Agent Governance Explained- How IT Can Enable the AI Agent Revolution with Thomas Zou [Microsoft]

1
00:00:00,000 --> 00:00:01,000
We can.

2
00:00:01,000 --> 00:00:08,280
Yeah, welcome back to the MC65 and podcast, the podcast where we explore Microsoft AI,

3
00:00:08,280 --> 00:00:12,880
co-pilot, power platform and the technologies that jet in the future of work.

4
00:00:12,880 --> 00:00:19,360
Over the past years, we have seen an exploding of AI agents, but thousands of agents,

5
00:00:19,360 --> 00:00:24,760
potentially being created inside an organization, comes a new challenge, who go of them,

6
00:00:24,760 --> 00:00:28,200
who secure them, who decide what they can access.

7
00:00:28,200 --> 00:00:31,320
Today's guest is helping define the future.

8
00:00:31,320 --> 00:00:36,880
Joining us, joining me today is Thomas Stoo, product marketing manager for Microsoft

9
00:00:36,880 --> 00:00:42,040
co-pilot studio with a strong focus on agent governance, helping organization scale AI

10
00:00:42,040 --> 00:00:44,440
safely, while empowering innovation.

11
00:00:44,440 --> 00:00:49,440
Today we'll discuss about co-pilot studio governance, security, lifestyle, a life cycle

12
00:00:49,440 --> 00:00:54,400
management, compliance, IT leadership and why governance is not the blocker.

13
00:00:54,400 --> 00:00:56,520
It's a foundation of enterprise AI success.

14
00:00:56,520 --> 00:00:59,800
Yeah, welcome Thomas, today ends the 65 podcast.

15
00:00:59,800 --> 00:01:03,000
Well, thank you for having me, Marko.

16
00:01:03,000 --> 00:01:06,600
And thank you for giving me this opportunity to talk about governance for agents.

17
00:01:06,600 --> 00:01:08,840
Yeah, it's really interesting.

18
00:01:08,840 --> 00:01:16,360
But before we deep dive into the topic again, can you tell a little bit about your journey,

19
00:01:16,360 --> 00:01:19,160
how you end up on Microsoft?

20
00:01:19,160 --> 00:01:20,160
Yeah.

21
00:01:20,160 --> 00:01:25,080
Well, I started as a journalist.

22
00:01:25,080 --> 00:01:28,560
So it was born, raised, John, a startless journalist.

23
00:01:28,560 --> 00:01:34,920
So to me, storytelling and narratives are always very important to me.

24
00:01:34,920 --> 00:01:40,360
And that is fundamentally how I think about my work is tell stories of the product, tell

25
00:01:40,360 --> 00:01:43,720
stories of the users of our product.

26
00:01:43,720 --> 00:01:48,040
And then I, after graduating from breast school, I went to a startup for a couple of years,

27
00:01:48,040 --> 00:01:51,120
and then in 2022 I enjoyed Microsoft.

28
00:01:51,120 --> 00:01:56,560
My journey within Microsoft has been full of adventures as well.

29
00:01:56,560 --> 00:02:00,760
So I was a PMM working on the security side of things.

30
00:02:00,760 --> 00:02:01,760
So defender.

31
00:02:01,760 --> 00:02:10,760
And earlier, 2026, I joined the COVAILA studio team as the PMM covering governance for the

32
00:02:10,760 --> 00:02:11,760
platform.

33
00:02:11,760 --> 00:02:18,320
Yeah, what does a product marketing manager actually do?

34
00:02:18,320 --> 00:02:21,040
Yeah, that's a great question.

35
00:02:21,040 --> 00:02:29,200
So my way about thinking product marketing manager is really, if you divide the traditional

36
00:02:29,200 --> 00:02:36,320
founders role into two parts, one is more technical, one is more go-to-market focused, then

37
00:02:36,320 --> 00:02:42,640
you would say that the more technical side of the product owner might be the product manager.

38
00:02:42,640 --> 00:02:50,080
And then the more go-to-market, the more sales or enablement side of the product owner or

39
00:02:50,080 --> 00:02:52,000
founder would be the product marketing manager.

40
00:02:52,000 --> 00:02:54,680
There are really two sides of the same coin.

41
00:02:54,680 --> 00:02:58,920
More specifically, what I do on a day-to-day basis is a couple of things.

42
00:02:58,920 --> 00:03:01,880
One is the positioning and the messaging of the product.

43
00:03:01,880 --> 00:03:06,840
So, you know, different people have different opinions about what the product is good at,

44
00:03:06,840 --> 00:03:11,160
whether the product is not good at, or how to differentiate.

45
00:03:11,160 --> 00:03:17,520
But what we would potentially want to do is to summarize a systematic way to talk about

46
00:03:17,520 --> 00:03:19,440
what makes the product unique.

47
00:03:19,440 --> 00:03:23,240
And then make sure that we convey that value clearly with our core audience, which is

48
00:03:23,240 --> 00:03:24,240
IDM.

49
00:03:24,240 --> 00:03:26,600
The second one is go-to-market strategy.

50
00:03:26,600 --> 00:03:32,960
So, defining how do you sell the product, defining how can you engage with our customers

51
00:03:32,960 --> 00:03:37,760
so that they can trust you, so that they can understand your value proposition.

52
00:03:37,760 --> 00:03:40,760
And the third one is content strategy.

53
00:03:40,760 --> 00:03:42,600
So similar to what we're doing right now.

54
00:03:42,600 --> 00:03:45,240
So we use different content forums.

55
00:03:45,240 --> 00:03:51,960
We use different content formats to talk about the value proposition and the differentiation

56
00:03:51,960 --> 00:03:54,080
of the platform.

57
00:03:54,080 --> 00:03:55,600
Yeah.

58
00:03:55,600 --> 00:04:02,000
And did you sell views for co-pilot in your daily work?

59
00:04:02,000 --> 00:04:03,760
Oh, yeah.

60
00:04:03,760 --> 00:04:08,640
I join this team because I'm a big fan of the product.

61
00:04:08,640 --> 00:04:12,480
And I just felt like there's such a wave that I cannot miss.

62
00:04:12,480 --> 00:04:19,040
And I felt like, you know, generate a Baye and Agentic Ai is the future.

63
00:04:19,040 --> 00:04:21,360
And I really wanted to be a part of it.

64
00:04:21,360 --> 00:04:23,720
That was one of the bigger incentives.

65
00:04:23,720 --> 00:04:25,480
Yeah, interesting.

66
00:04:25,480 --> 00:04:32,600
So actually, I say everyone, every company wants AI agent by the few organizations have

67
00:04:32,600 --> 00:04:35,000
a governance strategy.

68
00:04:35,000 --> 00:04:41,880
So what exactly is an agent, what exactly is agent governance?

69
00:04:41,880 --> 00:04:43,880
Right.

70
00:04:43,880 --> 00:04:50,920
So there's so many different ways of defining agent governance and different, depending

71
00:04:50,920 --> 00:04:56,840
who you ask, the practitioner view and leadership view and analyst view, but maybe different.

72
00:04:56,840 --> 00:05:03,280
But from my side, my personal take on it is a quite simple one is, how do you enable

73
00:05:03,280 --> 00:05:05,280
makers to innovate?

74
00:05:05,280 --> 00:05:06,280
Right.

75
00:05:06,280 --> 00:05:09,720
So it's the, you can't say it's the policy.

76
00:05:09,720 --> 00:05:11,720
You can say it's the process.

77
00:05:11,720 --> 00:05:12,880
You can say it's the technology.

78
00:05:12,880 --> 00:05:17,760
But ultimately, the goal of governance is not to become the police and then say, well,

79
00:05:17,760 --> 00:05:25,720
you cannot do is really to build a foundational infrastructure and framework so that your

80
00:05:25,720 --> 00:05:33,600
makers who are the adoptors of agent within organization can feel confident about how to innovate,

81
00:05:33,600 --> 00:05:38,280
how to experiment and how to deploy, how to scale.

82
00:05:38,280 --> 00:05:46,360
So those, those sat of rules or policy or process, however, call it together makes up to

83
00:05:46,360 --> 00:05:50,360
the agent governance.

84
00:05:50,360 --> 00:05:57,040
Did you see, yeah, misconceptions companies have about agent governance?

85
00:05:57,040 --> 00:05:59,280
Yeah, all the time.

