Microsoft Graph: The Enterprise Nervous System

1
00:00:00,000 --> 00:00:03,480
Your enterprise IT is currently operating like a body without a nervous system.

2
00:00:03,480 --> 00:00:06,000
Think about that. You have thousands of resources.

3
00:00:06,000 --> 00:00:09,760
Computers, databases, apps, policies and compliance rules.

4
00:00:09,760 --> 00:00:11,080
They are all running at the same time.

5
00:00:11,080 --> 00:00:15,640
But the only way you know something is broken is when a human logs in and sees a problem.

6
00:00:15,640 --> 00:00:17,760
Your admins are the only sensory organs you have.

7
00:00:17,760 --> 00:00:21,080
They patrol, they check dashboards, they respond to alerts,

8
00:00:21,080 --> 00:00:26,840
and when they find a mistake, a bad permission, a team without an owner or data shared too broadly,

9
00:00:26,840 --> 00:00:31,320
they fix it by hand. This reactive model worked when I was small, but it doesn't scale anymore.

10
00:00:31,320 --> 00:00:34,200
Microsoft Graph is becoming your enterprise nervous system,

11
00:00:34,200 --> 00:00:38,160
detection, decision response, all automated and all continuous.

12
00:00:38,160 --> 00:00:41,160
By 2030, this shift will be finished in your organization,

13
00:00:41,160 --> 00:00:44,160
or you will be left operating on reflex alone.

14
00:00:44,160 --> 00:00:47,320
Competitors who build this nervous system will move faster than you.

15
00:00:47,320 --> 00:00:50,280
They will respond to threats in milliseconds instead of hours,

16
00:00:50,280 --> 00:00:54,080
and they will operate with a tiny fraction of the manual work you require today.

17
00:00:54,080 --> 00:00:59,680
This episode explores what that transition means for your infrastructure, your team and your position in the market.

18
00:00:59,680 --> 00:01:03,200
The evolution of enterprise administration, we need to look at where we have been.

19
00:01:03,200 --> 00:01:07,240
The path forward only makes sense when you see the structural problems we are trying to solve.

20
00:01:07,240 --> 00:01:10,240
Enterprise IT administration evolved through layers.

21
00:01:10,240 --> 00:01:14,320
Each layer reduced human work but increased what the system could actually do.

22
00:01:14,320 --> 00:01:17,360
The pattern matters because it shows exactly where we are heading.

23
00:01:17,360 --> 00:01:19,960
In the beginning, we had the GUI, point and click.

24
00:01:19,960 --> 00:01:25,360
An admin would log into a portal, navigate menus and click buttons to set up a user or change a permission.

25
00:01:25,360 --> 00:01:26,880
The GUI worked for small teams.

26
00:01:26,880 --> 00:01:29,800
When you had 50 servers and 50 users, this was fine.

27
00:01:29,800 --> 00:01:33,560
But when you have 50,000 users across multiple clouds in different countries,

28
00:01:33,560 --> 00:01:35,080
clicking buttons becomes impossible.

29
00:01:35,080 --> 00:01:37,240
The person clicking the mouse becomes the bottleneck.

30
00:01:37,240 --> 00:01:40,120
You would need hundreds of admins just to keep up with the daily routine.

31
00:01:40,120 --> 00:01:41,400
Then PowerShell arrived.

32
00:01:41,400 --> 00:01:43,480
PowerShell was the first major shift.

33
00:01:43,480 --> 00:01:46,280
Instead of clicking buttons, admins could finally script their intent.

34
00:01:46,280 --> 00:01:47,880
You could write a script that says,

35
00:01:47,880 --> 00:01:51,320
"Set up this user, add them to these groups and give them this license."

36
00:01:51,320 --> 00:01:54,160
You run it once or you run it a thousand times.

37
00:01:54,160 --> 00:01:56,000
The human no longer performed the task.

38
00:01:56,000 --> 00:01:58,880
The human described what they wanted and the system did the work.

39
00:01:58,880 --> 00:02:00,200
This was a massive change.

40
00:02:00,200 --> 00:02:04,920
The cost of scaling dropped because one admin with a good script could do the work of 10 people clicking buttons.

41
00:02:04,920 --> 00:02:06,160
But PowerShell had a ceiling.

42
00:02:06,160 --> 00:02:07,040
It was still code.

43
00:02:07,040 --> 00:02:11,080
You still needed a specialist who understood syntax, error handling and API rules.

44
00:02:11,080 --> 00:02:12,880
And every cloud service had its own version.

45
00:02:12,880 --> 00:02:17,160
You had Exchange PowerShell, SharePoint PowerShell, Azure PowerShell, and Teams PowerShell.

46
00:02:17,160 --> 00:02:20,440
Each one was slightly different and each one required its own training.

47
00:02:20,440 --> 00:02:21,840
Then came Microsoft Graph.

48
00:02:21,840 --> 00:02:25,600
Graph was supposed to be a unified API, one API, one permission model,

49
00:02:25,600 --> 00:02:28,560
and one way to access everything in Microsoft 365.

50
00:02:28,560 --> 00:02:32,240
Identity, Exchange, Teams, and Security were all in one place.

51
00:02:32,240 --> 00:02:33,720
In theory, this was a revolution.

52
00:02:33,720 --> 00:02:37,400
But in reality, most organizations treated Graph like a developer tool.

53
00:02:37,400 --> 00:02:39,040
It was something for backend engineers.

54
00:02:39,040 --> 00:02:40,720
Operations teams didn't think about it.

55
00:02:40,720 --> 00:02:43,720
And that is the structural mistake we are still living with today.

56
00:02:43,720 --> 00:02:44,920
Here is the critical insight.

57
00:02:44,920 --> 00:02:49,080
Every layer of abstraction has reduced human effort while making the system more powerful.

58
00:02:49,080 --> 00:02:51,600
The GUI required a human for every single action.

59
00:02:51,600 --> 00:02:52,880
PowerShell changed that.

60
00:02:52,880 --> 00:02:56,160
So one human action could trigger hundreds of operations.

61
00:02:56,160 --> 00:02:56,960
Graph is different.

62
00:02:56,960 --> 00:03:00,240
Graph is not just a faster way for humans to do the same old things.

63
00:03:00,240 --> 00:03:02,880
Graph is the foundation for systems to operate on their own.

64
00:03:02,880 --> 00:03:07,240
It provides the data, the permissions, and the audit trail for machines to make decisions.

65
00:03:07,240 --> 00:03:10,840
It allows for action without a human ever getting involved.

66
00:03:10,840 --> 00:03:14,720
We are at a turning point where the next step isn't just about being more efficient.

67
00:03:14,720 --> 00:03:16,360
It is fundamentally different.

68
00:03:16,360 --> 00:03:20,400
We are moving from a world where humans describe intent in PowerShell to a world where

69
00:03:20,400 --> 00:03:23,440
systems detect problems and fix them automatically.

70
00:03:23,440 --> 00:03:25,200
Graph is the nervous system that makes this work.

71
00:03:25,200 --> 00:03:27,000
The sensors feed data into Graph.

72
00:03:27,000 --> 00:03:31,480
The policy engines check the rules in Graph and the workflows make the changes through Graph.

73
00:03:31,480 --> 00:03:33,000
Everything flows through one single layer.

74
00:03:33,000 --> 00:03:35,080
This is where most organizations get it wrong.

75
00:03:35,080 --> 00:03:38,720
They see the next step as better PowerShell or easier automation.

76
00:03:38,720 --> 00:03:42,560
They are still thinking about efficiency, but the structural shift is actually about control.

77
00:03:42,560 --> 00:03:46,360
We are moving from manual governance to autonomous governance and that requires a completely

78
00:03:46,360 --> 00:03:48,320
different architecture.

79
00:03:48,320 --> 00:03:51,080
Why manual IT governance is breaking?

80
00:03:51,080 --> 00:03:55,640
Before we look at the future, we have to understand why the current model is failing.

81
00:03:55,640 --> 00:03:57,520
Manual governance works until it doesn't.

82
00:03:57,520 --> 00:03:59,840
And for most of you, the breaking point is already here.

83
00:03:59,840 --> 00:04:01,680
The first symptom is configuration drift.

84
00:04:01,680 --> 00:04:04,440
In a manual environment, someone changes a permission here.

85
00:04:04,440 --> 00:04:06,040
They are just a sharing setting there.

86
00:04:06,040 --> 00:04:09,400
They create an exception for a business unit that needs to move fast.

87
00:04:09,400 --> 00:04:12,920
These changes happen for good reasons at the time, but they never get reversed.

88
00:04:12,920 --> 00:04:15,000
They aren't documented in a central policy.

89
00:04:15,000 --> 00:04:17,000
They are just one-off adjustments that pile up.

90
00:04:17,000 --> 00:04:18,000
A year later.

91
00:04:18,000 --> 00:04:19,680
Your environment is unrecognizable.

92
00:04:19,680 --> 00:04:23,480
Teams have broad sharing permissions that should have been revoked months ago.

93
00:04:23,480 --> 00:04:26,200
Retention policies are inconsistent across different divisions.

94
00:04:26,200 --> 00:04:28,200
Some mailboxes have protection enabled.

95
00:04:28,200 --> 00:04:32,360
While others are completely open, no human being has a full picture of the state of the system.

96
00:04:32,360 --> 00:04:35,840
And as you add more teams and more tenants, the drift only moves faster.

97
00:04:35,840 --> 00:04:37,520
The problem isn't that drift happens.

98
00:04:37,520 --> 00:04:39,360
The problem is that in a manual system, you don't have to worry about the system.

99
00:04:39,360 --> 00:04:42,080
You don't know how much drift you have until something breaks.

100
00:04:42,080 --> 00:04:43,640
Then there is the cost of oversight.

101
00:04:43,640 --> 00:04:45,160
This doesn't scale in a straight line.

102
00:04:45,160 --> 00:04:48,120
If you have 100 users, one person can audit access.

103
00:04:48,120 --> 00:04:51,200
But when you have 100,000 users, you don't just need more people.

104
00:04:51,200 --> 00:04:52,920
You need an army, complexity compounds.

105
00:04:52,920 --> 00:04:55,960
You end up with people managing people just to manage the system.

