AB-900 Copilot and Agent Administration: Licenses, Pay-As-You-Go Billing, Usage Reports, Prompts and Agent Governance
Copilot and agent administration is the routine admin work that keeps Microsoft 365 Copilot and agents running in a tenant: assigning licenses, running pay-as-you-go billing policies, measuring usage, managing prompts, and controlling, approving and monitoring agents. This lesson covers AB-900 task 3.2. You will learn where Copilot licenses are assigned and why one sometimes doesn't take effect; what a pay-as-you-go billing policy needs, how its budget behaves and where its spend shows; how the Copilot usage report and Copilot Analytics measure adoption; how saved, shared, scheduled and organizational prompts differ; and how admins set agent access, approve agents in the Microsoft 365 admin center and monitor them there and in the Power Platform admin center.
On this page10 sections
- Assigning Microsoft 365 Copilot licenses
- When an assigned license doesn't show Copilot yet
- Setting up a Copilot pay-as-you-go billing policy
- Budgets, connected services and viewing spend
- Monitoring Copilot usage and adoption
- Managing prompts: saved, shared, scheduled and organizational
- Configuring user access to agents
- Creating an agent with Agent Builder
- The approval process for agents
- Monitoring agents and managing their lifecycle
- Assign Microsoft 365 Copilot licenses to users or groups with the least-privileged role, and explain why an assigned license may not show Copilot yet
- Set up a Copilot pay-as-you-go billing policy, including its Microsoft 365 role, Azure subscription and Azure permission prerequisites
- Configure billing-policy budgets and service connections, and find pay-as-you-go spending
- Choose between the Microsoft Copilot usage report, the readiness report and the Copilot Dashboard to monitor usage and adoption
- Distinguish saved, shared, scheduled and organizational prompts, including how each is deleted and how admins turn scheduled prompts off
- Configure user access, publisher access and sharing for agents, and describe how users create agents with Agent Builder
- Explain the agent approval process and the lifecycle actions used to monitor and govern agents
Assigning Microsoft 365 Copilot licenses
Microsoft 365 Copilot licenses are assigned in the Microsoft 365 admin center, either from Billing > Licenses (select the Microsoft 365 Copilot product, then assign, remove or reassign) or from a user's Licenses and apps tab under Users > Active users. Licenses go to individual users or to groups. No other admin center hands out this license: the Power Platform admin center governs environments and Copilot Studio agents, the Microsoft Purview portal handles compliance, and the Microsoft 365 Apps admin center manages app policies and update settings.
Per-user or group-based assignment
Assigning to a group makes the license follow membership: a person added to the group receives the license, and a person removed from it gives the license back, with no admin step for each change. Assigning to individuals works too, but someone must act on every join and leave. The license assignment itself is what turns Copilot on for a person; settings elsewhere that merely target a group for other purposes don't grant it.
Who should do it: least privilege
| Role | What it is for | Fits Copilot license work? |
|---|---|---|
| License Administrator | Assign, remove and update license assignments for users and groups | Yes, the least-privileged role for assigning licenses |
| Billing Administrator | Make purchases, manage subscriptions and billing, set up pay-as-you-go billing policies | Buys licenses; not the role for assigning them |
| Reports Reader | View usage reports, including Copilot usage | No, read-only |
| Global Administrator | Everything in the tenant | Works, but far beyond least privilege |
When an assigned license doesn't show Copilot yet
A Copilot license takes effect only for an eligible user on a supported app, and even then it can take up to 24 hours for Copilot to appear in some apps; the user may need to restart or refresh the app. Three rules cover most "I have a license but no Copilot" cases:
- Guests and cross-tenant users aren't supported. Assigning Copilot licenses to cross-tenant users, including guest users, isn't supported. Copilot for such a person comes through their own home organization.
- Update channel matters for the desktop apps. Copilot is available in every Microsoft 365 Apps update channel except Semi-Annual Enterprise Channel. A device on Semi-Annual Enterprise Channel gets Copilot once it moves to a channel such as Current Channel or Monthly Enterprise Channel.