86
00:05:59,280 --> 00:06:04,880
I think a lot of people when they think about governance, they have this very bleak and

87
00:06:04,880 --> 00:06:12,560
this dear view of someone that's really strict about policy and tell people, hey, you cannot

88
00:06:12,560 --> 00:06:14,600
do this, you cannot do that.

89
00:06:14,600 --> 00:06:20,640
Or people think that governance is really just about blocking everything or governance

90
00:06:20,640 --> 00:06:26,520
is about turning off things, not allowing makers to innovate and build.

91
00:06:26,520 --> 00:06:27,520
Right.

92
00:06:27,520 --> 00:06:33,520
In fact, for the longest time that is governance, that is how you prevent risks from happening

93
00:06:33,520 --> 00:06:39,880
without giving the right channels and opportunities for makers to innovate and build.

94
00:06:39,880 --> 00:06:44,680
But with modern technology, with infrastructure that you have, with co-pilot studio or other

95
00:06:44,680 --> 00:06:51,400
products, you can really have that granularity and layers of management and governance so

96
00:06:51,400 --> 00:06:57,200
that you don't have to always trade off one another between innovation and risks.

97
00:06:57,200 --> 00:07:05,640
You can have good control over risks while also enable or facilitate innovation.

98
00:07:05,640 --> 00:07:12,880
That is ultimately, I think, what makes up good and bad governance.

99
00:07:12,880 --> 00:07:17,800
And when or where should governance begin?

100
00:07:17,800 --> 00:07:27,160
Yeah, I would say it usually, for less, less, use a fictional organization, as I said,

101
00:07:27,160 --> 00:07:28,960
as an example.

102
00:07:28,960 --> 00:07:36,600
One thing would typically tell our customers is that from our observation, the adopters

103
00:07:36,600 --> 00:07:44,600
and the facilitators or the administrators of the adoption within an organization are usually

104
00:07:44,600 --> 00:07:46,960
not the same people.

105
00:07:46,960 --> 00:07:54,640
And the people who are responsible for hair governance a lot of times are ITAMX.

106
00:07:54,640 --> 00:07:56,880
And you asked the question of where to begin.

107
00:07:56,880 --> 00:07:59,560
I would say that it should begin with IT.

108
00:07:59,560 --> 00:08:06,880
It should begin with IT having a very good view about the reality and the readiness of

109
00:08:06,880 --> 00:08:11,400
the organization in terms of a couple of aspects, right?

110
00:08:11,400 --> 00:08:19,920
AI strategy, whether they have a good foundation for AI education, readiness for different

111
00:08:19,920 --> 00:08:25,320
and technology and business strategy, do they have good business process mapping?

112
00:08:25,320 --> 00:08:31,440
And then do they have the good cultural and behavioral enablement for their organization

113
00:08:31,440 --> 00:08:32,920
and employees?

114
00:08:32,920 --> 00:08:36,640
And the movement out from there is more so the governance and security.

115
00:08:36,640 --> 00:08:43,120
Okay, now if your organization is already ready for AI agent adoption, do they have the

116
00:08:43,120 --> 00:08:47,320
right and the full back mechanism when things go wrong?

117
00:08:47,320 --> 00:08:51,840
There's a process of what in there, she should think about adoption and governance and security.

118
00:08:51,840 --> 00:08:58,720
And then we have some really good content around this called AI readiness, agent readiness framework

119
00:08:58,720 --> 00:09:05,320
or agent readiness assessment that helps ITAMX to go through a survey for free and then quickly

120
00:09:05,320 --> 00:09:09,600
understand where they are in their agent adoption journey.

121
00:09:09,600 --> 00:09:15,200
But yeah, I think it should start with IT assessing, understanding their reality and then

122
00:09:15,200 --> 00:09:19,040
setting up a plan for their entire organization to adopt agents.

123
00:09:19,040 --> 00:09:23,600
Is it something like a maturity model?

124
00:09:23,600 --> 00:09:30,400
You have there for for for, yeah, measure the readiness or how it works.

125
00:09:30,400 --> 00:09:33,560
Yeah, you're right, Michael, it is like a maturity model.

126
00:09:33,560 --> 00:09:40,680
So we worked with analyst firms and also our internal customer adoption teams to basically

127
00:09:40,680 --> 00:09:47,080
summarize and synthesize the patterns of which the major customers are adopting agents and

128
00:09:47,080 --> 00:09:51,880
then we identified different stages of readiness and maturity for these customers and then

129
00:09:51,880 --> 00:09:58,440
we also have recommendations for what customers should do when they have identified there

130
00:09:58,440 --> 00:10:00,480
in a certain maturity model.

131
00:10:00,480 --> 00:10:06,480
So because when you are, when you, when it's the first time for you to hear about agent,

132
00:10:06,480 --> 00:10:11,600
then you're caught through actions and mechanism to adopt agent might be very different from

133
00:10:11,600 --> 00:10:16,320
a team that already have like three different tenants running for different governance models

134
00:10:16,320 --> 00:10:18,720
that needs to be consolidated.

135
00:10:18,720 --> 00:10:24,640
So we try to be customizable, we try to be flexible with our guidance and any development.

136
00:10:24,640 --> 00:10:29,800
Ultimately what we're trying to do in here is really to establish a AI center of excellence

137
00:10:29,800 --> 00:10:37,560
we found a lot of the times, agent adoption doesn't come from the bottom up necessarily.

138
00:10:37,560 --> 00:10:39,160
It's a it's a two way street, right?

139
00:10:39,160 --> 00:10:45,560
You need to have interest and passion from makers, but you also need guidance from what

140
00:10:45,560 --> 00:10:51,880
we call it like a governing body or a group of people who have a lot of expertise and best

141
00:10:51,880 --> 00:10:58,200
practices that pass down those knowledge and upskill the rest of the folks.

142
00:10:58,200 --> 00:11:01,120
Like the champion program, right?

143
00:11:01,120 --> 00:11:05,080
Exactly, exactly.

144
00:11:05,080 --> 00:11:12,760
I think when it comes to governance, there are two teams in the innovation team and the

145
00:11:12,760 --> 00:11:14,120
control team.

146
00:11:14,120 --> 00:11:19,640
So how did we find the balance between innovation and control?

147
00:11:19,640 --> 00:11:22,760
Yeah, that's a great question.

148
00:11:22,760 --> 00:11:31,080
In fact, we have a good content series on YouTube, specifically on the Power Platform community

149
00:11:31,080 --> 00:11:34,520
channel and the co-hosting YouTube channel talking about this.

150
00:11:34,520 --> 00:11:36,360
It's called agents under control.

151
00:11:36,360 --> 00:11:41,320
It talks about IT's point of view on how to potentially adopt and govern agents.

152
00:11:41,320 --> 00:11:46,520
But to answer a question, we just talked about this in an episode called what is zone governance?

153
00:11:46,520 --> 00:11:48,600
The answer is basically zone governance.

154
00:11:48,600 --> 00:11:53,040
And it's a term that is not invented necessarily by Microsoft.

155
00:11:53,040 --> 00:11:55,800
It is really an industry or a grid upon pattern.

156
00:11:55,800 --> 00:11:58,240
I'm sure you have heard of it.

157
00:11:58,240 --> 00:12:03,960
First brought out by Gartner and other analyst firms, but really it's a model for setting

158
00:12:03,960 --> 00:12:10,240
different governance policies and different boundaries for different types of innovation

159
00:12:10,240 --> 00:12:11,240
and adoption.

160
00:12:11,240 --> 00:12:19,600
Let's say if you have a group of users that are really, really experimental, they just want

161
00:12:19,600 --> 00:12:26,240
to play, they just want to have a sense of understanding of the product, then the risk

162
00:12:26,240 --> 00:12:35,040
tolerance level for this group of users might be very different from workloads or apps or

163
00:12:35,040 --> 00:12:40,560
agents that needs to go into production that connects with actual business data and

164
00:12:40,560 --> 00:12:42,800
it's exposed to the customer.

165
00:12:42,800 --> 00:12:49,600
So the idea is you define different innovation and risk tolerance based on different policy

166
00:12:49,600 --> 00:12:59,640
controls within what we typically use PowerColiform M in Center or Microsoft 365 at the center.

167
00:12:59,640 --> 00:13:05,440
And then you set the different policy talent for these zones.

168
00:13:05,440 --> 00:13:13,320
So we typically zone into three or four buckets, typically three, agree zone, the yellow zone

169
00:13:13,320 --> 00:13:23,320
and the red zone and the risk based on the colors, but restrictions and governance

170
00:13:23,320 --> 00:13:26,760
level of control also increase.