106
00:04:55,960 --> 00:04:59,000
You build approval chains because one person can't make every decision.

107
00:04:59,000 --> 00:05:02,440
You write endless documentation because the knowledge can't stay in one head.

108
00:05:02,440 --> 00:05:04,080
All of this overhead becomes the bottleneck.

109
00:05:04,080 --> 00:05:05,120
A user needs access.

110
00:05:05,120 --> 00:05:06,120
It goes into a queue.

111
00:05:06,120 --> 00:05:08,600
It sits with a reviewer who's already buried in requests.

112
00:05:08,600 --> 00:05:09,600
It waits three weeks.

113
00:05:09,600 --> 00:05:10,920
The business misses a deadline.

114
00:05:10,920 --> 00:05:11,920
So they find a workaround.

115
00:05:11,920 --> 00:05:13,400
They build a parallel system.

116
00:05:13,400 --> 00:05:16,200
The cost of your governance doesn't just slow things down.

117
00:05:16,200 --> 00:05:21,280
It actually incentivizes people to bypass your security entirely at the same time.

118
00:05:21,280 --> 00:05:24,000
Regulatory expectations shifted while no one was looking.

119
00:05:24,000 --> 00:05:26,040
Regulators no longer care about your manual audits.

120
00:05:26,040 --> 00:05:28,680
They expect continuous automated controls.

121
00:05:28,680 --> 00:05:31,240
They want proof that policies are enforced in real time.

122
00:05:31,240 --> 00:05:32,560
Not a report from three months ago.

123
00:05:32,560 --> 00:05:36,360
If an auditor sees a misconfiguration that existed for two weeks before a human found

124
00:05:36,360 --> 00:05:37,640
it, that is a failure.

125
00:05:37,640 --> 00:05:38,840
The new standard is different.

126
00:05:38,840 --> 00:05:42,280
The system must detect the error in milliseconds and fix it in seconds.

127
00:05:42,280 --> 00:05:43,720
Manual governance cannot do this.

128
00:05:43,720 --> 00:05:45,400
You aren't failing because you aren't trying.

129
00:05:45,400 --> 00:05:49,240
You're failing because the model itself is incompatible with the year 2025.

130
00:05:49,240 --> 00:05:50,480
This is how Shadow IT starts.

131
00:05:50,480 --> 00:05:52,640
A team needs to collaborate with a partner.

132
00:05:52,640 --> 00:05:54,240
Your formal process takes six weeks.

133
00:05:54,240 --> 00:05:57,360
So they just create an ungoverned channel and share the files there.

134
00:05:57,360 --> 00:05:59,560
A product team needs data for an analysis.

135
00:05:59,560 --> 00:06:02,280
Your request process takes three weeks and three managers.

136
00:06:02,280 --> 00:06:05,240
So they export the data into an unmanaged tool.

137
00:06:05,240 --> 00:06:07,000
Governance that is too slow doesn't stop risk.

138
00:06:07,000 --> 00:06:07,840
It just moves it.

139
00:06:07,840 --> 00:06:11,760
It pushes the risk from the formal system into the shadows where you have no visibility

140
00:06:11,760 --> 00:06:12,760
and no control.

141
00:06:12,760 --> 00:06:15,520
And now the risk of data exposure is multiplying.

142
00:06:15,520 --> 00:06:19,760
When you introduce co-pilot and AI agents, misconfiguration becomes an existential threat

143
00:06:19,760 --> 00:06:20,760
in the old model.

144
00:06:20,760 --> 00:06:23,480
One user having access to the wrong folder was a problem.

145
00:06:23,480 --> 00:06:24,600
But it was a small problem.

146
00:06:24,600 --> 00:06:27,160
One user, one folder, with AI.

147
00:06:27,160 --> 00:06:28,680
The blast radius is enterprise scale.

148
00:06:28,680 --> 00:06:32,280
A single permission error can expose millions of documents instantly.

149
00:06:32,280 --> 00:06:36,200
An agent meant to summarize emails might accidentally read every customer contract in the

150
00:06:36,200 --> 00:06:36,960
company.

151
00:06:36,960 --> 00:06:41,400
Compliance bot might start leaking sensitive health data in its chat responses.

152
00:06:41,400 --> 00:06:43,040
It isn't about one folder anymore.

153
00:06:43,040 --> 00:06:45,200
It's about the entire data state.

154
00:06:45,200 --> 00:06:49,080
Manual governance is breaking because it is mathematically impossible to sustain.

155
00:06:49,080 --> 00:06:51,160
He's structural flow and current thinking.

156
00:06:51,160 --> 00:06:53,400
Most organizations know the bottleneck is real.

157
00:06:53,400 --> 00:06:54,880
They feel the friction every day.

158
00:06:54,880 --> 00:06:56,640
But they are solving for the wrong problem.

159
00:06:56,640 --> 00:06:59,040
The first mistake is how they view the technology.

160
00:06:59,040 --> 00:07:01,640
They treat Microsoft Graph as an API for developers.

161
00:07:01,640 --> 00:07:04,400
It's seen as a back and tool for scripts or integrations.

162
00:07:04,400 --> 00:07:06,240
The operations team doesn't look at it.

163
00:07:06,240 --> 00:07:11,240
Security manages their own silos, defender, purview, and entra.

164
00:07:11,240 --> 00:07:14,560
They don't realize that Graph is the central nervous system connecting all of them.

165
00:07:14,560 --> 00:07:16,720
Because they miss this, they automate in fragments.

166
00:07:16,720 --> 00:07:18,400
They write a script to find all teams.

167
00:07:18,400 --> 00:07:20,360
They write another to check retention labels.

168
00:07:20,360 --> 00:07:22,280
They write a third to audit access.

169
00:07:22,280 --> 00:07:25,720
Each script has its own data, its own permissions, and its own trail.

170
00:07:25,720 --> 00:07:27,600
They are treating individual symptoms.

171
00:07:27,600 --> 00:07:31,160
Instead of managing the single structure that coordinates the whole body.

172
00:07:31,160 --> 00:07:32,320
Then comes the second mistake.

173
00:07:32,320 --> 00:07:34,440
They see automation as a way to cut costs.

174
00:07:34,440 --> 00:07:35,600
The math looks easy.

175
00:07:35,600 --> 00:07:37,080
Automate the boring work.

176
00:07:37,080 --> 00:07:38,280
Reduce the headcount.

177
00:07:38,280 --> 00:07:39,080
Save the money.

178
00:07:39,080 --> 00:07:41,880
They build bots to handle password resets and basic tickets.

179
00:07:41,880 --> 00:07:42,800
It works for a while.

180
00:07:42,800 --> 00:07:44,160
The manual workload goes down.

181
00:07:44,160 --> 00:07:45,080
But here is the trap.

182
00:07:45,080 --> 00:07:47,040
They are optimizing for cost per ticket.

183
00:07:47,040 --> 00:07:48,160
Not risk per decision.

184
00:07:48,160 --> 00:07:51,280
When a human makes a choice, we assume they use judgment.

185
00:07:51,280 --> 00:07:54,360
When a script applies a rule to 10,000 requested ones.

186
00:07:54,360 --> 00:07:57,400
A single mistake hits 10,000 targets at machine speed.

187
00:07:57,400 --> 00:07:58,840
The cost of the ticket dropped.

188
00:07:58,840 --> 00:08:00,680
But the risk of the decision exploded.

189
00:08:00,680 --> 00:08:04,600
You end up with a system that is efficient, but incredibly fragile.

190
00:08:04,600 --> 00:08:07,920
The third floor is the belief that humans can stay in the loop.

191
00:08:07,920 --> 00:08:09,000
This is where the math wins.

192
00:08:09,000 --> 00:08:12,080
At a certain scale, a human cannot meaningfully review every decision.

193
00:08:12,080 --> 00:08:15,400
A large company has millions of access changes every month.

194
00:08:15,400 --> 00:08:19,400
Memberships, permissions, policy shifts, you cannot put a human eye on all of them.

195
00:08:19,400 --> 00:08:20,640
So you build workflows.

196
00:08:20,640 --> 00:08:21,960
You create chains of command.

197
00:08:21,960 --> 00:08:24,600
You require three levels of approval and manager sign-offs.

198
00:08:24,600 --> 00:08:26,480
This doesn't actually solve the problem.

199
00:08:26,480 --> 00:08:29,560
It just spreads the work across more people and adds weeks of delay.

200
00:08:29,560 --> 00:08:30,560
The process slows down.

201
00:08:30,560 --> 00:08:31,880
The business gets frustrated.

202
00:08:31,880 --> 00:08:33,600
They find the work around we talked about.

203
00:08:33,600 --> 00:08:37,560
The system becomes less secure, specifically because you tried to keep a human in the middle

204
00:08:37,560 --> 00:08:38,560
of it.

205
00:08:38,560 --> 00:08:40,560
The fundamental floor is the metric.

206
00:08:40,560 --> 00:08:43,960
Organizations are focused on how much it costs to handle a request, when they should be

207
00:08:43,960 --> 00:08:46,480
focused on the exposure if that request is wrong.

208
00:08:46,480 --> 00:08:48,120
These two goals do not work together.

209
00:08:48,120 --> 00:08:52,080
If you optimize for cost, you automate everything as fast as possible and assume the rules

210
00:08:52,080 --> 00:08:53,080
are right.

211
00:08:53,080 --> 00:08:56,880
If you optimize for risk, you build continuous verification into every single step.

212
00:08:56,880 --> 00:09:00,680
You make sure the system flags anomalies the moment they happen, until you see graph

213
00:09:00,680 --> 00:09:02,080
as your nervous system.

214
00:09:02,080 --> 00:09:06,080
Not just plumbing, you are stuck in the old model, you are still thinking like a developer,

215
00:09:06,080 --> 00:09:10,240
you are still chasing efficiency metrics, you are still trying to force humans into a loop

216
00:09:10,240 --> 00:09:11,800
that is too big for them.

217
00:09:11,800 --> 00:09:14,040
The problem isn't that you haven't automated enough.

218
00:09:14,040 --> 00:09:17,640
The problem is that you are automating the wrong things, for the wrong reasons.

219
00:09:17,640 --> 00:09:19,880
On the wrong architecture, you don't need a better script.