- Timing. Assignment propagates to the apps gradually, so for a freshly licensed, eligible user on a supported channel, waiting and then restarting or refreshing the app is the first step.
The Microsoft 365 Copilot license already includes Copilot in Word, Excel, PowerPoint, Outlook and Teams. Pay-as-you-go billing exists for metered use by people who don't hold that license.
Setting up a Copilot pay-as-you-go billing policy
A pay-as-you-go billing policy connects metered Copilot usage, such as agents used by people without a Copilot license, to an Azure subscription so the organization pays only for what is used. It is created in the Microsoft 365 admin center, in the Copilot area's billing settings (Microsoft is moving these pages under cost management, so the exact menu name can change). Comparing pay-as-you-go with the monthly license as a buying model is covered in the Copilot and agent features lesson; this section is about running the policy.
What setup needs
- A Microsoft 365 admin role: Billing Administrator, AI Administrator or Global Administrator.
- An Azure subscription in the same tenant and a resource group in it. Both can exist beforehand or be created inside the setup wizard.
- Azure rights: the person creating the policy needs Owner or Contributor on the subscription and the resource group. This is Azure role-based access control, separate from Microsoft 365 roles.
- A user scope: the policy covers all users or a specific group.
The two permission layers are independent, and each must be met on its own terms: Microsoft 365 roles are granted in Microsoft Entra ID and confer nothing in Azure, while Azure roles are granted on the subscription or resource group. The wizard lists only subscriptions on which the signed-in admin has a role that allows changes, Owner or Contributor; a read-only Azure role can view costs but can't link a subscription.
Serving people who don't hold a Copilot license is the point of the policy, so licensing those users is not part of setup.
Budgets, connected services and viewing spend
Once a billing policy exists, an admin manages three things on it: its budget, which services it is connected to, and how much it has spent.
Budgets notify; they don't stop usage
A budget has an amount, a reset period (month, quarter or year), recipient groups who get the emails and alert percentages in addition to the default alert at 100%, for example 80%. A budget is not enforced: when spending passes it, recipients are emailed and usage continues uninterrupted. To limit who can generate charges, scope the policy to a group or disconnect it from a service.
Connecting the policy to a service
A new policy bills nothing until it is connected to a pay-as-you-go service, such as Copilot Chat (agents for unlicensed users) or SharePoint agents. On the pay-as-you-go services list, the admin selects the service and sets the policy to Connected. If unlicensed users still can't use metered agents after a policy is set up, a missing connection is the usual cause. Disconnecting a policy can take up to two hours to take effect. An admin can also edit a policy's users and budget, or delete a policy that is no longer needed.
Where spending shows
Pay-as-you-go charges are money on an Azure subscription, so they show in billing views. In the Microsoft 365 admin center, the policy's Budget tab shows current-month spend and a chart of the last six months. In Azure, Microsoft Cost Management shows the charges on the linked subscription to anyone with at least read access to the billing resource group. Reports built to measure adoption or record interactions count people and activity, not cost, so they don't show what a policy has spent.
Monitoring Copilot usage and adoption
Copilot usage is monitored in two places: the Microsoft Copilot usage report in the Microsoft 365 admin center for IT admins, and Copilot Analytics, whose Copilot Dashboard in Viva Insights serves business leaders.
The Microsoft Copilot usage report
Under Reports > Usage, the report compares enabled users (people holding a Copilot license) with active users over 7, 28, 90 or 180 days, gives an active-users rate and breaks adoption down by app (Teams, Outlook, Word, Excel, PowerPoint and others).
- Active means an intentional action. A user counts as active only after doing something deliberate with Copilot, such as submitting a prompt. Holding a license makes someone enabled; having Copilot available, or launching it without interacting, doesn't make them active. A user who is active in any one app is counted in the overall active total as well as in that app's figure.