171
00:13:26,760 --> 00:13:35,400
So the idea is that for lower risk agents, innovation, you can put them into an environment

172
00:13:35,400 --> 00:13:45,240
with a lot more components allowed with policy setup like Vesca and I call see let's say

173
00:13:45,240 --> 00:13:47,400
API fireworks, etc.

174
00:13:47,400 --> 00:13:55,520
Firewalls, but you don't allow that environment to be accessible to a lot of people.

175
00:13:55,520 --> 00:14:00,120
Maybe that is just personal environment that is only accessible from that user itself.

176
00:14:00,120 --> 00:14:05,440
So you can play with it, but you cannot share as much, you cannot expose that those innovation

177
00:14:05,440 --> 00:14:07,080
as much to people.

178
00:14:07,080 --> 00:14:11,560
The yellow zone is kind of the middle zone where you have some testing going on, where you

179
00:14:11,560 --> 00:14:17,920
have some sharing going on, say an individual has already built an agent that is the key

180
00:14:17,920 --> 00:14:23,200
things or she thinks is ready for testing and wanted their IT admins to take a look and

181
00:14:23,200 --> 00:14:27,320
can put that particular agent into the yellow zone.

182
00:14:27,320 --> 00:14:35,380
The yellow zone have a little bit more sharing flexibility, but also comes with that is more

183
00:14:35,380 --> 00:14:41,800
scrutiny with regard to its data with regard to its sharing policy.

184
00:14:41,800 --> 00:14:46,440
And the red zone might be it production zone where everything is business centric, where

185
00:14:46,440 --> 00:14:48,120
everything is sensitive.

186
00:14:48,120 --> 00:14:52,680
So if you want to put things in there, you have to go through the approval of IT admins.

187
00:14:52,680 --> 00:15:00,120
So by defining those different zones, we help IT admins and their makers really adopt different

188
00:15:00,120 --> 00:15:03,920
level of risks quite quickly.

189
00:15:03,920 --> 00:15:09,400
>> You're a product manager for Co-Pilot Studios.

190
00:15:09,400 --> 00:15:16,240
So how did Co-Pilot Studio support governance today?

191
00:15:16,240 --> 00:15:24,200
>> Co-Pilot Studio itself is a largely, it's an agent building platform.

192
00:15:24,200 --> 00:15:33,120
So the governance structure around it is across different places.

193
00:15:33,120 --> 00:15:37,280
Because there's a product born out of the power platform family, a lot of people know this.

194
00:15:37,280 --> 00:15:44,720
The majority of controls and amin knobs, if you may, exist in the power platform and

195
00:15:44,720 --> 00:15:52,920
the power platform is a play where you do what we just call a zone governance control,

196
00:15:52,920 --> 00:15:54,480
which is at the environment level.

197
00:15:54,480 --> 00:16:03,360
If you want to have 10 level, like umbrella level control over how agent would act after

198
00:16:03,360 --> 00:16:10,400
it's been deployed, then you have another control plan, which is the Microsoft 365 and

199
00:16:10,400 --> 00:16:11,400
the Microsoft 365.

200
00:16:11,400 --> 00:16:18,420
You might also have part of agent 365, which is the new control plan for the operational

201
00:16:18,420 --> 00:16:26,880
stages of agents across different platforms built within or without within or outside of

202
00:16:26,880 --> 00:16:28,480
the Microsoft ecosystem.

203
00:16:28,480 --> 00:16:36,160
So you can also provide governance for third party agents, let's say, from our partners.

204
00:16:36,160 --> 00:16:41,600
So you really need this layered approach for the full int and governance.

205
00:16:41,600 --> 00:16:46,440
I would recommend ITNs to start from the power platform, I'm a senator, to get familiar

206
00:16:46,440 --> 00:16:53,640
with the controls and policies that are in close vicinity with Co-Pilot Studio.

207
00:16:53,640 --> 00:17:00,680
But if you want to have anti-end journey taken care of, especially advanced security controls

208
00:17:00,680 --> 00:17:06,080
integrated with Entra, Defender and Perview, I would say the,

209
00:17:06,080 --> 00:17:11,520
Mac, the Microsoft 365 and the center and if it's a five control plane, it's somewhere

210
00:17:11,520 --> 00:17:15,320
that you need to take a look as well.

211
00:17:15,320 --> 00:17:21,360
And so I think a little bit, who owns an agent?

212
00:17:21,360 --> 00:17:28,040
Is it the business or is it an IT topic?

213
00:17:28,040 --> 00:17:34,720
It is a very interesting and complicated question.

214
00:17:34,720 --> 00:17:41,640
I would say this is a very diplomatic answer, but ultimately it needs to be a combined

215
00:17:41,640 --> 00:17:45,640
ownership and different teams should own different things, right?

216
00:17:45,640 --> 00:17:51,400
And this is what we talked about in the IT center of excellence or AI center of excellence

217
00:17:51,400 --> 00:17:57,120
concept as well is that the enable Asian innovation is really a team effort.

218
00:17:57,120 --> 00:18:02,560
Let's say there's a business team who understand the business process and their day to day routine

219
00:18:02,560 --> 00:18:03,560
intimately.

220
00:18:03,560 --> 00:18:11,560
They are the ones who would feel the benefit and the impact of agents efficiency and day to day

221
00:18:11,560 --> 00:18:14,360
process automation the most.

222
00:18:14,360 --> 00:18:18,320
And then they understand their challenges and their pain, their pain pullings have inefficiencies

223
00:18:18,320 --> 00:18:19,320
the most.

224
00:18:19,320 --> 00:18:25,320
So they are the ones who should be responsible for summarizing the business process that

225
00:18:25,320 --> 00:18:31,160
needs to be automated, that needs to be consolidated into Asian workflows.

226
00:18:31,160 --> 00:18:35,200
So they are the one who needs to provide the business logic and knowledge.

227
00:18:35,200 --> 00:18:37,040
And obviously there is the IT team.

228
00:18:37,040 --> 00:18:45,520
IT team needs to give the business team or the frontline team the knowledge and make them

229
00:18:45,520 --> 00:18:53,680
feel comfortable and confident about turning those knowledge and business process expertise

230
00:18:53,680 --> 00:19:00,440
into tangible agents and technology that they can replicate for the rest of the organization.

231
00:19:00,440 --> 00:19:05,520
And obviously there is also the executive team who are responsible for sponsoring these

232
00:19:05,520 --> 00:19:13,840
activities, making sure that IT have enough resource, enough influence over other teams

233
00:19:13,840 --> 00:19:18,640
around how to do governance around how to do security around how to implement vast

234
00:19:18,640 --> 00:19:21,880
practices and not promote agents sprawl.

235
00:19:21,880 --> 00:19:26,760
As we know if you don't have Asian governance structure in place that people still innovate,

236
00:19:26,760 --> 00:19:31,480
it's just they create shadow agents, they create shadow processes and automations and it becomes

237
00:19:31,480 --> 00:19:37,800
really hard for the security measures to be in place because who knows what would happen

238
00:19:37,800 --> 00:19:42,040
if the employee connects a sensitive data set.

239
00:19:42,040 --> 00:19:47,480
Let's say with their customers names and social security numbers directly with a public

240
00:19:47,480 --> 00:19:51,880
facing agent and the agent does not have any prompt injection, production mechanism and

241
00:19:51,880 --> 00:19:56,680
anyone can ask questions about their users, social security or even credit card information

242
00:19:56,680 --> 00:19:59,120
that will be not in that scenario.

243
00:19:59,120 --> 00:20:04,080
So again, back to your point, it should be a collaboration between different teams and

244
00:20:04,080 --> 00:20:11,400
it should be a trusted platform and excellent center of excellence structure.

245
00:20:11,400 --> 00:20:18,520
And from your experience, how should organizations manage the agent life cycle?

246
00:20:18,520 --> 00:20:21,560
That's a good question.

247
00:20:21,560 --> 00:20:29,480
Again, I'll go back to the origins of power platform. Power platform introduced the concept of

248
00:20:29,480 --> 00:20:33,560
application lifecycle management through pipelines.

249
00:20:33,560 --> 00:20:40,320
Typically, there are the idea of solutions within the power platform where you can build

250
00:20:40,320 --> 00:20:43,920
a solution, essentially it's kind of like a repo and GitHub.

251
00:20:43,920 --> 00:20:50,000
And then you can move the solution along with its dependencies through different environments

252
00:20:50,000 --> 00:20:54,680
with different level of control as we just talked about the zone governance concept.

