Did you know everyday about 2 billion documents are added to Microsoft 365? As workplace content expands at an unprecedented pace, organisations need smarter, more efficient ways to locate information and put it into action. To support this, Microsoft launched SharePoint Agents in late 2024.
One of the biggest strengths of SharePoint agents is how easy they are to create. There’s no heavy technical setup, no complex build process. Essentially, if you have edit permissions on a SharePoint site, you can spin up an agent in a few clicks.
But with that simplicity comes a new set of questions. Who should be creating agents? What information could they surface? How do you make sure sensitive content stays protected? What happens if someone outside the intended team finds one?
In this blog, we’ll unpack what SharePoint agents are, why they matter, and answer some of the top questions organisations are asking right now as they start working with this new capability.
1. What is a SharePoint Agent?
A SharePoint agent is an AI-powered assistant that lives directly inside a SharePoint site.
It’s designed to help you find information, answer questions, and work with the content stored in that site, like documents, pages, or lists. It’s fairly lightweight, simple to create, and scoped to the information you already have in SharePoint.
There are two types of agents on a SharePoint site:
Ready-made agent
Custom-built agent
Ready-made SharePoint Agent. Image credit: Microsoft
Every SharePoint site automatically comes with a ready-made agent, scoped to the content of that site. Ready-made agents require no setup from site owners or admins, they appear by default and allow users to quickly ask questions, explore documents, and find information they already have access to.
Note: These agents don’t have an associated .agent file and are tied specifically to that site’s content.
Custom Built SharePoint Agent. Image credit: Microsoft
Custom-built agents offer more flexibility. Users with edit permissions can create their own agents by selecting specific sites, libraries, or folders as knowledge sources. Custom agents are saved as .agent files in the document library, and they can be tailored with a custom name, icon, behaviour, and broader content scope.
2. How do I know whether I need a Copilot agent or a SharePoint agent?
If you’re wondering whether you should create a SharePoint agent or something bigger like a Copilot Studio agent, the very first (and honestly easiest) question to ask yourself is:
“Does the process relate to a SharePoint site, list, document library, or content already stored in SharePoint?”
If the answer is yes, the information, the documents, the lists you need are already sitting inside SharePoint, then a SharePoint agent is probably your best bet! Because SharePoint agents are designed exactly for that: making SharePoint content easier to find, understand, and interact with through natural language.
If your process goes beyond simply surfacing or reasoning over SharePoint documents, like if you need to connect to another system, kick off an approval, write back data, or integrate APIs, then you’re stepping into Copilot Studio territory.
Think of it this way:
- SharePoint agent = “Help me find and use what’s already inside SharePoint.”
- Copilot Studio agent = “Help me trigger or automate actions across different systems and apps.”
Note: Advanced customisation for SharePoint Agents is on the roadmap and will be available soon.
Advanced customisation for SharePoint agents in Copilot Studio is coming soon
3. What does it cost? What license do I need?
If your organisation already has Microsoft 365 Copilot licenses, good news! SharePoint agents are included at no extra cost. You can create, use, and share them freely, without worrying about per-use charges or complex billing setup. Everything’s covered as part of your existing Copilot subscription.
Can I use SharePoint agents without a Copilot license?
If you don’t have Copilot licenses yet, you can still use SharePoint agents through Microsoft’s pay-as-you-go option. In this consumption model, you’re only charged for what you use, specifically, $0.01 per message. Since most interactions involve a series of messages (like processing your question and generating a detailed response), a typical query might cost around $0.12. This setup gives organisations flexibility. You can trial SharePoint agents without needing to license everyone for Copilot, and scale up later if it proves valuable.
It’s also worth noting that there’s no difference in what you get between the two options. Whether you’re using SharePoint agents through a Microsoft 365 Copilot license or through the pay-as-you-go model, the features and capabilities are exactly the same. Users can create, use, and interact with agents in the same way, the only real difference is how the usage is billed.
How many messages will I use with a SharePoint Agent?
The number of messages an agent uses can vary depending on how it’s set up and what it’s doing. For example, more complex agents, or ones that are used more frequently, will naturally generate higher usage. SharePoint agents also make use of features like generative answers and tenant graph grounding, which can increase message consumption. Learn about consumption-based pricing for SharePoint agents here.
4. Where do I find SharePoint agents?
Go to any modern SharePoint site (e.g. a team site or communication site). Look for the Copilot icon (usually in the top-right corner or along the left-hand navigation) You will be able to see the ready-made agent and any custom agents created for that SharePoint site.