- Names are concealed by default. Usage reports replace user names, display names, groups and sites with random strings. Showing real names is a tenant-wide choice in Settings > Org settings > Reports, and it governs every view of the reports, downloads included.
- Who can view: Reports Reader is the read-only role for usage reports.
The Microsoft Purview audit log does record Copilot interactions, but Microsoft says audit data is for security and compliance and isn't meant as the basis for usage reporting.
Copilot Analytics
Copilot Analytics groups Microsoft's Copilot measurement tools:
| Tool | Where | Audience and purpose |
|---|---|---|
| Microsoft Copilot readiness report | Microsoft 365 admin center | IT admins planning who should get licenses next |
| Microsoft Copilot usage report | Microsoft 365 admin center | IT admins measuring how licensed users use Copilot, by app |
| Microsoft Copilot Dashboard | Viva Insights (web app, Teams) | Leaders and managers: readiness, adoption, impact and sentiment, aggregated with a minimum group size, no admin center access needed |
| Advanced reporting | Viva Insights | Analysts building custom Copilot reports and queries |
Senior leaders identified from Microsoft Entra ID organizational data get automatic access to the Copilot Dashboard, and others can be given delegated access.
Configuring user access to agents
Admins control who can use, install and share agents on the agent settings page of the Microsoft 365 admin center. Three settings look alike but govern different things:
| Setting | What it controls | Options |
|---|---|---|
| User access | Which people can access and install agents | All users (default), No users, or Specific users or groups |
| Agent and plugin access | Which publisher types users can install from | Agents from Microsoft, from your organization, from external publishers (each can be allowed or cleared) |
| Sharing | Who can share agents built with Agent Builder across the organization | All users, No users, or Specific users or groups |
- To pilot agents with one group, set User access to Specific users or groups. Copilot Chat itself stays available to everyone else.
- To keep out third-party agents before anyone installs them, clear external publishers in Agent and plugin access; those agents disappear from the store. Because the setting works by publisher type, it also covers agents of that type that haven't been published yet.
- Sharing governs organization-wide sharing of Agent Builder agents. Sharing an agent with specific named people stays available whatever this setting says, and Copilot Studio agents follow Copilot Studio's own sharing controls.
Beyond these tenant-wide settings, each agent in the registry has its own availability (who can install it), and individual agents can be blocked or pinned.
Creating an agent with Agent Builder
Users create their own agents with Agent Builder, which opens from the Microsoft 365 Copilot app (microsoft365.com/chat or office.com/chat) and from Microsoft Teams on desktop and web. The flow has three steps:
- Describe the agent in plain language and let Copilot draft it.
- Configure it: name, instructions, knowledge sources (such as SharePoint sites or files) and starter prompts.
- Test it in the built-in test pane, then keep it private, share it with people, or submit it for the organization.
Agents that need custom actions, workflows or broader publishing can be copied from Agent Builder to Copilot Studio, the full maker tool. What makes an agent more than a reusable prompt is its own instructions, knowledge sources and starter prompts, and the test pane that checks them together. Starter prompts set in an agent appear only inside that agent. Authoring happens in Agent Builder or Copilot Studio; the admin centers come in afterwards, to approve, govern and monitor.
The approval process for agents
When a maker submits an agent for the organization, it appears under Requests on the agents page of the Microsoft 365 admin center, and an admin either publishes it to the store or rejects it. Requests is the queue of items waiting for an admin: new submissions (Pending review), updates to published agents (Pending update), agents awaiting activation (Pending activate), and users' requests to install a blocked Microsoft-built agent.
The Publish to store wizard
- Audience: which users or groups can install the agent.
- Preinstall (optional): which users or groups get it installed for them. Preinstall is the step that puts the agent into people's apps, and it is set separately from the install audience.
- Policy template: the default template, an existing one or a custom one.
- Consent: the admin consents to the permissions the agent requests.
Reject submission declines a pending request, and the maker can revise and resubmit. Agents that are already published are managed with the lifecycle actions in the next section.
