step 7: Verification pass on all claims/features cited

Step 1: Requirements & Scope Interview

Ask/extract:

• Trigger: user-initiated chat, scheduled, event-driven (email arrival, Dataverse row, Teams message)?
• Data sources: mailbox, SharePoint, Dataverse, Graph, line-of-business API, external SaaS
• Sensitivity/regulatory: PII, financial, legal hold, retention requirements
• Actions needed: read-only (RAG/Q&A) vs write actions (send email, create ticket, update record)
• Human-in-the-loop requirement: full autonomy vs approval gates
• Users: internal only, or external/customer-facing
• Volume: messages/day, expected concurrency (drives cost + throttling design)

Step 2: Feasibility & Platform Selection

Decision matrix (verify current limits before quoting numbers):

Rule of thumb: start with Copilot Studio for business-process agents (fastest to secure + govern), drop to Foundry only when you need custom orchestration/models/tools Copilot Studio can't express, and only use M365 Copilot declarative agents when the ask is "extend Copilot chat with grounding/actions" rather than a standalone automation.

Output a feasibility verdict covering:

• Can this be done with existing connectors, or is custom API/plugin needed?
• Any hard blockers (e.g., mailbox access model, licensing gate, data residency)?
• What's genuinely uncertain and needs a spike/prototype to confirm?

Step 3: Architecture Design

Cover explicitly:

• Orchestration layer: Copilot Studio topics/agent flows, or Foundry Agent Service with tools/functions
• Grounding/knowledge: SharePoint/Graph connector, Dataverse, Azure AI Search index (for large/unstructured corpora), or direct API tool calls
• Identity: Entra Agent ID / service principal, least-privilege Graph API permissions (application vs delegated — prefer delegated + on-behalf-of where a human is in the loop)
• Triggers: Power Automate (mailbox event, Dataverse trigger), Graph webhooks, or scheduled flows
• Human-in-the-loop points: approval steps for any write/send action, especially compliance/legal/HR domains
• Observability: Copilot Studio analytics, Application Insights (Foundry), transcript logging to Dataverse/Log Analytics
• Data flow diagram (describe in text if no diagram tool): source → ingestion/grounding → agent reasoning → action connector → sink, annotating sensitivity at each hop

Step 4: Cost Estimate

State clearly this needs verifying against current pricing pages, but structure the estimate as:

• M365 Copilot seat licenses (if declarative agent extends Copilot chat) — per-user/month
• Copilot Studio: message-based consumption (classic + generative messages) — estimate volume × current per-message/session rate
• Azure AI Foundry: model token consumption (input/output tokens per model tier) + Agent Service compute + Azure AI Search index (if used) + storage
• Power Automate: per-flow or per-user premium connector licensing if triggers/actions need premium connectors
• Networking/security add-ons: Purview DLP, Defender for Cloud Apps if extending governance
• Always present as a range with the volume assumption stated, and flag "confirm current rates on Microsoft pricing calculator before committing budget."

Step 5: Build Plan (Prototype → Production)

1. Prototype in Copilot Studio (or Foundry playground) with mocked/sample data, no write actions enabled
2. Validate grounding quality and prompt/topic behavior with real (sanitized) sample content
3. Wire one real connector read-only, test with pilot user group
4. Add write actions behind approval gates
5. Apply security hardening (Step 6) before any production data exposure
6. Pilot with limited user group, monitor transcripts/analytics
7. Iterate on topics/instructions/tools based on failure transcripts
8. Promote to production, set up ongoing monitoring + change log for connector/model updates

Step 6: Security & Governance Review

Checklist:

• Least-privilege Graph/API permissions scoped to only required mailbox/site/list
• DLP policies (Purview) applied to the environment/connector
• Data Loss Prevention tested against the agent's actual connectors, not just default policy
• Sensitive action (send/delete/share) requires human approval or is disabled
• Agent identity uses Entra Agent ID (or dedicated service account) — not a shared/personal account
• Content moderation / responsible AI filters enabled (Foundry content safety, Copilot Studio moderation settings)
• Audit logging enabled (Purview Audit, Copilot Studio transcripts) and retained per compliance requirement
• Tested for prompt injection via untrusted content (e.g., email body) before allowing autonomous actions
• Environment/tenant isolation confirmed (dev/test/prod separation in Power Platform environments)

Step 7: Verification Pass

Before delivering final design, explicitly list every feature/limit/connector cited and mark:

• ✅ Stable, long-standing capability (safe to state confidently)
• ⚠️ Recently changed / GA-in-progress — flag "verify current status on Microsoft Learn/Release Planner before build"
• ❓ Unconfirmed / assumption — flag as a spike item for prototype phase

Never present cost figures, message limits, or connector availability as certain without this flag.

Example 1: Input: "Compliance team wants full AI automation of their mailbox — triage, respond, escalate." Output:

• Feasibility verdict: Feasible with caveats. Full autonomous "respond" is high-risk for compliance domain — recommend triage + draft + human-approve-send initially.
• Platform: Copilot Studio agent (mailbox trigger via Power Automate + Graph) as primary; Azure AI Foundry only if custom classification model beyond what Copilot Studio's generative topics can do is required — start without it.
• Architecture: Graph webhook on mailbox → Power Automate flow → Copilot Studio agent (classifies + drafts response using knowledge sources: policy SharePoint site + past case Dataverse table) → approval step (Teams approval card to compliance lead) → send via Graph on approval → log to Dataverse for audit.
• Security: dedicated Entra Agent ID with Mail.Read/Mail.Send scoped to shared mailbox only (not user mailboxes), Purview DLP on outbound content, no autonomous send, full transcript retention per compliance retention policy, prompt-injection test using crafted malicious email content before go-live.
• Cost: Copilot Studio consumption estimate based on expected daily email volume × generative messages per email (classification + draft = ~2 messages/email); flag "confirm current per-message rate before budgeting." Power Automate premium connector license if using premium Graph connector.
• Build plan: prototype with 50 sample historical emails (sanitized) → validate triage accuracy → add approval-gated draft → pilot with compliance lead only → expand to team.
• Verification flags: ⚠️ confirm Copilot Studio mailbox trigger connector is GA vs preview; ⚠️ confirm current generative message consumption rate; ✅ Entra Agent ID + scoped app permissions is stable pattern.

Example 2: Input: "Sales wants a chatbot that answers questions from our SharePoint proposal library." Output:

• Feasibility: Feasible, low complexity.
• Platform: M365 Copilot declarative agent (if users already have Copilot licenses and just need chat grounding) — do not over-engineer into Foundry.
• Architecture: Declarative agent with SharePoint site as knowledge source, no custom actions needed initially.
• Security: Respects existing SharePoint permissions (verify agent doesn't bypass item-level permissions — flag ⚠️ to test explicitly).
• Cost: No additional cost beyond existing M365 Copilot seats — flag if seats not yet licensed, that's the main cost driver.
• Build plan: configure in Copilot Studio/agent builder, test with 5 sample questions against known proposals, pilot with sales team, monitor for hallucination on missing documents.