5. Who can create and use a SharePoint agent?
Anyone who has edit permissions on a SharePoint site can create, customise, and share a SharePoint agent. That means site owners, designers, or members with editing rights can build agents tailored to their team’s needs; like answering common HR questions or surfacing key project documents.
As for using an agent, it’s all about your existing SharePoint permissions.
Agents can only return information you already have access to, so rest assured they won’t reveal anything hidden or private. So if a document is stored in a site you can access, the agent can use it to answer your question. If it’s not, it won’t be included in the response.
Only people who can access the. agent file can use or open that agent. If someone doesn’t have permission to open the file, they can’t run the agent.
6. Can I disable SharePoint agents?
This question is probably the top-asked about SharePoint agents. We know IT and security teams in particular are worried about people creating agents without enough oversight. To mitigate this risk, SharePoint admins can block agents on sensitive sites by turning on Restricted Content Discovery.
Once enabled, users on that site:
Won’t see the Copilot icon
Can’t use the ready-made agent
Can’t create new agents
Can’t ground other agents with content from that site
The site itself remains accessible as usual, but it’s excluded from any Copilot or agent-based AI experiences.
7. Should I be concerned about data leakage?
As we mentioned earlier, anyone with edit permissions on a SharePoint site can create, customise, and share a SharePoint agent. And since edit permissions are fairly common across many sites, especially for team leads, content owners, or power users, creating an agent is relatively easy for a lot of people.
That ease of access is a great enabler, but it also raises really valid concerns, especially for IT teams, data governance leads, and security teams. The obvious question is:
“What exactly will this agent surface?”
The answer: SharePoint agents can only return content that the person asking the question already has permission to see. They don’t override SharePoint’s security model or expose hidden files. Still, because they make it easier to access content across a site, and can summarise or answer questions based on large sets of documents, many teams are thinking carefully about oversight, content quality, and data sensitivity before rolling them out widely.
Agents also support your organisation’s conditional access, endpoint protection, DLP policies, and sensitivity labels, so existing security settings stay fully in effect.
8. What if someone finds the .agent file?
Each agent is stored as a .agent file. That means if someone doesn’t have permission to that file, they won’t even see that the agent exists, just like with any other document in SharePoint. It won’t show up in search, the library, or the agent picker.
Even if the .agent file is shared more broadly and someone outside the intended audience opens it, the agent will only return responses based on content that user already has access to. If they don’t have permission to the underlying files the agent uses, it simply won’t surface that information.
Example:
Your HR team creates a SharePoint agent grounded in a folder of performance review documents to help handle frequent exec requests. If an executive assistant without access to those HR files somehow ends up with access to the .agent file, they could open the agent, but they’d get no useful answers. The agent wouldn’t be able to see or return any of the restricted content, because the assistant doesn’t have permission to those files in the first place.
9. Can I change what a user can access with SharePoint agents?
Not directly through the agent itself, but yes, you can manage what users see by setting the right permissions on your SharePoint sites and content. Agents only respond based on what a user already has access to, so if a file or site is restricted, it won’t be included in their results. If you need tighter control, SharePoint admins can use tools like Restricted Access Control policies or sensitivity labels with Microsoft Purview DLP to manage visibility and protect sensitive content.
10. How do I monitor SharePoint agent usage?
Once your agents are live, it’s a good idea to keep an eye on how they’re being used and that looks a little different depending on your role and access.
If you’ve got access to the site, you can open any .agent file and check how many people have viewed it, right from the file’s details pane. You can also search for .agent to find all agents on a site, or head to Site usage to see which files (including agents) are getting the most attention.
If you’re a SharePoint admin, there are a few more tools at your fingertips. PowerShell lets you pull a full inventory of agents across your environment, and Microsoft Purview shows who’s been using them and when. You can even track usage costs through Microsoft Cost Management, and soon, SharePoint Advanced Management will offer deeper insights into where agents are created and which policies are in place.
So rest assured, there’s plenty of visibility, no matter your role. Microsoft has great guidance on monitoring agent usage here.
Image credit: Microsoft
So, is your organisation ready for SharePoint agents?
Before you get started, it’s important to make sure your data, permissions, and governance settings are in good shape. As you know by now, SharePoint agents work with what they can access, and that means the right content needs to be in the right place, with the right access.
If you’re not sure where to begin, we can guide you through the steps to get everything aligned. From reviewing site architecture, data security audits, to helping you feel confident about content exposure, we’re here to support you.
Ready to explore what SharePoint agents can do for your organisation? Get in touch, we’d love to help you get started.