Updates to an approved agent
An update to a published agent needs its own review. It shows in Requests with an Update pending status, and until an admin approves it, everyone keeps using the previous approved version.
Monitoring agents and managing their lifecycle
Agents are monitored in two admin centers that see different agents: the Microsoft 365 admin center for the organization's agent inventory, usage and lifecycle actions, and the Power Platform admin center for operational insights on Copilot Studio agents.
| Microsoft 365 admin center (Agent Registry, agent usage) | Power Platform admin center (Copilot area, Copilot Studio page, Monitor) | |
|---|---|---|
| Agents covered | Agents in the tenant, including Agent Builder and Copilot Studio agents | Copilot Studio agents; Agent Builder agents aren't included |
| What you see | Inventory: name, creator, creation date, host products, availability status; agent usage | Active agents (sessions in the last 28 days), agent session success rate, message consumption |
| What you can do | Block, unblock, delete, restore, assign owners, pin, manage availability | Govern environments and capacity for Copilot Studio |
If Agent Builder agents are missing from the Power Platform view, that's expected: use the Agent Registry for a full inventory.
Lifecycle actions
- Block / Unblock: Block stops every user in the organization from using an Agent Builder or Copilot Studio agent at once, wherever it is hosted (Copilot, Teams, Outlook and others); for a SharePoint or Microsoft Foundry agent, blocking affects only its availability in Copilot Chat. A block has no time limit and leaves the agent's configuration intact; Unblock returns it.
- Delete / Restore: Delete is a soft delete. The agent can be restored for 30 days, after which it is permanently deleted automatically; an admin can also delete permanently straight away. A restore brings the agent back as it was, ownership included. (Contrast organizational prompts, whose deletion is permanent with no window.)
- Uninstall: removes an admin-installed copy from people's apps; the agent's availability in the store is a separate setting.
- Ownership: Assign new owner reassigns an agent that has no owner (for example, after the maker leaves) or is active; the new owner gets full edit and delete rights and the files the previous owner uploaded, and the previous owner loses all access. Add owner adds an owner to an Agent Builder agent while keeping its existing owners. Ownership is an agent setting, separate from licensing.
Tip. Expect short admin scenarios that state a requirement plus a constraint, typically about privilege, scope, cost, timing or reversibility, and then ask which admin center, role, setting, report or lifecycle action meets it. Know the near-twins: License Administrator vs Billing Administrator, per-user vs group-based license assignment, Microsoft 365 roles vs Azure Owner/Contributor for billing policies, budget alerts vs a spending cap, the usage report vs the readiness report vs the Copilot Dashboard, enabled vs active users, saved vs shared vs scheduled vs organizational prompts, agent User access vs Agent and plugin access vs Sharing, audience vs preinstall in the publishing wizard, block vs delete vs uninstall, and Assign new owner vs Add owner. Harder items combine two facts, such as which admin center sees which agents and what fills the gap, and a few ask you to select two answers. Prices and Copilot Credit rates aren't needed.
- Copilot licenses are assigned in the Microsoft 365 admin center (Billing > Licenses or a user's Licenses and apps); group-based assignment makes the license follow group membership.
- License Administrator is the least-privileged role for assigning licenses; Billing Administrator buys and manages billing.
- Guests and cross-tenant users can't hold a Copilot license, Semi-Annual Enterprise Channel doesn't get Copilot, and Copilot can take up to 24 hours to appear after assignment.
- A pay-as-you-go billing policy needs a Billing, AI or Global Administrator plus Owner or Contributor on an Azure subscription and resource group in the same tenant.
- Budgets send alerts at chosen percentages but never stop usage; a policy bills nothing until it is connected to a service such as Copilot Chat or SharePoint agents.
- Pay-as-you-go spend shows on the policy's Budget tab and in Microsoft Cost Management, not in usage reports.
- The Copilot usage report counts enabled vs active users, where active needs an intentional action; names are concealed until the Reports org setting is changed.