220
00:09:19,880 --> 00:09:23,160
You need a complete reframing of what the system is for.

221
00:09:23,160 --> 00:09:25,640
Microsoft Graph as the enterprise nervous system.

222
00:09:25,640 --> 00:09:28,840
Let's redefine what graph actually is for autonomous operations.

223
00:09:28,840 --> 00:09:32,080
Most people see Microsoft Graph as a rest API.

224
00:09:32,080 --> 00:09:36,120
A technical surface for developers to query user objects or patch permissions.

225
00:09:36,120 --> 00:09:38,240
That view is accurate, but it is incomplete.

226
00:09:38,240 --> 00:09:41,360
It misses the structural role graph plays in an autonomous system.

227
00:09:41,360 --> 00:09:45,360
Graph isn't just an API, it is the unified data plane that connects every signal your enterprise

228
00:09:45,360 --> 00:09:46,360
produces.

229
00:09:46,360 --> 00:09:50,600
Identity signals from EntraID, security signals from Defender, compliance signals from

230
00:09:50,600 --> 00:09:54,760
PerView, and operational signals from Teams and SharePoint all flow into one place.

231
00:09:54,760 --> 00:09:57,360
You can query all of it and trigger actions through it.

232
00:09:57,360 --> 00:10:00,560
This unified data plane is what makes autonomous governance possible.

233
00:10:00,560 --> 00:10:02,960
In the old model, every system lived in a silo.

234
00:10:02,960 --> 00:10:06,240
Exchange had its own logs while SharePoint had its own permission model.

235
00:10:06,240 --> 00:10:09,560
Security alerts came from one tool and compliance signals came from another.

236
00:10:09,560 --> 00:10:12,360
This meant an admin had to mentally stitch everything together.

237
00:10:12,360 --> 00:10:16,480
They had to look at a security alert about mailbox access and a compliance violation in SharePoint

238
00:10:16,480 --> 00:10:18,600
and try to figure out if they were related.

239
00:10:18,600 --> 00:10:22,080
The human was the correlation engine, the human was the decision maker, the human had

240
00:10:22,080 --> 00:10:23,760
to do all the heavy lifting.

241
00:10:23,760 --> 00:10:25,640
Graph eliminates that requirement.

242
00:10:25,640 --> 00:10:30,000
Because all the data is accessible through a single interface, a policy engine can correlate

243
00:10:30,000 --> 00:10:33,320
security alerts with access patterns in real time.

244
00:10:33,320 --> 00:10:37,200
An automation system can see that a user triggered an anomaly in their API usage while

245
00:10:37,200 --> 00:10:39,880
simultaneously accessing a sensitive file they shouldn't have.

246
00:10:39,880 --> 00:10:44,400
It sees the whole picture at once, one decision, one remediation, all coordinated through

247
00:10:44,400 --> 00:10:45,680
a single substrate.

248
00:10:45,680 --> 00:10:47,480
Graph operates in three layers.

249
00:10:47,480 --> 00:10:50,680
Understanding these is critical because they define how autonomy actually works.

250
00:10:50,680 --> 00:10:52,080
The sensory layer is detection.

251
00:10:52,080 --> 00:10:55,000
This is where Graph provides the eyes and ears of the system.

252
00:10:55,000 --> 00:10:59,800
Image notifications flow through Graph the moment a permission is granted or a team is created.

253
00:10:59,800 --> 00:11:03,720
The system doesn't have to poll or wait for a nightly scan because it knows what's happening

254
00:11:03,720 --> 00:11:04,720
instantly.

255
00:11:04,720 --> 00:11:08,240
Continuous scanning identifies drift by comparing the current state against what you actually

256
00:11:08,240 --> 00:11:09,240
want.

257
00:11:09,240 --> 00:11:11,440
Anomaly detection then surfaces behavioral risk.

258
00:11:11,440 --> 00:11:15,600
If a user suddenly requests thousands of documents they've never touched before.

259
00:11:15,600 --> 00:11:17,920
Or an agent makes API calls it 3am.

260
00:11:17,920 --> 00:11:20,720
Those patterns flow through Graph as observable signals.

261
00:11:20,720 --> 00:11:22,920
The decision layer is evaluation.

262
00:11:22,920 --> 00:11:24,360
Detection is useless without judgment.

263
00:11:24,360 --> 00:11:25,840
Graph doesn't just show you signals.

264
00:11:25,840 --> 00:11:27,400
It evaluates them.

265
00:11:27,400 --> 00:11:31,360
Policies defined in Entra or PerView are checked against real time data to see if a permission

266
00:11:31,360 --> 00:11:32,640
should be granted.

267
00:11:32,640 --> 00:11:36,080
If PerView says a file type is restricted the access is denied.

268
00:11:36,080 --> 00:11:40,680
If Entra says a team must be owned by a manager and the user isn't one the team isn't created.

269
00:11:40,680 --> 00:11:43,320
This evaluation happens thousands of times per minute.

270
00:11:43,320 --> 00:11:46,920
Humans set the policy once and the system applies it consistently.

271
00:11:46,920 --> 00:11:48,720
The action layer is remediation.

272
00:11:48,720 --> 00:11:52,440
Once the system detects and evaluates a problem something has to change.

273
00:11:52,440 --> 00:11:54,240
Automated remediation closes the loop.

274
00:11:54,240 --> 00:11:55,240
Humans are tightened.

275
00:11:55,240 --> 00:11:56,600
Labels are reapplied.

276
00:11:56,600 --> 00:11:57,800
And owners are reassigned.

277
00:11:57,800 --> 00:11:59,560
All of this happens through Graph APIs.

278
00:11:59,560 --> 00:12:04,000
Every change is logged and traceable so it can be audited or reversed if necessary.

279
00:12:04,000 --> 00:12:07,600
The nervous system matter for holds because all three layers are coordinated.

280
00:12:07,600 --> 00:12:08,680
You detect a problem.

281
00:12:08,680 --> 00:12:10,080
You evaluate it against policy.

282
00:12:10,080 --> 00:12:11,080
And you fix it.

283
00:12:11,080 --> 00:12:12,200
All of this happens through Graph.

284
00:12:12,200 --> 00:12:13,200
It is the substrate.

285
00:12:13,200 --> 00:12:17,320
The sensor layer and the action layer use the same API and the same audit trail.

286
00:12:17,320 --> 00:12:19,920
That unity is what makes autonomy coherent instead of chaotic.

287
00:12:19,920 --> 00:12:25,040
It transforms Graph from a developer tool into the central nervous system of your enterprise.

288
00:12:25,040 --> 00:12:27,920
The detection layer, how autonomous systems see.

289
00:12:27,920 --> 00:12:30,920
Let's look at how the system actually perceives problems.

290
00:12:30,920 --> 00:12:31,920
Detection is the foundation.

291
00:12:31,920 --> 00:12:33,920
You can't fix what you don't know exists.

292
00:12:33,920 --> 00:12:37,400
In the old model, the system only knew about problems when a human found them.

293
00:12:37,400 --> 00:12:41,080
An admin might run a monthly review and find a user with the wrong permissions.

294
00:12:41,080 --> 00:12:44,240
Or security analysts might spot a weird pattern in a log file.

295
00:12:44,240 --> 00:12:45,680
The human was the sensor.

296
00:12:45,680 --> 00:12:50,640
This reactive approach creates a massive gap between when a problem starts and when the fix begins.

297
00:12:50,640 --> 00:12:52,640
Autonomous detection flips this.

298
00:12:52,640 --> 00:12:56,320
Instead of humans looking for problems, the system observes itself through an event-driven

299
00:12:56,320 --> 00:12:57,320
architecture.

300
00:12:57,320 --> 00:13:00,720
In the old polling model, you ran a script every night to check if a thousand teams were

301
00:13:00,720 --> 00:13:01,720
compliant.

302
00:13:01,720 --> 00:13:04,840
You had to wait 24 hours before the system checked again.

303
00:13:04,840 --> 00:13:08,280
In that window, a team could have been open to the entire internet and state exposed

304
00:13:08,280 --> 00:13:09,480
for the full cycle.

305
00:13:09,480 --> 00:13:12,040
Event-driven architecture kills that waiting period.

306
00:13:12,040 --> 00:13:15,440
When a permission changes, Graph fires a notification immediately.

307
00:13:15,440 --> 00:13:17,120
The system reacts in milliseconds.

308
00:13:17,120 --> 00:13:21,080
The lag between the problem starting and the system seeing it shrinks from overnight to

309
00:13:21,080 --> 00:13:23,200
instant.

310
00:13:23,200 --> 00:13:26,200
Desired state modeling is what makes this detection meaningful.

311
00:13:26,200 --> 00:13:27,720
Detection without context is just noise.

312
00:13:27,720 --> 00:13:31,440
If you detect a permission change, you need to know if it was supposed to happen.

313
00:13:31,440 --> 00:13:35,560
It only becomes useful when you compare it against a model of what healthy looks like.

314
00:13:35,560 --> 00:13:39,360
For a team, the desired state might require at least two owners and specific sensitivity

315
00:13:39,360 --> 00:13:40,360
labels.

316
00:13:40,360 --> 00:13:41,360
These aren't random rules.

317
00:13:41,360 --> 00:13:43,720
They are the requirements your organization defined.

318
00:13:43,720 --> 00:13:47,440
The desired state modeling translates those rules into patterns the system can watch.

319
00:13:47,440 --> 00:13:50,760
It continuously measures the actual state against your model.

320
00:13:50,760 --> 00:13:53,120
Continuous scanning identifies drift as it occurs.

321
00:13:53,120 --> 00:13:54,360
This isn't a periodic event.

322
00:13:54,360 --> 00:13:55,360
It's ongoing.

323
00:13:55,360 --> 00:13:58,600
The system compares the actual state against the desired state thousands of times every

324
00:13:58,600 --> 00:13:59,600
minute.

325
00:13:59,600 --> 00:14:04,080
If a user's permissions change or a file is shared externally, the system checks it against

326
00:14:04,080 --> 00:14:05,080
policy right then.

327
00:14:05,080 --> 00:14:07,520
There is no human intervention and no scheduled batch jobs.

328
00:14:07,520 --> 00:14:11,200
The moment the environment deviates from the model, the system knows.