253
00:20:54,680 --> 00:20:59,440
And you can do lifecycle management that way.

254
00:20:59,440 --> 00:21:05,560
You can put a solution into a experimentation zone and then a yellow zone and then red zone.

255
00:21:05,560 --> 00:21:11,400
And then the IT would set up governance policies around what are the requirements for the

256
00:21:11,400 --> 00:21:17,600
red zones and what does mean for an organization to take a solution into production.

257
00:21:17,600 --> 00:21:22,280
So those are the concepts that exist within power platform.

258
00:21:22,280 --> 00:21:29,840
Obviously within the innovation community of COVA Studio, we also try and make the platform

259
00:21:29,840 --> 00:21:33,000
more accessible to third party integrations.

260
00:21:33,000 --> 00:21:39,680
So it is not uncommon to see people use GitHub as another tool for source control or Azure

261
00:21:39,680 --> 00:21:45,880
DevOps, which we always recommend and to take experiment with because you never know

262
00:21:45,880 --> 00:21:50,360
which platform works the best for your organization's unique reality.

263
00:21:50,360 --> 00:21:57,240
So I would say that if you are someone who is thinking about version control and lifecycle

264
00:21:57,240 --> 00:22:03,480
management, try different things, try different templates and then there are plenty of guidance

265
00:22:03,480 --> 00:22:11,200
from the COVA Studio adoption side or the COVA adoption teams on back practices and

266
00:22:11,200 --> 00:22:13,600
blog that you would found really helpful.

267
00:22:13,600 --> 00:22:18,280
I'm sure a lot of audience of this podcast have heard of them and used them.

268
00:22:18,280 --> 00:22:21,520
So if you have any questions, don't hesitate to reach out to us as well.

269
00:22:21,520 --> 00:22:25,360
We have tech community where we answer questions and aka forums.

270
00:22:25,360 --> 00:22:29,920
So yeah, those are all great resource thinking leverage to understand those resources.

271
00:22:29,920 --> 00:22:37,560
Yeah, I think we are now in an era where we have to agent to agent or multi agent,

272
00:22:37,560 --> 00:22:42,880
or build this stuff.

273
00:22:42,880 --> 00:22:46,800
I think organizations can have hundreds or thousands of agents.

274
00:22:46,800 --> 00:22:54,520
Does there a good way organization can monitor agent usage?

275
00:22:54,520 --> 00:22:55,520
Absolutely.

276
00:22:55,520 --> 00:23:03,800
Again, it goes back to what we just talked about, the layered approach in governance and security.

277
00:23:03,800 --> 00:23:07,160
By the way, when we talk about governance, I'm losing this term very loosely.

278
00:23:07,160 --> 00:23:09,040
When I say governance, there's really a couple of things.

279
00:23:09,040 --> 00:23:14,760
It's about the administration of how agents are created, how they can be created, and then

280
00:23:14,760 --> 00:23:17,600
how they are secured and protected.

281
00:23:17,600 --> 00:23:22,800
And then how can we scale agent across to what we just talked about, the pipeline and

282
00:23:22,800 --> 00:23:29,240
then the transformation of culture and behavioral patterns of the organization adoption journey.

283
00:23:29,240 --> 00:23:37,040
So when we look at those four things, I think one good thing for the IT Amons or anyone

284
00:23:37,040 --> 00:23:45,120
who's interested in governing them to think about is what tools is available to me and how

285
00:23:45,120 --> 00:23:47,280
should I combine those tools.

286
00:23:47,280 --> 00:23:53,560
Again, it goes back to you have Power Platform, MS Center and then you have A3,5.

287
00:23:53,560 --> 00:23:58,400
You can set up different levels of policies within those two platforms and then use those

288
00:23:58,400 --> 00:24:06,440
combined efforts to give you a good granularity, but also umbrella control.

289
00:24:06,440 --> 00:24:19,160
Yeah, I think yeah, traditional IT management devices, tomorrow IT, they manage a couple

290
00:24:19,160 --> 00:24:21,640
of these AI agents.

291
00:24:21,640 --> 00:24:26,640
How is the IT department changing?

292
00:24:26,640 --> 00:24:35,640
I think IT is also using agent workflows to automate their governance.

293
00:24:35,640 --> 00:24:46,400
As IT may fail overwhelmed by the amount of innovation that is going on now that not only

294
00:24:46,400 --> 00:24:52,320
agents are being populated, but also all kinds of agent work loads or tools.

295
00:24:52,320 --> 00:24:54,200
Let's say get up co-pilot.

296
00:24:54,200 --> 00:25:01,960
It allows agents or applications to quite possibly to be built so fast and erase so fast.

297
00:25:01,960 --> 00:25:12,000
So it's no longer a realistic expectation for IT to be the gatekeeper to manually approve

298
00:25:12,000 --> 00:25:14,080
or deny everything.

299
00:25:14,080 --> 00:25:19,840
They cannot have one-on-one meetings with every innovator every day to walk them through

300
00:25:19,840 --> 00:25:21,560
the best practices.

301
00:25:21,560 --> 00:25:26,760
They need to think about automation and scale as well.

302
00:25:26,760 --> 00:25:33,280
Again, it goes back to the Center for Excellence concept is that IT is really a nibbling function

303
00:25:33,280 --> 00:25:35,480
rather than a policing function.

304
00:25:35,480 --> 00:25:42,720
You need to figure out are the unique and repeated business fractions in your organization,

305
00:25:42,720 --> 00:25:48,440
in collaboration with your client or business owners and then proactively reach out to them

306
00:25:48,440 --> 00:25:53,800
about how to use agent work loads to automate.

307
00:25:53,800 --> 00:26:01,680
And then when it comes to say risk management and governance, you should also have probably

308
00:26:01,680 --> 00:26:07,360
agents built for your own work loads like IT, Q and A, maybe is a good use case.

309
00:26:07,360 --> 00:26:12,320
Where you summarize the governance, brass practices, business process, approval process,

310
00:26:12,320 --> 00:26:20,640
application process into a set of grounding documents and then use agent to answer preliminary

311
00:26:20,640 --> 00:26:24,520
questions or another good example is approval.

312
00:26:24,520 --> 00:26:32,960
Let's say a user wanted to submit an agent for publishing.

313
00:26:32,960 --> 00:26:34,400
What are the rubrics?

314
00:26:34,400 --> 00:26:38,320
What are the criteria for you to prove or deny that agent?

315
00:26:38,320 --> 00:26:42,920
You should make that explicit and then pass that knowledge down to users so they can basically

316
00:26:42,920 --> 00:26:48,320
do a self-check before they submit everything for you.

317
00:26:48,320 --> 00:26:53,180
So if they can self-identify certain risks or governance loopholes, then they will

318
00:26:53,180 --> 00:26:59,980
solve them themselves or you can set a set of requirements, hey, is this agent, does this

319
00:26:59,980 --> 00:27:02,520
agent have authorization?

320
00:27:02,520 --> 00:27:11,040
Does this agent have basic sensitive data control over what type of connectors has been connected?

321
00:27:11,040 --> 00:27:18,240
Does this agent have basic prompt injection protection established as a part of the platform?

322
00:27:18,240 --> 00:27:24,840
All those things should be embedded into those process requirements and then from there

323
00:27:24,840 --> 00:27:30,080
you would found the escalation rate would reduce by quite a lot.

324
00:27:30,080 --> 00:27:39,480
Another good thing that IT can start to do in response to this change is to not use default

325
00:27:39,480 --> 00:27:41,520
environment anymore.

326
00:27:41,520 --> 00:27:48,900
So if you have a default environment in the power platform, concept and then use that

327
00:27:48,900 --> 00:27:55,680
default environment as where people go by default to experiment that after a quick

328
00:27:55,680 --> 00:28:02,440
while there will be a ton of agents from there and it will be so hard for the IT admins

329
00:28:02,440 --> 00:28:03,680
to clean it up.

330
00:28:03,680 --> 00:28:10,000
So leveraging features within the power platform, like if I'm a routing or personal environment

331
00:28:10,000 --> 00:28:12,880
would help that situation by quite a bit.

332
00:28:12,880 --> 00:28:19,000
So I think IT should be at the forefront for understanding what new technology and processes

333
00:28:19,000 --> 00:28:26,040
and toolings are available to them, quickly adopt them themselves and then summarize those

334
00:28:26,040 --> 00:28:32,760
as practice practices and help them to transform their own work as well.

