30-second answer

PowerShell
Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/finance -Interactive -ClientId $clientId
$agent = Get-PnPCopilotAgent | Select-Object -First 1
Get-PnPFile -Url $agent.ServerRelativeUrl -AsListItem |
    Get-PnPProperty -Property RoleAssignments, HasUniqueRoleAssignments

Sharing an agent shares the agent. It does not share what the agent knows. Those are two permission questions, and they have different answers.

What this proves

Who may open or edit the agent itself. The agent is a file, so the file's permissions are the answer, and they behave like any other document's.

What it does not prove

  • What any of those people will get back from it. Microsoft is explicit that responses depend on each user's own permissions to the agent's data sources. Access to the agent is not access to the content behind it.
  • That the agent is safe to share. A safe answer needs both halves: who holds the agent, and who can read what it points at. This is one half.
  • Who has used it. Permission is not activity. Usage is in file statistics and in the audit log.

PowerShell

PowerShell
$clientId = '00000000-0000-0000-0000-000000000000'
Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/finance -Interactive -ClientId $clientId

foreach ($agent in Get-PnPCopilotAgent) {
    $item = Get-PnPFile -Url $agent.ServerRelativeUrl -AsListItem
    Get-PnPProperty -ClientObject $item -Property HasUniqueRoleAssignments | Out-Null
    [pscustomobject]@{
        Agent  = $agent.CustomCopilotConfig.GPTDefinition.Name
        File   = $agent.ServerRelativeUrl
        Unique = $item.HasUniqueRoleAssignments
    }
}

HasUniqueRoleAssignments is the question that matters first: an agent inheriting the library's permissions is shared with whoever the library is shared with, and nobody decided that on purpose.

Example output

Text
Agent             File                                        Unique
-----             ----                                        ------
Budget assistant  /sites/finance/SiteAssets/Budget Q3.agent    False
Invoices          /sites/finance/SiteAssets/Invoices.agent      True

False means the agent is as widely available as the library holding it. True means somebody set permissions on this one, and the next read is which.

Explanation

Microsoft documents both halves of this on the same page, and they are easy to read as one sentence when they are two.

The first half: agents in SharePoint are .agent files, and "the permissions on the .agent file determine who can access or edit the agent". That is the sharing you performed.

The second half: "if a user has access to the agent but not to the site or document library it references, the agent's responses for this user don't include content from those restricted sources". That is the sharing you did not perform, and could not have.

So an agent creates no new access. It also removes none. What it changes is speed: content that was reachable by somebody willing to search for it is now reachable by somebody who asks a question in plain language. An organisation with a permission model it never tested has not acquired a new problem here, it has acquired a faster reader of the old one.

The practical consequence for a review is an ordering. Reading the agent's permissions tells you who holds it. Reading its sources, and then the permissions on those sources, tells you what any of them can actually obtain. Doing the first and calling it an assessment is the mistake this page exists to prevent.

Who was allowed to make it in the first place.

The question above assumes an agent exists. Who could have made it is a different question with a documented answer, and the answer is wider than most people assume.

Building is included. Copilot Chat is available at no extra cost to Entra account users on ordinary Microsoft 365, Office 365, Teams and education plans

  • Business Basic upward, E1 upward, F1, F3, Teams Essentials, Office 365 A1 - with no Copilot add-on in the list. Microsoft states plainly that Copilot Chat users can build agents from the chat UX in the Microsoft Copilot Agent Builder, and the Copilot Studio release note that shipped it says all Copilot Chat users automatically get this feature.

What separates a free agent from a billed one is what it is grounded on, and Microsoft draws the line in two sentences:

Declarative agents that are grounded in instructions and public websites are available at no additional cost. These agents are available by default.

Agents that access shared tenant data, such as SharePoint or Graph Connector content, are billed based on metered consumption. Agents utilizing metered consumption are off by default for users in Copilot Chat.

So an ordinary licensed user can open Agent Builder and publish an agent today without anybody approving it or paying anything, provided that agent is grounded in its own instructions and public web pages. Pointing one at a SharePoint library is the step that needs either a Microsoft Copilot licence or pay-as-you-go billed to an Azure subscription, and until an administrator sets that up it is off.

For a review this is an ordering, not a reassurance. The tenant has no Copilot licences does not establish nobody here can publish an agent. It establishes that any agent published here is instruction-and-web grounded, which is a different and much narrower statement, and it is worth writing down as the narrower one.

There is a control, and it has a name. Administrators can control whether Agent Builder is available at all, through Manage agents for Microsoft 365 Copilot in Integrated Apps in the Microsoft 365 admin center. Whether it is set in a given tenant is read there, not from the presence or absence of agents.

Production considerations

  • This is a read. Nothing here grants, revokes or shares anything.
  • Inherited permissions are the common case and the quiet one. An agent in Site Assets is available to the site's members unless somebody changed it, and unless somebody changed it is not a control.
  • The answer is bounded by the identity running it. Agents in sites this identity cannot open do not appear, and their absence looks identical to there being none.
  • Two reads make an assessment. This one, and the sources the agent points at. Either alone is a fact; only both together are an answer.

None yet. Whether an agent should carry unique permissions is not something Microsoft documents a requirement or a recommendation for, and a rule built on that silence would be an opinion with a rule's authority. What is observable here is worth recording as evidence long before anybody decides what it should be.

References

Found something wrong? Suggest a correction. The article source is not public; the engine it cites is.

What this answer underwrites

The engine reads these Microsoft operations to collect evidence, so what is established here is what those collectors rest on.

  • agentsthe Copilot agents in one site, and the sources each declares