329
00:14:11,200 --> 00:14:15,400
The detection surfaces behavioral risk, which is different from a simple policy violation.

330
00:14:15,400 --> 00:14:19,000
A violation is clear, like a restricted permission existing where it shouldn't.

331
00:14:19,000 --> 00:14:20,000
An anomaly is subtle.

332
00:14:20,000 --> 00:14:23,960
It's a user accessing files they've never touched before or an account making API calls

333
00:14:23,960 --> 00:14:25,040
it unusual times.

334
00:14:25,040 --> 00:14:26,480
These things might be legitimate.

335
00:14:26,480 --> 00:14:29,720
Maybe the user has a new project, but they are worth checking because they often happen

336
00:14:29,720 --> 00:14:31,640
right before a security incident.

337
00:14:31,640 --> 00:14:35,360
Anomaly detection flags things that aren't strictly against the rules, but still warrant

338
00:14:35,360 --> 00:14:36,360
an investigation.

339
00:14:36,360 --> 00:14:39,400
The key insight is that detection is no longer human dependent.

340
00:14:39,400 --> 00:14:43,680
It doesn't rely on an admin noticing a mistake or a tired officer remembering to run a monthly

341
00:14:43,680 --> 00:14:44,680
audit.

342
00:14:44,680 --> 00:14:46,000
Detection is algorithmic and continuous.

343
00:14:46,000 --> 00:14:49,680
It is happening right now in organizations that have moved to these patterns.

344
00:14:49,680 --> 00:14:51,000
The system is watching.

345
00:14:51,000 --> 00:14:52,000
It is comparing.

346
00:14:52,000 --> 00:14:53,000
And it is flagging.

347
00:14:53,000 --> 00:14:55,920
The sensory layer of the nervous system is finally operational.

348
00:14:55,920 --> 00:14:58,400
The question for most companies isn't whether they can build this.

349
00:14:58,400 --> 00:15:00,000
It's whether they will.

350
00:15:00,000 --> 00:15:01,200
The evaluation layer.

351
00:15:01,200 --> 00:15:03,360
How autonomous systems decide.

352
00:15:03,360 --> 00:15:04,680
Detection is only half the story.

353
00:15:04,680 --> 00:15:06,800
The system also needs to think about what to do.

354
00:15:06,800 --> 00:15:10,800
A sensory nervous system that just flags problems endlessly is worse than useless.

355
00:15:10,800 --> 00:15:11,800
It's noise.

356
00:15:11,800 --> 00:15:14,280
The evaluation layer is where judgment enters the system.

357
00:15:14,280 --> 00:15:16,920
When a detection fires, the system doesn't immediately act.

358
00:15:16,920 --> 00:15:21,280
A permission might violate policy or a file might be shared externally when it shouldn't

359
00:15:21,280 --> 00:15:22,280
be.

360
00:15:22,280 --> 00:15:24,880
Maybe a user's access pattern shifted in a way that looks wrong.

361
00:15:24,880 --> 00:15:27,080
In these moments, the system evaluates.

362
00:15:27,080 --> 00:15:31,440
Policy engines take the detected issue and run it against your organizational rules,

363
00:15:31,440 --> 00:15:34,560
which is how governance policy actually becomes operational.

364
00:15:34,560 --> 00:15:39,160
If a user is accessing financial documents they shouldn't see, the policy engine knows.

365
00:15:39,160 --> 00:15:42,320
If a file should have been archived six months ago but it's still in active storage, the

366
00:15:42,320 --> 00:15:43,320
engine flags it.

367
00:15:43,320 --> 00:15:47,320
When a document is classified as confidential but gets shared with the entire company,

368
00:15:47,320 --> 00:15:48,880
the system catches that violation.

369
00:15:48,880 --> 00:15:50,880
The policy engine isn't making a judgment call.

370
00:15:50,880 --> 00:15:53,360
It's applying rules.

371
00:15:53,360 --> 00:15:56,720
Humans define these rules once and now the system applies them consistently thousands

372
00:15:56,720 --> 00:15:58,200
of times per second.

373
00:15:58,200 --> 00:16:00,440
Risk classification determines the urgency.

374
00:16:00,440 --> 00:16:02,760
Not every violation requires an immediate response.

375
00:16:02,760 --> 00:16:07,720
A low-risk configuration drift, like a retention policy set to 30 days instead of 90, might

376
00:16:07,720 --> 00:16:09,680
get fixed in a nightly batch.

377
00:16:09,680 --> 00:16:11,960
But a critical security exposure is different.

378
00:16:11,960 --> 00:16:16,000
If a high-privileged account has unrestricted access to customer personal data that requires

379
00:16:16,000 --> 00:16:20,360
an immediate fix, the evaluation layer classifies the risk and assigns a severity level to the

380
00:16:20,360 --> 00:16:21,360
problem.

381
00:16:21,360 --> 00:16:26,000
It determines whether a human needs to step in first or if the system can fix it autonomously.

382
00:16:26,000 --> 00:16:29,600
Critical issues affecting regulated data escalate immediately, while low-risk issues get

383
00:16:29,600 --> 00:16:33,560
batched with others for a maintenance window, the system triages automatically.

384
00:16:33,560 --> 00:16:37,000
It doesn't flood your operations team with alerts about every minor deviation.

385
00:16:37,000 --> 00:16:39,800
It surfaces the exceptions that actually matter.

386
00:16:39,800 --> 00:16:43,600
This is how the system maintains human oversight without creating a bottleneck.

387
00:16:43,600 --> 00:16:46,960
For high-impact changes, approval workflows ensure that judgment still happens where it

388
00:16:46,960 --> 00:16:48,200
needs to happen.

389
00:16:48,200 --> 00:16:52,080
Before the system revokes a permission or forces a policy change on a critical service,

390
00:16:52,080 --> 00:16:53,080
it gets approval.

391
00:16:53,080 --> 00:16:55,200
But notice what's different from manual governance.

392
00:16:55,200 --> 00:16:57,960
The human isn't reviewing a thousand requests per day.

393
00:16:57,960 --> 00:17:02,520
The human is reviewing the exceptions that the system flagged as requiring real judgment.

394
00:17:02,520 --> 00:17:07,000
A sensitive access change, a policy violation in a regulated system, or a conflict between

395
00:17:07,000 --> 00:17:09,200
business need and security policy.

396
00:17:09,200 --> 00:17:11,480
These are the cases where human judgment adds value.

397
00:17:11,480 --> 00:17:13,440
The human says, yes, revoke that permission.

398
00:17:13,440 --> 00:17:14,440
It shouldn't exist.

399
00:17:14,440 --> 00:17:18,160
Or they might say, actually, wait, this is legitimate because we have a legal hold on this

400
00:17:18,160 --> 00:17:19,160
content.

401
00:17:19,160 --> 00:17:20,160
Don't delete it.

402
00:17:20,160 --> 00:17:23,000
The human provides the judgment that the rules can't capture and then the system executes

403
00:17:23,000 --> 00:17:24,840
that decision at scale.

404
00:17:24,840 --> 00:17:28,680
This enrichment is what prevents false positives and stupid decisions.

405
00:17:28,680 --> 00:17:32,760
A user might have read access to a folder containing design documents and the policy engine

406
00:17:32,760 --> 00:17:33,760
will detect this.

407
00:17:33,760 --> 00:17:36,640
But before it revokes the permission, it checks the context.

408
00:17:36,640 --> 00:17:38,160
Is this user in the design department?

409
00:17:38,160 --> 00:17:40,640
Are they supposed to have access to these documents?

410
00:17:40,640 --> 00:17:44,080
Where they granted this permission through a proper access request workflow?

411
00:17:44,080 --> 00:17:47,720
Context enrichment prevents the system from making brutal, literal decisions that technically

412
00:17:47,720 --> 00:17:50,600
follow the rules but violate operational reality.

413
00:17:50,600 --> 00:17:55,360
A permission might technically violate a policy but it might also be explicitly justified.

414
00:17:55,360 --> 00:17:59,400
The evaluation layer understands the difference between a violation and an exception.

415
00:17:59,400 --> 00:18:03,360
It understands why a permission exists before it decides whether to remove it.

416
00:18:03,360 --> 00:18:05,280
The shift fundamentally is this.

417
00:18:05,280 --> 00:18:06,720
Human set policy once.

418
00:18:06,720 --> 00:18:07,880
They define the rules.

419
00:18:07,880 --> 00:18:08,880
What is acceptable?

420
00:18:08,880 --> 00:18:09,880
What is risky?

421
00:18:09,880 --> 00:18:10,880
What requires approval?

422
00:18:10,880 --> 00:18:14,320
Then the system applies those policies continuously and consistently.

423
00:18:14,320 --> 00:18:18,640
A human can't review 10 million access decisions per day, but a policy engine can.

424
00:18:18,640 --> 00:18:22,920
A human can't remember which rules apply to which scenario but a policy engine can.

425
00:18:22,920 --> 00:18:26,680
The evaluation layer automates judgment at scale while preserving human oversight where

426
00:18:26,680 --> 00:18:27,880
it actually matters.

427
00:18:27,880 --> 00:18:29,200
The remediation layer.

428
00:18:29,200 --> 00:18:31,240
How autonomous systems act.

429
00:18:31,240 --> 00:18:35,760
Once the system has detected a problem and decided what to do, it needs to act.

430
00:18:35,760 --> 00:18:37,920
Detection without action is just observation.

431
00:18:37,920 --> 00:18:40,040
Evaluation without execution is just analysis.

432
00:18:40,040 --> 00:18:44,080
The remediation layer is where the system moves from thinking to doing.

433
00:18:44,080 --> 00:18:46,640
Automated remediation closes the feedback loop.

434
00:18:46,640 --> 00:18:50,520
The detection layer identifies a problem and the evaluation layer determines its

435
00:18:50,520 --> 00:18:52,200
a violation that needs fixing.

436
00:18:52,200 --> 00:18:56,360
In a manual system, a ticket gets created, someone reads it, someone schedules time to fix

437
00:18:56,360 --> 00:18:59,080
it, and eventually someone executes the fix.

438
00:18:59,080 --> 00:19:02,800
Days pass while the problem persists and the vulnerability remains open.