- The Copilot Dashboard in Viva Insights gives leaders readiness, adoption, impact and sentiment without admin center access.
- Saved prompts are private, team-shared prompts reach one team, scheduled prompts run only for their owner, and organizational prompts (AI Administrator or Search Editor) reach everyone and are deleted permanently.
- Admins turn scheduled prompts off by disabling connected experiences in Office through Cloud Policy, which also turns off other connected experiences; the change isn't retroactive: schedules already set up run to completion, while users lose the controls to change them.
- Agent User access limits people, Agent and plugin access limits publisher types, and Sharing covers only Agent Builder agents; Requests holds submissions and pending updates, block pauses an agent indefinitely, and delete is restorable for 30 days.
Frequently asked questions
Where do I assign Microsoft 365 Copilot licenses?
Microsoft 365 Copilot licenses are assigned in the Microsoft 365 admin center, either from Billing > Licenses by selecting the Copilot product, or from a user's Licenses and apps tab under Users > Active users. You can assign to individual users or to groups; with group-based assignment, people get the license when they join the group and lose it when they leave. The License Administrator role is enough for this work.
Why doesn't a user see Copilot after I assigned a license?
After a Microsoft 365 Copilot license is assigned, some apps can take up to 24 hours to show Copilot, and the user may need to restart or refresh the app. Also check that the user isn't a guest or cross-tenant user, which isn't supported, and that their desktop apps aren't on Semi-Annual Enterprise Channel, the one update channel without Copilot.
Does a Copilot pay-as-you-go budget stop spending when it is reached?
No. A budget on a Copilot pay-as-you-go billing policy only sends email alerts to the chosen recipient groups at the alert percentages you set, plus the default 100% alert. Usage continues after the budget is passed. To limit spending, scope the policy to a smaller group or disconnect it from the service.
What do I need before creating a Copilot pay-as-you-go billing policy?
You need the Billing Administrator, AI Administrator or Global Administrator role in Microsoft 365, an Azure subscription in the same tenant with a resource group (both can be created during setup), and Owner or Contributor rights on that subscription and resource group. After creating the policy, connect it to a service such as Copilot Chat or SharePoint agents, or nothing is billed to it.
What counts as an active user in the Microsoft Copilot usage report?
In the Microsoft Copilot usage report, a user is active only after an intentional Copilot action, such as submitting a prompt. Holding a license makes someone an enabled user, and opening the Copilot pane without doing anything isn't counted. The report compares enabled and active users over 7, 28, 90 or 180 days and breaks activity down by app.
Who can manage organizational prompts, and can a deleted one be restored?
Organizational prompts for Copilot are managed in the Microsoft 365 admin center under Copilot > Prompts by an AI Administrator or Search Editor (or a Global Administrator). Deleting an organizational prompt is permanent, with no restore window, so export all prompts or save a copy first; a prompt deleted by mistake has to be re-created from that copy.
What is the difference between blocking and deleting an agent?
In the Microsoft 365 admin center, blocking an Agent Builder or Copilot Studio agent stops everyone in the organization from using it, with no time limit, and unblocking returns it with its configuration intact (blocking a SharePoint or Microsoft Foundry agent affects only its availability in Copilot Chat). Deleting is a soft delete: the agent can be restored for 30 days and is then permanently deleted automatically. Use block to pause an agent and delete only to retire it.
Why don't Agent Builder agents appear in the Power Platform admin center?
The Copilot Studio page in the Power Platform admin center reports on Copilot Studio agents, such as active agents in the last 28 days, session success rate and consumption, and it doesn't include agents built with Agent Builder. For an inventory of all the organization's agents with creator and availability status, use the Agent Registry in the Microsoft 365 admin center.
Source
This lesson covers the "Perform basic administrative tasks for Copilot and agents" domain of the official AB-900 exam guide. Vendors revise their guides — check the source for the current version.
Sign up free to mark lessons complete, bookmark topics and track your exam readiness.