335
00:28:32,760 --> 00:28:38,520
And I think we have all so much of our tools for Microsoft.

336
00:28:38,520 --> 00:28:49,480
So for an administrator, what roles do Microsoft, ENTRA, ID, place in this new AI agent area?

337
00:28:49,480 --> 00:28:51,720
And this is a great question.

338
00:28:51,720 --> 00:28:57,840
I think it is to answer shortly is basically the future because you would think about the

339
00:28:57,840 --> 00:29:02,160
vision that Microsoft have for agents.

340
00:29:02,160 --> 00:29:09,400
Ultimately we would want agents to be able to perform, to have the capability or possibility

341
00:29:09,400 --> 00:29:15,720
to perform at the same level as a human employee is not going to replace a human employee for

342
00:29:15,720 --> 00:29:16,720
sure.

343
00:29:16,720 --> 00:29:26,160
But let's say if I cannot attend a meeting or if I cannot go to a certain conference, then

344
00:29:26,160 --> 00:29:33,720
that agent should be able to embody my knowledge, my point of view and my judgment.

345
00:29:33,720 --> 00:29:40,160
So in that regard, with that much of agency, you also need that much of control and governance

346
00:29:40,160 --> 00:29:41,480
around it.

347
00:29:41,480 --> 00:29:49,240
So really the idea behind getting every single agent and enter ID is around, hey, Microsoft,

348
00:29:49,240 --> 00:29:53,200
you already have this great infrastructure for managing human employees.

349
00:29:53,200 --> 00:30:01,280
And then as you're familiar with in Microsoft 35, MS Center or other control planes, why

350
00:30:01,280 --> 00:30:07,400
don't we use those knowledge and vast practices to manage agent take employees as well?

351
00:30:07,400 --> 00:30:12,760
And obviously the innovation would keep happen for how advanced how autonomous agents can

352
00:30:12,760 --> 00:30:13,760
be.

353
00:30:13,760 --> 00:30:19,160
I'm not here to make promises around, hey, down the line for how long agents would be just

354
00:30:19,160 --> 00:30:24,680
like humans, but why don't we just slverge the existing technology infrastructure so that

355
00:30:24,680 --> 00:30:31,880
by the time we get there or by the time we increase our agent's capabilities, the again,

356
00:30:31,880 --> 00:30:36,880
the security can be in place, the policy enforcement can be in place for those agents.

357
00:30:36,880 --> 00:30:42,680
So enter ID is really a important step for us to go towards that so that the management

358
00:30:42,680 --> 00:30:52,920
of agents can be similar or consistent with how we manage human employees.

359
00:30:52,920 --> 00:30:55,520
Yeah.

360
00:30:55,520 --> 00:31:00,880
I started with, yeah, Gibo and Microsoft technology, I came from the from the Niger science

361
00:31:00,880 --> 00:31:01,880
part.

362
00:31:01,880 --> 00:31:04,320
And there were one tool, oh, I hated it.

363
00:31:04,320 --> 00:31:07,560
At this time, I hated the most, that's my favorite.

364
00:31:07,560 --> 00:31:15,560
But how important is this Microsoft view when we think about, yeah, ag.

365
00:31:15,560 --> 00:31:25,320
Yeah, per views is I think one of the important cornerstones of making sure agents are performing

366
00:31:25,320 --> 00:31:29,440
securely and protected, right?

367
00:31:29,440 --> 00:31:36,360
So per view at its core is about protecting data is for protecting data from leaks is about

368
00:31:36,360 --> 00:31:39,360
protecting data from reached.

369
00:31:39,360 --> 00:31:44,960
It's about protecting data from intentionally or unintentionally shared without the bound

370
00:31:44,960 --> 00:31:47,600
that is supposed to stay with it.

371
00:31:47,600 --> 00:31:48,600
Right?

372
00:31:48,600 --> 00:31:53,760
So if you think about how an agent acts in runtime, when we are talking about protecting

373
00:31:53,760 --> 00:31:59,360
agent, what we're really saying is that we're protecting data, right?

374
00:31:59,360 --> 00:32:07,360
Because if the agent does not have access to sensitive data or data that you want to protect,

375
00:32:07,360 --> 00:32:12,600
then what is the risk of that agent for your organization really?

376
00:32:12,600 --> 00:32:19,160
Is it that it would act in a way that it's going to damage your, um, damage, damage your

377
00:32:19,160 --> 00:32:20,160
business process?

378
00:32:20,160 --> 00:32:25,600
Not quite likely because you already have a good prompt that's going to set the, the,

379
00:32:25,600 --> 00:32:30,640
has been set up to limit that agent's capability.

380
00:32:30,640 --> 00:32:41,320
So how do we make sure that first of all the access of that agent is protected is monitored?

381
00:32:41,320 --> 00:32:46,520
And then how that agent shares data is protected and monitored is very important.

382
00:32:46,520 --> 00:32:54,880
If we use the connector concept within Power Platform to control how agents can access

383
00:32:54,880 --> 00:33:01,880
data source and share the data, then on top of that, per week gives security, I'm in

384
00:33:01,880 --> 00:33:08,720
Zanitium is really a more granular and more nuanced view on how the agents deal with data.

385
00:33:08,720 --> 00:33:11,360
A good example of this is sensitive data labeling, right?

386
00:33:11,360 --> 00:33:19,160
So if you ground agents with a sensitive data file, then, and then you set up a policy

387
00:33:19,160 --> 00:33:24,400
saying that agents should not share a sensitive data outside, then obviously, per week would

388
00:33:24,400 --> 00:33:26,080
help agent to enforce that policy.

389
00:33:26,080 --> 00:33:30,920
But if you don't have the sense of sensitive labeling, you cannot do that.

390
00:33:30,920 --> 00:33:35,400
And the best part about it is, per week is already integrated with your Microsoft 365

391
00:33:35,400 --> 00:33:36,400
ecosystem.

392
00:33:36,400 --> 00:33:43,280
So you don't need to have your employees enforce another layer of manually tag sensitive

393
00:33:43,280 --> 00:33:48,640
data labels to refiles to your business processes.

394
00:33:48,640 --> 00:33:56,240
This is the first thing, the second thing is, or unintended data sharing, that is so

395
00:33:56,240 --> 00:33:57,880
it not supposed to happen, right?

396
00:33:57,880 --> 00:34:04,320
Purpose would block you from literally copy and paste, saying that information into external

397
00:34:04,320 --> 00:34:05,320
sources.

398
00:34:05,320 --> 00:34:11,840
And then such behavior would also be flagged to ITM and so that they can target certain

399
00:34:11,840 --> 00:34:15,920
on ethical behavior inside a risk or so on.

400
00:34:15,920 --> 00:34:21,320
So all of these is about prevention and also reaction.

401
00:34:21,320 --> 00:34:26,400
You should have data security, post-traumatagement to understand what are the risks going on in

402
00:34:26,400 --> 00:34:28,200
your organization.

403
00:34:28,200 --> 00:34:35,200
And when things do happen, there should be immediate response to those risks and purview

404
00:34:35,200 --> 00:34:37,920
is at the forefront of that.

405
00:34:37,920 --> 00:34:45,800
And I think some agents have to work with sensitive data or have to write or read

406
00:34:45,800 --> 00:34:51,120
data that's sensitive.

407
00:34:51,120 --> 00:34:59,280
Is there other things, especially when I have these kinds of agents, how organization can

408
00:34:59,280 --> 00:35:01,800
secure them?

409
00:35:01,800 --> 00:35:08,280
Yeah, I would say again it goes back to the layer approach.

410
00:35:08,280 --> 00:35:12,080
The real first layer is you need to have environment level controls.

411
00:35:12,080 --> 00:35:16,760
If you feel like certain things that you just want to make sure the agent never touches,

412
00:35:16,760 --> 00:35:20,880
then don't allow those data connectors within certain environments and then put that business

413
00:35:20,880 --> 00:35:23,200
critical agent into that environment.

414
00:35:23,200 --> 00:35:24,200
That's the first thing.

415
00:35:24,200 --> 00:35:29,360
The second thing is use or just talked about the, it's a five layer or the Microsoft Security

416
00:35:29,360 --> 00:35:30,360
layer, right?

417
00:35:30,360 --> 00:35:39,320
You can use policy templates to say, hey, all the agent within my tenant have to be attached

418
00:35:39,320 --> 00:35:45,640
to this Entra Access package and then you can disallow certain application access from

419
00:35:45,640 --> 00:35:47,120
those packages.