439
00:19:02,800 --> 00:19:05,760
In the autonomous system, remediation happens immediately.

440
00:19:05,760 --> 00:19:10,040
The moment the evaluation layer says this permission shouldn't exist, the remediation system

441
00:19:10,040 --> 00:19:11,040
revokes it.

442
00:19:11,040 --> 00:19:14,840
The moment a policy says this file should have a sensitivity label, the system applies

443
00:19:14,840 --> 00:19:15,840
it.

444
00:19:15,840 --> 00:19:17,880
The remediation layer is missing, the system reassigns it.

445
00:19:17,880 --> 00:19:21,040
When a retention policy expires, the system archives the content.

446
00:19:21,040 --> 00:19:24,720
This doesn't happen on a schedule and it doesn't wait for human approval in the routine

447
00:19:24,720 --> 00:19:25,720
case.

448
00:19:25,720 --> 00:19:28,720
It happens in the microsecond after the evaluation decision is made.

449
00:19:28,720 --> 00:19:31,040
What does remediation look like concretely?

450
00:19:31,040 --> 00:19:35,560
Imagine a user's access role has changed because they're moving from engineering to sales.

451
00:19:35,560 --> 00:19:39,600
The remediation system calls graph APIs to remove them from the engineering distribution

452
00:19:39,600 --> 00:19:42,680
list and revoke their access to the code repository.

453
00:19:42,680 --> 00:19:47,200
At the same time, it adds them to sales distribution lists and grants access to customer data.

454
00:19:47,200 --> 00:19:49,560
The entire access transition happens automatically.

455
00:19:49,560 --> 00:19:53,480
The user goes home on Friday as an engineer and comes back Monday as a salesperson with exactly

456
00:19:53,480 --> 00:19:54,480
the right access.

457
00:19:54,480 --> 00:19:58,200
There is no manual provisioning, no forgotten access removals, and no stale permissions

458
00:19:58,200 --> 00:19:59,600
lingering in the system.

459
00:19:59,600 --> 00:20:03,600
Self-healing architecture reduces the meantime to remediation from hours to seconds.

460
00:20:03,600 --> 00:20:06,800
MTTR is how the industry measures operational responsiveness.

461
00:20:06,800 --> 00:20:09,320
When a problem occurs, how long until it's fixed?

462
00:20:09,320 --> 00:20:14,240
In the manual system, MTTR is measured in hours at best, but often it takes days.

463
00:20:14,240 --> 00:20:18,080
Someone has to notice the problem, investigate it, and determine a fix before they can finally

464
00:20:18,080 --> 00:20:19,400
execute it.

465
00:20:19,400 --> 00:20:22,680
Each step introduces latency.

466
00:20:22,680 --> 00:20:25,680
In an autonomous system, MTTR is measured in milliseconds.

467
00:20:25,680 --> 00:20:30,480
The detection fires, the evaluation confirms the violation, and the remediation executes.

468
00:20:30,480 --> 00:20:33,760
That speed difference is a massive competitive advantage.

469
00:20:33,760 --> 00:20:38,200
A security exposure that would remain for hours in a manual system is fixed in seconds

470
00:20:38,200 --> 00:20:39,200
here.

471
00:20:39,200 --> 00:20:42,540
A advanced violation that would linger for days is corrected in the time it takes for a single

472
00:20:42,540 --> 00:20:44,640
API call to complete.

473
00:20:44,640 --> 00:20:47,760
Immutable audit trails ensure every action is logged and traceable.

474
00:20:47,760 --> 00:20:50,240
This is non-negotiable.

475
00:20:50,240 --> 00:20:54,160
When the system fixes something, we need to know exactly what changed and why.

476
00:20:54,160 --> 00:20:56,440
An immutable audit trail captures it all.

477
00:20:56,440 --> 00:20:59,680
Maybe the system detected orphaned ownership in a team because nobody had been assigned

478
00:20:59,680 --> 00:21:01,200
as owner for 90 days.

479
00:21:01,200 --> 00:21:04,880
This triggered the owner's required policy, so the system reassigned ownership to the

480
00:21:04,880 --> 00:21:06,080
department manager.

481
00:21:06,080 --> 00:21:09,760
The decision was made by the policy engine, and the execution was logged with a timestamp

482
00:21:09,760 --> 00:21:10,760
and confirmation.

483
00:21:10,760 --> 00:21:14,320
If there's ever a question about why ownership changed, the answer is recorded.

484
00:21:14,320 --> 00:21:16,200
It's not just someone changed it.

485
00:21:16,200 --> 00:21:20,000
The log shows the autonomy system changed it because a specific policy was violated.

486
00:21:20,000 --> 00:21:22,760
This level of traceability is essential for governance.

487
00:21:22,760 --> 00:21:26,040
Auditors need to see the policy context that caused the action to happen.

488
00:21:26,040 --> 00:21:27,440
The log isn't an afterthought.

489
00:21:27,440 --> 00:21:31,040
It's the evidence that your governance is actually operating according to your rules.

490
00:21:31,040 --> 00:21:34,120
Rollback capabilities provide safety.

491
00:21:34,120 --> 00:21:36,840
Internet scale means mistakes can propagate instantly.

492
00:21:36,840 --> 00:21:41,160
If a remediation decision is wrong because a policy was misconfigured, the system needs

493
00:21:41,160 --> 00:21:42,480
to revert.

494
00:21:42,480 --> 00:21:45,720
Rollback means the system remembers its prior state and can restore it.

495
00:21:45,720 --> 00:21:49,360
If a label was applied to a thousand documents by mistake, rollback restores them to their

496
00:21:49,360 --> 00:21:50,680
original state.

497
00:21:50,680 --> 00:21:54,320
If a permission was revoked that turned out to be needed for a critical process, rollback

498
00:21:54,320 --> 00:21:57,440
restores it while the evaluation layer reconsideres.

499
00:21:57,440 --> 00:21:59,840
The safety mechanism isn't "don't automate".

500
00:21:59,840 --> 00:22:02,960
The safety mechanism is "automate", but be able to undo.

501
00:22:02,960 --> 00:22:07,440
The outcome is infrastructure that heals itself before humans even know something broke.

502
00:22:07,440 --> 00:22:10,400
Problems are detected, evaluated and remediated in real time.

503
00:22:10,400 --> 00:22:12,480
The system maintains its own health.

504
00:22:12,480 --> 00:22:15,480
Humans define the policy and the system enforces it.

505
00:22:15,480 --> 00:22:17,440
The 2026 inflection point.

506
00:22:17,440 --> 00:22:20,080
Everything we've discussed so far is technically possible.

507
00:22:20,080 --> 00:22:21,080
Autonomy is achievable.

508
00:22:21,080 --> 00:22:22,800
Self-healing governance is feasible.

509
00:22:22,800 --> 00:22:26,880
Graph as your nervous system is architecturally sound, but theory and practice diverge when

510
00:22:26,880 --> 00:22:27,880
you hit deadlines.

511
00:22:27,880 --> 00:22:30,720
And 2026 is when Microsoft forces the transition.

512
00:22:30,720 --> 00:22:32,680
This isn't a recommendation to move eventually.

513
00:22:32,680 --> 00:22:33,960
This isn't a gradual phase out.

514
00:22:33,960 --> 00:22:34,960
These are hard dates.

515
00:22:34,960 --> 00:22:37,520
If you haven't moved by these dates, your automation stopped working.

516
00:22:37,520 --> 00:22:39,160
Your security integrations break.

517
00:22:39,160 --> 00:22:40,560
Your agents stop executing.

518
00:22:40,560 --> 00:22:41,560
It's not a suggestion.

519
00:22:41,560 --> 00:22:42,920
It's a structural requirement.

520
00:22:42,920 --> 00:22:47,480
April 2026 is when the Microsoft Graph Security API V1 retires.

521
00:22:47,480 --> 00:22:51,600
Most organizations have built security automation that depends on the Graph Security Connector.

522
00:22:51,600 --> 00:22:55,800
When that date hits, those workflows start failing because the connector simply stops working.

523
00:22:55,800 --> 00:22:59,840
Your incident response automation that was supposed to trigger during a high severity alert.

524
00:22:59,840 --> 00:23:02,760
Broken, your security playbooks that fetch alert data?

525
00:23:02,760 --> 00:23:03,760
Broken.

526
00:23:03,760 --> 00:23:06,160
Your CM tools that pull security events through the API?

527
00:23:06,160 --> 00:23:07,160
Broken.

528
00:23:07,160 --> 00:23:11,720
The moment April arrives, you must have migrated to Graph Security, API V2, or your security

529
00:23:11,720 --> 00:23:13,120
automation goes dark.

530
00:23:13,120 --> 00:23:14,600
This isn't a nice to have update.

531
00:23:14,600 --> 00:23:17,520
If you're running automated threat response, it stops.

532
00:23:17,520 --> 00:23:21,680
Most companies will only discover this when an incident occurs, and their automated response

533
00:23:21,680 --> 00:23:22,680
fails to trigger.

534
00:23:22,680 --> 00:23:28,200
August 28, 2026 is when the Microsoft Graph Toolkit and the Graph CLI retire.

535
00:23:28,200 --> 00:23:31,360
Many teams use these tools to interact with Graph every single day.

536
00:23:31,360 --> 00:23:35,560
The Toolkit provided the UI components for building applications, while the CLI provided

537
00:23:35,560 --> 00:23:37,800
the command line interface for operations.

538
00:23:37,800 --> 00:23:40,800
If you're scripting relies on these tools, that era is ending.

539
00:23:40,800 --> 00:23:44,760
You need to move to the PowerShell SDK or direct-rest API calls immediately.

540
00:23:44,760 --> 00:23:49,800
For many of you, this means rewriting automation scripts that are currently running in production.

541
00:23:49,800 --> 00:23:52,680
June 15, 2026 is the most critical date of all.

542
00:23:52,680 --> 00:23:56,280
The legacy agent registry API becomes unsupported on this day.

543
00:23:56,280 --> 00:23:59,360
Many agent registered through that old path will stop working.

544
00:23:59,360 --> 00:24:03,680
If you created agents before the migration to agent 365 and didn't re-register them,

545
00:24:03,680 --> 00:24:04,680
they become inert.

546
00:24:04,680 --> 00:24:06,560
They're still there, but they don't function.

547
00:24:06,560 --> 00:24:09,880
Your automated governance agents stop detecting drift.

548
00:24:09,880 --> 00:24:11,920
Your compliance agent stop checking policies.

549
00:24:11,920 --> 00:24:15,360
Your incident response agent stop correlating security signals.

550
00:24:15,360 --> 00:24:17,400
Months of automation work will just stop executing.

551
00:24:17,400 --> 00:24:18,800
These aren't optional updates.

552
00:24:18,800 --> 00:24:20,200
They're structural migrations.

553
00:24:20,200 --> 00:24:21,520
They don't just affect one tool.

554
00:24:21,520 --> 00:24:23,640
They affect every PowerShell script that calls Graph.

555
00:24:23,640 --> 00:24:25,680
They affect every integration with your CM.

556
00:24:25,680 --> 00:24:27,560
They affect every agent you've deployed.

557
00:24:27,560 --> 00:24:29,760
All of it depends on this infrastructure.

558
00:24:29,760 --> 00:24:31,480
And all of it breaks if you don't migrate.

559
00:24:31,480 --> 00:24:33,120
The cascading failures are real.

560
00:24:33,120 --> 00:24:37,520
An organization misses the April 20, 2026 deadline for the security API.

561
00:24:37,520 --> 00:24:39,680
Their automation breaks.

562
00:24:39,680 --> 00:24:43,000
Three months later, they missed the June deadline for agent registration.

563
00:24:43,000 --> 00:24:44,440
Their governance agent stop working.

564
00:24:44,440 --> 00:24:48,360
By August, they are scrambling to rewrite scripts under extreme time pressure.

565
00:24:48,360 --> 00:24:49,520
Mistakes happen.

566
00:24:49,520 --> 00:24:51,200
Security controls aren't properly tested.

567
00:24:51,200 --> 00:24:53,200
Governance that used to work becomes fragile.

568
00:24:53,200 --> 00:24:54,480
This isn't a distant concern.

569
00:24:54,480 --> 00:24:55,960
It's 18 months away.

570
00:24:55,960 --> 00:24:58,960
Organizations that haven't started planning are already behind.

571
00:24:58,960 --> 00:25:03,200
The teams that will thrive in 2030 are the ones that see 2026 as the inflection point.

572
00:25:03,200 --> 00:25:06,560
The moment when you have to commit, the moment when the old model stops working and the

573
00:25:06,560 --> 00:25:08,480
new model becomes mandatory.

574
00:25:08,480 --> 00:25:10,800
The question isn't whether you'll migrate.

575
00:25:10,800 --> 00:25:12,720
You will.

576
00:25:12,720 --> 00:25:14,680
The question is whether you'll be ready.

577
00:25:14,680 --> 00:25:17,000
Agent 365, the governance framework.

578
00:25:17,000 --> 00:25:19,960
Microsoft's response to the autonomy challenge is Agent 365.

579
00:25:19,960 --> 00:25:23,520
It reveals everything about where enterprise IT is actually headed.

580
00:25:23,520 --> 00:25:25,200
This isn't a product announcement.

581
00:25:25,200 --> 00:25:26,600
It's a structural requirement.

582
00:25:26,600 --> 00:25:31,000
Agent 365 is the unified control plane for every AI agent in your environment.

583
00:25:31,000 --> 00:25:35,200
It's the system that translates the nervous system concept into operational practice.

584
00:25:35,200 --> 00:25:37,400
But here's the problem with how we used to think.

585
00:25:37,400 --> 00:25:41,320
When you build power shell scripts or graph integrations in the past, you are building tools.

586
00:25:41,320 --> 00:25:42,760
They operate it under your control.

587
00:25:42,760 --> 00:25:44,360
They use credentials you manage.

588
00:25:44,360 --> 00:25:45,360
Agents are different.

589
00:25:45,360 --> 00:25:46,800
Agents are autonomous workers.

590
00:25:46,800 --> 00:25:47,800
They make decisions.

591
00:25:47,800 --> 00:25:48,800
They take actions.

592
00:25:48,800 --> 00:25:50,360
They operate when you're not watching.

593
00:25:50,360 --> 00:25:53,160
And you cannot manage autonomous workers like you manage tools.

594
00:25:53,160 --> 00:25:55,040
You manage them like you manage employees.

595
00:25:55,040 --> 00:25:57,440
Agent 365 is the embodiment of that shift.

596
00:25:57,440 --> 00:26:01,560
Every agent deployed through Agent 365 gets a unique identity in EntraID.

597
00:26:01,560 --> 00:26:05,040
This isn't a shared service account or a hidden credential in a script.

598
00:26:05,040 --> 00:26:06,360
It's a first class identity.

599
00:26:06,360 --> 00:26:08,600
Treat it exactly like a human employee.

600
00:26:08,600 --> 00:26:09,880
This agent is owned by someone.

601
00:26:09,880 --> 00:26:10,880
It has a sponsor.

602
00:26:10,880 --> 00:26:12,360
It has a clear business justification.

603
00:26:12,360 --> 00:26:15,880
If you ask why an agent exists or what it's authorized to do, you get real answers.

604
00:26:15,880 --> 00:26:17,840
The agent goes through onboarding.

605
00:26:17,840 --> 00:26:20,480
Permissions are assigned based on a specific role.

606
00:26:20,480 --> 00:26:23,480
This is provisioned according to the principle of least privilege.

607
00:26:23,480 --> 00:26:25,840
The agent operates within defined boundaries.

608
00:26:25,840 --> 00:26:27,040
Compare this to the old model.

609
00:26:27,040 --> 00:26:28,360
You create a service principle.

610
00:26:28,360 --> 00:26:31,120
You granted broad permissions because you aren't sure what it needs.

611
00:26:31,120 --> 00:26:33,120
It's easier than figuring out the minimal set.

612
00:26:33,120 --> 00:26:35,840
The service principle runs with whatever access you gave it.

613
00:26:35,840 --> 00:26:40,320
If someone asks why it has admin access to the entire tenant, the answer is usually vague.

614
00:26:40,320 --> 00:26:42,360
That vagueness was acceptable in the past.

615
00:26:42,360 --> 00:26:44,680
It's not acceptable for autonomous workers.

616
00:26:44,680 --> 00:26:47,280
Leased privilege permissions now replace broad access.

617
00:26:47,280 --> 00:26:50,320
The agent is granted only what it needs to finish its specific task.

618
00:26:50,320 --> 00:26:54,840
A governance agent that enforces team's ownership can read metadata and update owners.

619
00:26:54,840 --> 00:26:55,840
It cannot read email.

620
00:26:55,840 --> 00:26:57,200
It cannot delete files.

621
00:26:57,200 --> 00:26:59,080
It cannot manage security policies.

622
00:26:59,080 --> 00:27:03,000
An incident response agent can read security alerts and update user access.

623
00:27:03,000 --> 00:27:05,400
It cannot modify firewalls or reset passwords.

624
00:27:05,400 --> 00:27:06,880
The principle is ruthlessly simple.

625
00:27:06,880 --> 00:27:09,520
Give the agent exactly what it needs and nothing more.

626
00:27:09,520 --> 00:27:12,080
This creates natural boundaries for the blast radius.

627
00:27:12,080 --> 00:27:16,120
If the agent is compromised, the damage is limited to its actual scope.

628
00:27:16,120 --> 00:27:19,800
The newest monitoring via Defender and PerView means every action is observed.

629
00:27:19,800 --> 00:27:21,680
The agent's API calls are tracked.

630
00:27:21,680 --> 00:27:23,240
Its permission grants are audited.

631
00:27:23,240 --> 00:27:26,360
Its policy enforcement is recorded with full context.

632
00:27:26,360 --> 00:27:29,320
If the agent behaves unexpectedly, Defender flags it.

633
00:27:29,320 --> 00:27:30,840
If it accesses data, it shouldn't.

634
00:27:30,840 --> 00:27:31,840
PerView logs it.

635
00:27:31,840 --> 00:27:34,680
The system surfaces anomalies just as it would for a human user.

636
00:27:34,680 --> 00:27:36,240
The agent isn't operating in the dark.

637
00:27:36,240 --> 00:27:38,040
It's completely visible and auditable.

638
00:27:38,040 --> 00:27:40,120
The implication cuts deeper than it looks.

639
00:27:40,120 --> 00:27:41,880
Autonomy doesn't mean uncontrolled.

640
00:27:41,880 --> 00:27:44,800
It means controlled by policy instead of by human oversight.

641
00:27:44,800 --> 00:27:46,000
The agent has a job to do.

642
00:27:46,000 --> 00:27:47,520
The policy is defined what's acceptable.

643
00:27:47,520 --> 00:27:49,440
The agent operates within those policies.

644
00:27:49,440 --> 00:27:52,000
If it tries to exceed them, the system stops it.

645
00:27:52,000 --> 00:27:54,360
If it behaves strangely, the system alerts you.

646
00:27:54,360 --> 00:27:56,040
If it's no longer needed, it's deprovisioned.

647
00:27:56,040 --> 00:27:57,080
The control is structural.

648
00:27:57,080 --> 00:27:58,600
The control is automatic.

649
00:27:58,600 --> 00:28:00,880
It doesn't require a human approving every single action.

650
00:28:00,880 --> 00:28:04,840
It requires policy being defined correctly and the system enforcing that policy.

651
00:28:04,840 --> 00:28:08,600
This is why agent 365 forces a complete rethinking of governance.

652
00:28:08,600 --> 00:28:10,680
You can no longer manage agents as tools.

653
00:28:10,680 --> 00:28:12,080
You have to manage them as workers.

654
00:28:12,080 --> 00:28:15,080
You have to think about identity, role and continuous oversight.

655
00:28:15,080 --> 00:28:19,200
You have to define the policies that the agent will enforce while it operates independently.

656
00:28:19,200 --> 00:28:22,320
The shift isn't just technical, it's organizational.

657
00:28:22,320 --> 00:28:26,240
Your governance model has to accommodate workers who operate at machine speed.

658
00:28:26,240 --> 00:28:27,560
Entra agent ID.