420
00:35:47,120 --> 00:35:48,440
So that's the first thing.

421
00:35:48,440 --> 00:35:53,400
If you have to expose certain sensitive data to very specific people, then that I would

422
00:35:53,400 --> 00:35:56,400
say use the right authentication methods, right?

423
00:35:56,400 --> 00:36:05,200
So make sure that you have authentication gates using Entra or other MFA providers and

424
00:36:05,200 --> 00:36:15,680
make sure that those people who should have access to that particular agent is bounded

425
00:36:15,680 --> 00:36:21,520
by certain security groups and they can configure that Entra security group with the access

426
00:36:21,520 --> 00:36:24,480
pattern of the agent.

427
00:36:24,480 --> 00:36:33,320
The one big best practice is never allow sensitive data to be accessed through agent that is

428
00:36:33,320 --> 00:36:35,560
unauthenticated, right?

429
00:36:35,560 --> 00:36:43,560
If you want to make sure that you expose sensitive data to specific people, then authentication

430
00:36:43,560 --> 00:36:47,880
needs to come in place with a lot of scrutiny.

431
00:36:47,880 --> 00:36:57,600
Yeah, I think what do these things can governance become a self-service?

432
00:36:57,600 --> 00:37:00,880
Is there a game?

433
00:37:00,880 --> 00:37:01,880
Do you have that question again?

434
00:37:01,880 --> 00:37:06,560
Yeah, can governance become a self-service?

435
00:37:06,560 --> 00:37:08,200
I think that's the goal.

436
00:37:08,200 --> 00:37:15,200
I mean, obviously not 100% of governance will become self-service, but as we talk about,

437
00:37:15,200 --> 00:37:21,440
increasingly, the industry is moving towards more automation and there should be certain

438
00:37:21,440 --> 00:37:26,480
mount of governance that would become a self-service.

439
00:37:26,480 --> 00:37:31,440
And also, like we talked about, governance is such an all-encompassing thing.

440
00:37:31,440 --> 00:37:41,080
The approval process should never be fully self-service, right?

441
00:37:41,080 --> 00:37:47,800
There should always be human in a loop for deciding what can go to the entire organization

442
00:37:47,800 --> 00:37:49,200
or go public.

443
00:37:49,200 --> 00:37:56,200
But things like upskilling, things like knowledge transfer, things like business process

444
00:37:56,200 --> 00:38:04,760
summarization, or basic rules and guidance, those things should definitely be self-service.

445
00:38:04,760 --> 00:38:07,320
And it can exist in the form of SharePoint.

446
00:38:07,320 --> 00:38:09,360
It can exist in the form of agents.

447
00:38:09,360 --> 00:38:16,760
It can exist in the form of simply a Word document, but ultimately, again, typically IT

448
00:38:16,760 --> 00:38:19,280
amens are overwhelmed.

449
00:38:19,280 --> 00:38:24,200
So they knew you'd think about ways to reduce workloads for them and make sure that they're

450
00:38:24,200 --> 00:38:28,000
not always working.

451
00:38:28,000 --> 00:38:29,000
And thank you.

452
00:38:29,000 --> 00:38:32,280
In the future, AI will eventually become a AI.

453
00:38:32,280 --> 00:38:35,280
Can you say it again?

454
00:38:35,280 --> 00:38:36,280
Sorry?

455
00:38:36,280 --> 00:38:37,280
Yeah, yeah.

456
00:38:37,280 --> 00:38:43,280
Well, in the future, did you think AI eventually become a AI?

457
00:38:43,280 --> 00:38:51,240
I think not fully 100% human in a loop will keep being very important, but I do think we're

458
00:38:51,240 --> 00:38:56,840
going to keep moving to a direction where that is happening.

459
00:38:56,840 --> 00:39:05,600
One good example of this is that if you go to your agent store in Microsoft 365, co-pilot,

460
00:39:05,600 --> 00:39:12,080
then there will be an agent called Microsoft 365 Amin Center agent, the Mac agent.

461
00:39:12,080 --> 00:39:17,640
And that agent already can help you to govern a lot of the Mac activities.

462
00:39:17,640 --> 00:39:23,720
And we're building to or something that is similar to that within the PowerPaf form.

463
00:39:23,720 --> 00:39:31,000
So yeah, I do think that those futures and those visions are slowly, but surely coming

464
00:39:31,000 --> 00:39:32,000
true.

465
00:39:32,000 --> 00:39:46,560
Yeah, especially for me, AI living in Europe, Germany, so there's a topic, the German laws,

466
00:39:46,560 --> 00:39:52,320
the rest of the world, not its compliance.

467
00:39:52,320 --> 00:40:00,600
How can I think in this multi agent world, and we have the EU AI Act, and they have done

468
00:40:00,600 --> 00:40:03,000
a lot of compliance stuff?

469
00:40:03,000 --> 00:40:15,840
How can Microsoft or tools help here to get all these regulations done?

470
00:40:15,840 --> 00:40:18,760
Yeah, this is a great question.

471
00:40:18,760 --> 00:40:23,400
I know it's the top of mind for a lot of the highly regulated industries and NGOs.

472
00:40:23,400 --> 00:40:27,920
I first of all, I would say that this is just my personal device.

473
00:40:27,920 --> 00:40:33,320
It's probably going to be very comprehensive, but I can provide some thoughts on directionally

474
00:40:33,320 --> 00:40:36,720
how can I approach this.

475
00:40:36,720 --> 00:40:41,480
And again, it's highly nuanced topics, so don't treat this as like legal advice or anything

476
00:40:41,480 --> 00:40:43,800
who does not represent Microsoft's point of view.

477
00:40:43,800 --> 00:40:50,480
I would say, first of all, you need to understand your unique reality and the requirements for

478
00:40:50,480 --> 00:40:53,440
your industry for compliance.

479
00:40:53,440 --> 00:40:58,920
Not every industry, every geo share the same compliance requirement.

480
00:40:58,920 --> 00:41:05,960
And from there, you need to consult your legal entities for, like is there a specific framework

481
00:41:05,960 --> 00:41:08,560
upon which they need to follow?

482
00:41:08,560 --> 00:41:13,880
So the EU AI Act might be a framework and the US might be another.

483
00:41:13,880 --> 00:41:17,160
So what are the framework that you need to adhere to?

484
00:41:17,160 --> 00:41:22,160
And based on there, there are best practices or industry organizations or product that can

485
00:41:22,160 --> 00:41:23,720
help you out.

486
00:41:23,720 --> 00:41:32,800
In the realm of co-pilot studio, one simple thing that you can ensure that would help you

487
00:41:32,800 --> 00:41:35,040
is autologging.

488
00:41:35,040 --> 00:41:38,960
So documenting everything is basically a foundation for compliance.

489
00:41:38,960 --> 00:41:42,400
If you don't know what has happened, there is no way for you to do autotrails.

490
00:41:42,400 --> 00:41:46,240
There is no way for you to understand your compliance posture.

491
00:41:46,240 --> 00:41:50,640
So definitely turn on autologging within co-pilot studio.

492
00:41:50,640 --> 00:41:53,200
And then it goes back to the layered approach.

493
00:41:53,200 --> 00:42:01,920
Now with co-pilot studio infrastructure hooked with autologging, you also need tools like

494
00:42:01,920 --> 00:42:08,480
Perview or Defender for you to understand your security logging so that combining those

495
00:42:08,480 --> 00:42:16,960
investigation and locking capabilities, you can then morph and bespoke your compliance

496
00:42:16,960 --> 00:42:24,480
reporting to the requirements of your governing body.

497
00:42:24,480 --> 00:42:27,360
That would be the directional feedback that I'll have.

498
00:42:27,360 --> 00:42:30,200
Yeah, interesting.

499
00:42:30,200 --> 00:42:37,600
I think a little bit about AI adoption.

500
00:42:37,600 --> 00:42:42,400
I think technology doesn't create the adoption.

501
00:42:42,400 --> 00:42:44,400
It's not the tool.

502
00:42:44,400 --> 00:42:46,600
It's the adoption.

503
00:42:46,600 --> 00:42:53,920
But what makes an organization successful when they adapt agent?

504
00:42:53,920 --> 00:43:00,120
I think it goes back to what we just talked about the collaboration between the interpen teams.