659
00:28:27,560 --> 00:28:29,040
Identity for digital workers.

660
00:28:29,040 --> 00:28:32,680
The foundation of agent 365 is a simple shift in how we think.

661
00:28:32,680 --> 00:28:37,160
Entra agent ID treats agents as first class identities in your directory, not as hidden service

662
00:28:37,160 --> 00:28:40,200
accounts, not as background processes, as identities.

663
00:28:40,200 --> 00:28:41,720
This distinction matters.

664
00:28:41,720 --> 00:28:44,040
Because identity is how you govern anything at scale.

665
00:28:44,040 --> 00:28:46,160
When you hire a human, they get an identity.

666
00:28:46,160 --> 00:28:50,560
You look them up, you assign roles, you use conditional access to restrict where they work.

667
00:28:50,560 --> 00:28:53,800
The employee is a discreet, auditable entity in the system.

668
00:28:53,800 --> 00:28:56,360
But for decades, automation didn't work this way.

669
00:28:56,360 --> 00:28:59,040
A script ran under a generic service account.

670
00:28:59,040 --> 00:29:00,800
Multiple scripts share the same login.

671
00:29:00,800 --> 00:29:02,400
You couldn't tell which one was doing what.

672
00:29:02,400 --> 00:29:05,000
The automation was invisible, the governance was opaque.

673
00:29:05,000 --> 00:29:06,840
Entra agent ID inverts this model.

674
00:29:06,840 --> 00:29:08,760
Every agent gets its own unique identity.

675
00:29:08,760 --> 00:29:11,400
You can look at that identity and see exactly what it is.

676
00:29:11,400 --> 00:29:13,240
This is the team's governance agent.

677
00:29:13,240 --> 00:29:14,920
It's owned by platform engineering.

678
00:29:14,920 --> 00:29:16,960
It manages sharing policies.

679
00:29:16,960 --> 00:29:18,760
That clarity changes everything.

680
00:29:18,760 --> 00:29:22,200
When you know what the agent is and who owns it, you can actually govern it.

681
00:29:22,200 --> 00:29:24,800
Each agent has clear ownership and accountability.

682
00:29:24,800 --> 00:29:28,040
This is where we move from script thinking to digital worker thinking.

683
00:29:28,040 --> 00:29:29,120
A human has a manager.

684
00:29:29,120 --> 00:29:30,360
They have reporting lines.

685
00:29:30,360 --> 00:29:32,440
If something goes wrong, you know who to talk to.

686
00:29:32,440 --> 00:29:34,160
An agent needs that same structure.

687
00:29:34,160 --> 00:29:37,480
Every agent has an owner responsible for its behavior and its permissions.

688
00:29:37,480 --> 00:29:38,960
It also has a sponsor.

689
00:29:38,960 --> 00:29:40,760
Usually a business leader who requested it.

690
00:29:40,760 --> 00:29:42,520
The sponsor represents the business need.

691
00:29:42,520 --> 00:29:46,680
When you evaluate if an agent should exist, you ask the sponsor if it's still needed.

692
00:29:46,680 --> 00:29:47,680
If they say no.

693
00:29:47,680 --> 00:29:51,240
The agent gets deprovisioned, just like an employee whose role was eliminated.

694
00:29:51,240 --> 00:29:54,880
The structure changes how agents behave when ownership is clear.

695
00:29:54,880 --> 00:29:56,360
Governance becomes sustainable.

696
00:29:56,360 --> 00:29:58,160
An agent isn't just code running in the dark.

697
00:29:58,160 --> 00:30:00,080
It's an entity someone is responsible for.

698
00:30:00,080 --> 00:30:04,040
That responsibility creates the incentive to keep it properly scoped and monitored.

699
00:30:04,040 --> 00:30:06,520
It stops the cycle of orphaned automation.

700
00:30:06,520 --> 00:30:10,240
Scripts that nobody remembers writing that eventually break the system.

701
00:30:10,240 --> 00:30:14,200
Additional access applies to agents exactly like it applies to users.

702
00:30:14,200 --> 00:30:16,560
Policies can restrict actions based on risk signals.

703
00:30:16,560 --> 00:30:21,400
If an agent that usually works at noon starts making API calls at 2am, conditional access blocks

704
00:30:21,400 --> 00:30:23,960
it if it suddenly executes from an unknown location.

705
00:30:23,960 --> 00:30:26,240
The system requires extra verification.

706
00:30:26,240 --> 00:30:27,560
These controls aren't add-ons.

707
00:30:27,560 --> 00:30:29,960
They are native to how the identity operates.

708
00:30:29,960 --> 00:30:33,120
Access reviews include agents the same way they include humans.

709
00:30:33,120 --> 00:30:35,880
Every quarter your team reviews who has what access.

710
00:30:35,880 --> 00:30:37,640
For humans that's job level access.

711
00:30:37,640 --> 00:30:39,680
For agents that's functional access.

712
00:30:39,680 --> 00:30:41,680
This agent still need to modify ownership.

713
00:30:41,680 --> 00:30:43,240
Does it still need to live in this tenant?

714
00:30:43,240 --> 00:30:45,840
These reviews ensure permissions don't drift into over-privilege.

715
00:30:45,840 --> 00:30:49,040
An agent might accumulate extra permissions over time if nobody is watching.

716
00:30:49,040 --> 00:30:50,280
Access reviews catch that.

717
00:30:50,280 --> 00:30:51,880
The structural shift is profound.

718
00:30:51,880 --> 00:30:53,440
You aren't managing scripts anymore.

719
00:30:53,440 --> 00:30:54,720
You're managing a workforce.

720
00:30:54,720 --> 00:30:56,960
That workforce operates continuously at machine speed.

721
00:30:56,960 --> 00:30:58,160
It has full visibility.

722
00:30:58,160 --> 00:30:59,480
It has clear accountability.

723
00:30:59,480 --> 00:31:02,480
This is what autonomous IT actually means.

724
00:31:02,480 --> 00:31:03,840
The governance first model.

725
00:31:03,840 --> 00:31:07,480
With agent IDs in place, governance becomes the primary design constraint.

726
00:31:07,480 --> 00:31:08,800
It's no longer an afterthought.

727
00:31:08,800 --> 00:31:10,000
This is the fundamental shift.

728
00:31:10,000 --> 00:31:11,960
In the old model, you built the system first.

729
00:31:11,960 --> 00:31:13,200
You automated the workflows.

730
00:31:13,200 --> 00:31:14,760
You made the agents do their jobs.

731
00:31:14,760 --> 00:31:16,400
And then you thought about governance.

732
00:31:16,400 --> 00:31:18,680
You'd add some logs or restrictive permissions.

733
00:31:18,680 --> 00:31:21,720
But governance was just layered on top of a system that wasn't built for it.

734
00:31:21,720 --> 00:31:25,240
It's like building a house and then trying to make it earthquake-proof later.

735
00:31:25,240 --> 00:31:26,840
You can reinforce the walls.

736
00:31:26,840 --> 00:31:28,640
But the architecture isn't optimized for it.

737
00:31:28,640 --> 00:31:30,320
The governance first model reverses this.

738
00:31:30,320 --> 00:31:31,880
You start by defining policy.

739
00:31:31,880 --> 00:31:32,880
What is allowed?

740
00:31:32,880 --> 00:31:33,880
What requires a human?

741
00:31:33,880 --> 00:31:35,200
What data can the agent touch?

742
00:31:35,200 --> 00:31:36,760
You define these boundaries upfront.

743
00:31:36,760 --> 00:31:38,720
Then you build the system inside them.

744
00:31:38,720 --> 00:31:42,360
The system stays within the lines because policy is baked into the architecture.

745
00:31:42,360 --> 00:31:43,680
It isn't bolted on.

746
00:31:43,680 --> 00:31:47,360
Policy driven architecture means you define a rule once and enforce it everywhere.

747
00:31:47,360 --> 00:31:48,920
This is the elegance of the model.

748
00:31:48,920 --> 00:31:51,000
Your organization has a sharing policy for teams.

749
00:31:51,000 --> 00:31:52,480
You define it once in Entra.

750
00:31:52,480 --> 00:31:54,080
You define it once in Perview.

751
00:31:54,080 --> 00:31:55,840
Now that policy applies everywhere.

752
00:31:55,840 --> 00:31:59,000
When a user tries to share a team, SharePoint enforces the rule.

753
00:31:59,000 --> 00:32:02,640
When an agent creates a team, the agent enforces the rule.

754
00:32:02,640 --> 00:32:04,040
There is one source of truth.

755
00:32:04,040 --> 00:32:07,080
Everyone, human and agent, operates under the same constraint.

756
00:32:07,080 --> 00:32:10,120
We consider this to manual governance where the policy lives in a word document.

757
00:32:10,120 --> 00:32:11,360
The admin understands it one way.

758
00:32:11,360 --> 00:32:13,400
The developer understands it another way.

759
00:32:13,400 --> 00:32:14,400
One of them is wrong.

760
00:32:14,400 --> 00:32:15,560
And nobody knows which.

761
00:32:15,560 --> 00:32:17,560
Policy driven architecture removes that confusion.

762
00:32:17,560 --> 00:32:19,000
The policy is executable.

763
00:32:19,000 --> 00:32:20,000
It's in the code.

764
00:32:20,000 --> 00:32:21,320
It's version controlled.

765
00:32:21,320 --> 00:32:24,320
When the policy changes, it changes everywhere at once.

766
00:32:24,320 --> 00:32:26,680
Agents are constrained by this policy at runtime.

767
00:32:26,680 --> 00:32:28,000
This is the safety mechanism.

768
00:32:28,000 --> 00:32:29,800
An agent's job is to enforce the rules.

769
00:32:29,800 --> 00:32:32,280
It reads the policy and scans for violations.

770
00:32:32,280 --> 00:32:33,880
But here's the problem people worry about.

771
00:32:33,880 --> 00:32:35,200
What if the agent goes rogue?

772
00:32:35,200 --> 00:32:37,280
The agent cannot exceed its scoped permissions.

773
00:32:37,280 --> 00:32:41,600
No matter what task it's given, even if a malicious actor tries to reconfigure the agent,

774
00:32:41,600 --> 00:32:42,600
the system stops it.