505
00:43:00,120 --> 00:43:06,680
What we have seen is organizations that are better at others than others at adoption are

506
00:43:06,680 --> 00:43:13,760
typically the teams that have very strong vision for what does great look like in terms

507
00:43:13,760 --> 00:43:19,760
of AI center of excellence and then have top down support from executive team to sponsor

508
00:43:19,760 --> 00:43:22,920
those adoption journey and learning activities.

509
00:43:22,920 --> 00:43:26,960
So it needs to be a pull and a push mechanism.

510
00:43:26,960 --> 00:43:33,560
But the frontline innovators and makers they need to start experimenting but also experiment

511
00:43:33,560 --> 00:43:40,960
within the scaffolding that's defined by IT teams or the executive team or the IT center

512
00:43:40,960 --> 00:43:42,960
of excellence.

513
00:43:42,960 --> 00:43:50,120
The leadership team should also be very specific about how can the frontline workers adopt

514
00:43:50,120 --> 00:43:56,760
these best practices and then endorse the governing.

515
00:43:56,760 --> 00:43:59,120
The governance structure put in place by IT teams.

516
00:43:59,120 --> 00:44:07,400
Endoors the activity that would upscale more people and quite frankly just put this as

517
00:44:07,400 --> 00:44:10,080
a top of line for the company.

518
00:44:10,080 --> 00:44:20,080
Because business process automation and efficiency will always benefit the company's organizational

519
00:44:20,080 --> 00:44:21,640
efficiency in the long run.

520
00:44:21,640 --> 00:44:30,640
So I would say start with the AI center of excellence and go from there.

521
00:44:30,640 --> 00:44:41,920
And I think yeah, Microsoft had done a big commitment to AI and there it's coming.

522
00:44:41,920 --> 00:44:46,520
So many new stuff, feeling everyday, something new.

523
00:44:46,520 --> 00:44:54,840
So yeah, how do you not got overwhelmed with all these information?

524
00:44:54,840 --> 00:44:59,440
I do go get overwhelmed by all these information where I go.

525
00:44:59,440 --> 00:45:02,560
I'm a victim of that too.

526
00:45:02,560 --> 00:45:06,160
Yeah, it's just, you cannot avoid it.

527
00:45:06,160 --> 00:45:13,480
We all know that the world of technology is moving so fast and it used to be the case

528
00:45:13,480 --> 00:45:22,160
that I can try catch up once a month or once a quarter with newest technology.

529
00:45:22,160 --> 00:45:29,960
Spend one Friday on the new tech and feel quite confident about all at least what is going

530
00:45:29,960 --> 00:45:31,280
on right now.

531
00:45:31,280 --> 00:45:32,600
It's a longer case.

532
00:45:32,600 --> 00:45:39,760
The speed of innovation is significantly outpacing the human capacity of learning.

533
00:45:39,760 --> 00:45:46,240
So I would say that I just acknowledge the fact that feeling overwhelmed will be a new

534
00:45:46,240 --> 00:45:47,240
reality.

535
00:45:47,240 --> 00:45:54,040
You just need to know what is your priority and what is your area that you really want

536
00:45:54,040 --> 00:45:59,280
to get good at and start small.

537
00:45:59,280 --> 00:46:09,320
Another thing is my personal guide that I try to follow is try not to think about knowledge

538
00:46:09,320 --> 00:46:21,240
retention as progress because AI is replacing knowledge retention.

539
00:46:21,240 --> 00:46:29,600
What really defines progress is your ability to hone your craft and the difference between

540
00:46:29,600 --> 00:46:34,880
crafting and knowing is really the process of doing.

541
00:46:34,880 --> 00:46:44,120
So I try to learn by doing and try to get deeper on to certain topics based on my own

542
00:46:44,120 --> 00:46:48,400
hands-on experience rather than hearing other people's second hand knowledge.

543
00:46:48,400 --> 00:46:54,000
And yeah, that's how I deal with all the roping world.

544
00:46:54,000 --> 00:46:55,480
What about you?

545
00:46:55,480 --> 00:47:06,200
Yeah, I have an agent that puts all from LinkedIn and all other sources next year short briefing

546
00:47:06,200 --> 00:47:07,200
daily.

547
00:47:07,200 --> 00:47:11,400
Yeah, what I do.

548
00:47:11,400 --> 00:47:14,120
That's why I would do it.

549
00:47:14,120 --> 00:47:20,880
When we don't think it's overwhelming put in the agent world or in the co-pilot world,

550
00:47:20,880 --> 00:47:25,840
I think oversharing is there that this is worth.

551
00:47:25,840 --> 00:47:32,880
How can we prevent from oversharing?

552
00:47:32,880 --> 00:47:42,200
Well, first thing is you need to know what are the things you don't want to share, defining

553
00:47:42,200 --> 00:47:43,200
those boundaries.

554
00:47:43,200 --> 00:47:50,640
And that is through in the Microsoft ecosystem, through since they've been labeling, through

555
00:47:50,640 --> 00:47:55,600
seeing the right document with the right labels.

556
00:47:55,600 --> 00:47:59,880
And from there, the rest of the technology would help you out, right?

557
00:47:59,880 --> 00:48:06,440
And for instance, if you are in a Microsoft 3.0.0 planet, then you won't be able to have

558
00:48:06,440 --> 00:48:10,280
access to things that you don't have access to.

559
00:48:10,280 --> 00:48:11,280
That's the first thing.

560
00:48:11,280 --> 00:48:16,120
The second thing is, again, leveraging connector policy and environment controls like we just

561
00:48:16,120 --> 00:48:19,120
talk about.

562
00:48:19,120 --> 00:48:27,480
And of course, you can also use what we talk about, purview and defender to first prevent

563
00:48:27,480 --> 00:48:30,320
excessive data from being leaked.

564
00:48:30,320 --> 00:48:38,280
The second thing is when people do try to gel break and do prompt injection or try to

565
00:48:38,280 --> 00:48:45,320
host an A or co-worse the agent from giving out information.

566
00:48:45,320 --> 00:48:50,280
And you can have some kind of production mechanism.

567
00:48:50,280 --> 00:48:57,120
Yeah, Microsoft is an awesome technology company, but is there any technology that's excited

568
00:48:57,120 --> 00:49:01,560
you outside for Microsoft?

569
00:49:01,560 --> 00:49:02,640
Absolutely.

570
00:49:02,640 --> 00:49:10,560
I think to be honest, most of the technology that I'm excited about is a combination of

571
00:49:10,560 --> 00:49:14,000
Microsoft technology and open source, right?

572
00:49:14,000 --> 00:49:20,000
And you see so many folks from Microsoft contributing to open source, sometimes, casually,

573
00:49:20,000 --> 00:49:21,320
sometimes as their full job.

574
00:49:21,320 --> 00:49:26,000
I think that's something that I really love about Microsoft is how much it embraces open

575
00:49:26,000 --> 00:49:27,720
source over the years.

576
00:49:27,720 --> 00:49:36,560
And then you see people like Scott Hanselman who work on GitHub co-videal app as I see right

577
00:49:36,560 --> 00:49:37,560
now.

578
00:49:37,560 --> 00:49:42,080
And I know that I'm a legendary figure of VP in Microsoft, but he's working in I see capacity

579
00:49:42,080 --> 00:49:44,080
I now.

580
00:49:44,080 --> 00:49:49,240
And working in open source.

581
00:49:49,240 --> 00:49:53,840
And of course, things like open claw, Hermaz agent are no good tools to have.

582
00:49:53,840 --> 00:50:00,240
And you can find so many quality technology out there that are just being contributed by

583
00:50:00,240 --> 00:50:03,560
both human and agents right now.

584
00:50:03,560 --> 00:50:10,560
And that's what I love about agentic broad as well is that you can amplify and extend

585
00:50:10,560 --> 00:50:16,000
this human goodwill to the open source community.

586
00:50:16,000 --> 00:50:23,200
In particular, I would recommend one specific open source technology that is skills for co-videal

587
00:50:23,200 --> 00:50:24,480
studio.

588
00:50:24,480 --> 00:50:32,920
This is a piece of tool that is collaborated between Microsoft employees and the open source

589
00:50:32,920 --> 00:50:33,920
community.

590
00:50:33,920 --> 00:50:39,960
Essentially allows co-videal agent like an opcopilot or a clock code to know how to use the

591
00:50:39,960 --> 00:50:42,560
backend of co-videal studio.

592
00:50:42,560 --> 00:50:43,560
Right.

593
00:50:43,560 --> 00:50:49,760
So if you tell a generic coding agent to build a co-videal studio agent, it might not understand

594
00:50:49,760 --> 00:50:55,320
the schema of how orchestration work in the backend for co-videal studio, but would that

595
00:50:55,320 --> 00:51:02,640
skill get up co-videal would be able to connect with your actual co-videal studio account.

596
00:51:02,640 --> 00:51:07,800
You can read your co-base, you can read your agent inventory, and then it can help you

597
00:51:07,800 --> 00:51:08,800
modify agents.

598
00:51:08,800 --> 00:51:14,840
You can help you to build new tools, build new adaptive cards, things that you want to automate

599
00:51:14,840 --> 00:51:18,080
quite a lot or even e-vals.

600
00:51:18,080 --> 00:51:23,880
So yeah, just really leverage both the product itself and also the open source tooling that

601
00:51:23,880 --> 00:51:31,360
you have available to you and you would soon become a very capable ITM.

602
00:51:31,360 --> 00:51:36,160
Because there are, have you a favorite co-pilot capacity?

603
00:51:36,160 --> 00:51:38,200
A capability?

604
00:51:38,200 --> 00:51:39,200
Yes.

605
00:51:39,200 --> 00:51:46,980
Well, if you're talking about co-pilot in general, meaning that if you're talking about

606
00:51:46,980 --> 00:51:56,080
co-pilot as in Microsoft's agentic, who's assistance, then I would say my personal

607
00:51:56,080 --> 00:52:01,840
favorite is probably get up co-pilot either in register code or get up co-pilot app.

608
00:52:01,840 --> 00:52:06,520
I've been recently experimenting with both and I just found that they both have their

609
00:52:06,520 --> 00:52:13,480
quirks and features, but I really feel like if you are someone who is already familiar with

610
00:52:13,480 --> 00:52:23,520
GitHub and who loves using GitHub as your main source of operations, DevOps, then you would

611
00:52:23,520 --> 00:52:25,920
love get up co-pilot app.

612
00:52:25,920 --> 00:52:33,760
It just fits in so well with your grooves, how you think about the entire process, where

613
00:52:33,760 --> 00:52:38,240
to a degree where things just make sense, right?

614
00:52:38,240 --> 00:52:43,240
Things like you can start a different session with different issue and then the agent would

615
00:52:43,240 --> 00:52:50,840
try out for you based on it should relate to automation and then you can basically turn

616
00:52:50,840 --> 00:52:59,720
your open source repo into a swarm of agents that helps you to look at issues overnight

617
00:52:59,720 --> 00:53:04,200
and then help you to identify things that requires your attention.

618
00:53:04,200 --> 00:53:11,720
It would be a dream for maintaining a big open source project and it can save so much energy

619
00:53:11,720 --> 00:53:13,720
and time.

620
00:53:13,720 --> 00:53:16,600
Yeah, that would probably be my favorite.

621
00:53:16,600 --> 00:53:22,320
Yeah, I think it's really strong to get up co-pilot.

622
00:53:22,320 --> 00:53:24,640
I'm more the edge of that off span.

623
00:53:24,640 --> 00:53:27,800
I hope we get a guess.

624
00:53:27,800 --> 00:53:35,000
The co-pilot also was the same strange here in the future.

625
00:53:35,000 --> 00:53:44,320
Is there a co-pilot studio feature where you wish more people use or know about it?

626
00:53:44,320 --> 00:53:55,080
Yeah, well, co-pilot studio just announced its new workflow builder and also new orchestrator.

627
00:53:55,080 --> 00:53:59,800
These are very underrated features so far.

628
00:53:59,800 --> 00:54:05,480
We're trying to do a better job at helping people understand the significance of these features

629
00:54:05,480 --> 00:54:08,120
but ultimately, you know, take time.

630
00:54:08,120 --> 00:54:14,040
But my plug in here would be try it out yourself.

631
00:54:14,040 --> 00:54:19,720
What defines the new orchestrator is really it would now be able to think and act like

632
00:54:19,720 --> 00:54:23,600
the cutting edge coding agent that you are familiar with like get up co-pilot.

633
00:54:23,600 --> 00:54:31,080
It would reason it would have Asian loops will be able to use tools and skills in a more

634
00:54:31,080 --> 00:54:42,320
smarter way and you would soon realize that the new Asian orchestrator with a new workflow

635
00:54:42,320 --> 00:54:47,960
goes way, way beyond then typical what we call process automation now.

636
00:54:47,960 --> 00:54:51,000
It has a lot more thinking power.

637
00:54:51,000 --> 00:54:54,000
It has a lot more system compatibility.

638
00:54:54,000 --> 00:54:56,680
It has a lot more extendability.

639
00:54:56,680 --> 00:55:04,280
We have a lot of resources on co-pilot studio cat team's blog and you should take a look

640
00:55:04,280 --> 00:55:08,720
and we have a lot of examples and templates as well.

641
00:55:08,720 --> 00:55:09,720
It would be fun.

642
00:55:09,720 --> 00:55:11,720
Yeah, awesome.

643
00:55:11,720 --> 00:55:16,320
I have to try it out next time.

644
00:55:16,320 --> 00:55:22,440
Yeah, so yeah, this was an amazing session.

645
00:55:22,440 --> 00:55:38,800
When you say organization should improve one thing tomorrow, what should it be?

646
00:55:38,800 --> 00:55:50,200
I would say ask yourself are there people that you would call champions in your order

647
00:55:50,200 --> 00:55:57,040
or organization to enable an adoption outside of you?

648
00:55:57,040 --> 00:56:00,280
It is like one person organization that does not count.

649
00:56:00,280 --> 00:56:07,320
For a typical organization like we talked about having a small group of people serving

650
00:56:07,320 --> 00:56:13,360
as the kingling, the seas for more innovation and then have those people to help people

651
00:56:13,360 --> 00:56:16,520
out and make sure they are incentivized to do so.

652
00:56:16,520 --> 00:56:23,440
Have hackathons, have innovation summits, have competitions and then make sure people feel

653
00:56:23,440 --> 00:56:30,000
like innovation is encouraged and incentivized and slowly but surely you will get there.

654
00:56:30,000 --> 00:56:32,520
You just need to start trying.

655
00:56:32,520 --> 00:56:40,360
Yeah, normally my closing question is if listeners remember one lesson from today, what should

656
00:56:40,360 --> 00:56:41,360
it be?

657
00:56:41,360 --> 00:56:49,240
I think here we have somebody good lesson, so I do another closing question.

658
00:56:49,240 --> 00:56:58,040
What did you think when we meet in a year here on the podcast, what will we discuss then?

659
00:56:58,040 --> 00:57:00,480
I think we will be discussing autonomous agents.

660
00:57:00,480 --> 00:57:06,600
I think we will be discussing now that agents are becoming more capable as you have seen

661
00:57:06,600 --> 00:57:12,440
from Microsoft Scal, which is based on our architecture.

662
00:57:12,440 --> 00:57:22,000
How do we govern and secure these increasingly more well connected, well-reasoned and autonomous

663
00:57:22,000 --> 00:57:23,720
agents?

664
00:57:23,720 --> 00:57:31,560
With greater capability comes with greater responsibility and governance and security

665
00:57:31,560 --> 00:57:32,560
needs to keep up.

666
00:57:32,560 --> 00:57:35,240
I think that would be a good follow-up.

667
00:57:35,240 --> 00:57:37,240
Yeah, awesome.

668
00:57:37,240 --> 00:57:44,080
Thank you so much, Thomas, for joining me today on the MC65 on podcast.

669
00:57:44,080 --> 00:57:48,040
Today's conversation highlighted something.

670
00:57:48,040 --> 00:57:53,840
Every organization needs to hear successful AI is just about building intelligent agents.

671
00:57:53,840 --> 00:57:59,280
It's about governing them responsibility, security and scalable.

672
00:57:59,280 --> 00:58:06,520
Yeah, and I think we explore how co-pilot studio and the adults enterprises are already AI,

673
00:58:06,520 --> 00:58:15,040
why governance, yeah, actually, rather than slow innovation and how IT is evolving from

674
00:58:15,040 --> 00:58:19,480
managing devices to managing intelligent digital co-workers.

675
00:58:19,480 --> 00:58:24,720
So yeah, thank you so much for being here and for your time.

676
00:58:24,720 --> 00:58:25,720
So goodbye.

677
00:58:25,720 --> 00:58:26,720
Thank you.

678
00:58:26,720 --> 00:58:29,040
Thank you, Marco, for having me.

679
00:58:29,040 --> 00:58:39,040
[BLANK_AUDIO]