775
00:32:42,600 --> 00:32:45,360
The constraints are hard boundaries enforced by the platform.

776
00:32:45,360 --> 00:32:47,120
An agent cannot grant itself access.

777
00:32:47,120 --> 00:32:48,640
It cannot bypass DLP rules.

778
00:32:48,640 --> 00:32:51,640
The system won't allow it because policy is the primary constraint.

779
00:32:51,640 --> 00:32:53,880
Data governance extends to agent actions too.

780
00:32:53,880 --> 00:32:55,640
Sensitivity labels don't just apply to humans.

781
00:32:55,640 --> 00:32:56,640
They apply to agents.

782
00:32:56,640 --> 00:32:58,840
DLP doesn't just watch for risky human behavior.

783
00:32:58,840 --> 00:33:00,080
It watches the agents.

784
00:33:00,080 --> 00:33:03,480
If an agent is misconfigured to process customer data, it shouldn't see.

785
00:33:03,480 --> 00:33:04,480
DLP catches it.

786
00:33:04,480 --> 00:33:06,480
The agent is treated like a user of data.

787
00:33:06,480 --> 00:33:07,880
The rules apply equally.

788
00:33:07,880 --> 00:33:09,280
Order trails are non-negotiable.

789
00:33:09,280 --> 00:33:11,280
Every action is logged with complete context.

790
00:33:11,280 --> 00:33:13,240
Not just what changed, but why it changed.

791
00:33:13,240 --> 00:33:14,800
Which policy triggered the move?

792
00:33:14,800 --> 00:33:16,400
Who authorised that policy?

793
00:33:16,400 --> 00:33:19,800
If there's ever a question about an action, the answer is documented.

794
00:33:19,800 --> 00:33:21,960
This level of detail isn't just for admins.

795
00:33:21,960 --> 00:33:23,920
It's for auditors and compliance teams.

796
00:33:23,920 --> 00:33:26,080
It's the evidence that the system is following the rules.

797
00:33:26,080 --> 00:33:28,800
The result is governance that scales because it's automated.

798
00:33:28,800 --> 00:33:32,000
You don't hire 500 people to watch 500,000 users.

799
00:33:32,000 --> 00:33:33,240
You define the policy once.

800
00:33:33,240 --> 00:33:34,280
You implement it in code.

801
00:33:34,280 --> 00:33:38,160
In order to do it continuously, the system scales because policy is executable.

802
00:33:38,160 --> 00:33:39,800
Governance becomes an engineering problem.

803
00:33:39,800 --> 00:33:40,800
Not a headcount problem.

804
00:33:40,800 --> 00:33:42,240
That's the structural transformation.

805
00:33:42,240 --> 00:33:45,240
That's why autonomous IT actually works at enterprise scale.

806
00:33:45,240 --> 00:33:47,240
Self-healing tenants, the operating model.

807
00:33:47,240 --> 00:33:50,800
Now we need to look at what autonomous IT actually looks like when you put it to work.

808
00:33:50,800 --> 00:33:53,080
This isn't a theory or a roadmap anymore.

809
00:33:53,080 --> 00:33:56,680
It's how your tenant operates when every layer finally starts talking to the others.

810
00:33:56,680 --> 00:33:58,400
It starts with desired state modelling.

811
00:33:58,400 --> 00:34:01,640
You sit down and you define what correct looks like for your organization.

812
00:34:01,640 --> 00:34:03,040
But you don't write it in a document.

813
00:34:03,040 --> 00:34:04,720
You write it as operational code.

814
00:34:04,720 --> 00:34:09,840
For teams that means every single team has at least two internal owners and a sensitivity label

815
00:34:09,840 --> 00:34:11,920
if it was created after a specific date.

816
00:34:11,920 --> 00:34:15,960
For SharePoint it means every document library has a retention policy and every piece of

817
00:34:15,960 --> 00:34:17,680
sensitive content is classified.

818
00:34:17,680 --> 00:34:21,800
For mailboxes it means archiving is turned on and litigation holds stay in place when

819
00:34:21,800 --> 00:34:22,800
they need to.

820
00:34:22,800 --> 00:34:25,520
These aren't just suggestions or best practices.

821
00:34:25,520 --> 00:34:28,600
They are the executable definition of a healthy environment.

822
00:34:28,600 --> 00:34:31,720
The system then scans your environment against that definition.

823
00:34:31,720 --> 00:34:33,160
And it doesn't wait for a schedule.

824
00:34:33,160 --> 00:34:34,480
It happens continuously.

825
00:34:34,480 --> 00:34:37,640
Right now, while you're watching this, your tenant is being scanned.

826
00:34:37,640 --> 00:34:39,200
A team was created an hour ago.

827
00:34:39,200 --> 00:34:40,200
Does it have two owners?

828
00:34:40,200 --> 00:34:41,200
Yes.

829
00:34:41,200 --> 00:34:42,200
Does it have a label?

830
00:34:42,200 --> 00:34:43,200
No, that's a deviation.

831
00:34:43,200 --> 00:34:46,480
A SharePoint site had its retention policy manually removed by a user.

832
00:34:46,480 --> 00:34:47,480
That's another deviation.

833
00:34:47,480 --> 00:34:51,000
A user just changed departments and their permissions shifted.

834
00:34:51,000 --> 00:34:53,080
Does that new access level match their new role?

835
00:34:53,080 --> 00:34:54,080
It's unclear.

836
00:34:54,080 --> 00:34:55,080
So the system flags it.

837
00:34:55,080 --> 00:34:57,120
These gaps aren't found during a monthly audit.

838
00:34:57,120 --> 00:35:00,800
They're caught in real time because the system checks your state thousands of times every

839
00:35:00,800 --> 00:35:01,640
minute.

840
00:35:01,640 --> 00:35:03,080
And if you're not doing a problem, it means nothing.

841
00:35:03,080 --> 00:35:06,400
If you don't do anything about it, that's where the decision-making layer comes in.

842
00:35:06,400 --> 00:35:08,880
The system sees the deviation and evaluates it.

843
00:35:08,880 --> 00:35:12,400
That team without a label, it's a low priority because it was created recently and meets

844
00:35:12,400 --> 00:35:14,200
the rules for automatic labeling.

845
00:35:14,200 --> 00:35:15,640
No human needs to look at that.

846
00:35:15,640 --> 00:35:17,320
The system just proceeds to the fix.

847
00:35:17,320 --> 00:35:21,520
But that SharePoint site with the missing retention policy, that's a high priority because

848
00:35:21,520 --> 00:35:23,360
it might violate compliance rules.

849
00:35:23,360 --> 00:35:26,960
The system checks the site classification, sees it holds general documents and decides

850
00:35:26,960 --> 00:35:27,960
to remediate.

851
00:35:27,960 --> 00:35:31,400
The user who changed departments, the system sees they moved from engineering to

852
00:35:31,400 --> 00:35:35,080
sales and realizes their new access should follow the sales baseline.

853
00:35:35,080 --> 00:35:36,800
It's expected drift, not a violation.

854
00:35:36,800 --> 00:35:38,200
So it just updates their baseline.

855
00:35:38,200 --> 00:35:41,400
This is where the model breaks away from manual governance.

856
00:35:41,400 --> 00:35:44,680
The system doesn't just send you an alert and wait for you to fix it.

857
00:35:44,680 --> 00:35:47,840
It decides what to do automatically in almost every case.

858
00:35:47,840 --> 00:35:51,720
And it only escalates to a human when your judgment actually adds value.

859
00:35:51,720 --> 00:35:54,160
If a violation is straightforward, the system fixes it.

860
00:35:54,160 --> 00:35:57,520
If a change needs business context, the system evaluates it.

861
00:35:57,520 --> 00:36:00,280
If something is totally outside the lines, it asks for help.

862
00:36:00,280 --> 00:36:01,680
The decision making never stops.

863
00:36:01,680 --> 00:36:04,040
The fix follows immediately and automatically.

864
00:36:04,040 --> 00:36:07,920
The team gets its label, the SharePoint site gets its retention policy back.

865
00:36:07,920 --> 00:36:10,520
The user's permissions are updated to match their new role.

866
00:36:10,520 --> 00:36:12,960
All of this happens without a single ticket being opened.

867
00:36:12,960 --> 00:36:16,720
Without a help desk queue and without an admin scheduling time to click buttons, it happens

868
00:36:16,720 --> 00:36:17,720
in seconds.

869
00:36:17,720 --> 00:36:20,760
The system detects the drift, the policy dictates the fix.

870
00:36:20,760 --> 00:36:24,760
And the system executes it, done, and everything is logged when that label was applied, the

871
00:36:24,760 --> 00:36:28,840
system recorded exactly why it happened, and which agent performed the action at what

872
00:36:28,840 --> 00:36:30,160
time.

873
00:36:30,160 --> 00:36:31,840
And the retention policy was fixed.

874
00:36:31,840 --> 00:36:35,000
The audit trail showed that the site classification triggered the rule.

875
00:36:35,000 --> 00:36:37,720
This trail isn't for your admins, it's for evidence.

876
00:36:37,720 --> 00:36:42,400
When a regulator asks how you know your content is protected, you don't show them a spreadsheet.

877
00:36:42,400 --> 00:36:46,000
You show them the log, you show them that the system detected the content on one date,

878
00:36:46,000 --> 00:36:49,160
checked it against the policy, and applied the fix on another date.

879
00:36:49,160 --> 00:36:50,920
It's proof that your governance is continuous.

880
00:36:50,920 --> 00:36:53,640
The result is a tenant that actually maintains itself.

881
00:36:53,640 --> 00:36:57,280
Content gets classified, permissions stay aligned, and ownership stays current.

882
00:36:57,280 --> 00:37:01,080
Your infrastructure is constantly patrolling itself and fixing what breaks.

883
00:37:01,080 --> 00:37:03,440
You define the policy and the system enforces it.

884
00:37:03,440 --> 00:37:06,640
You get governance at scale because the system works at machine speed, and that's what

885
00:37:06,640 --> 00:37:08,080
self-healing actually means.

886
00:37:08,080 --> 00:37:09,600
The cost to value shift.

887
00:37:09,600 --> 00:37:13,240
There is an economic story here that explains why this shift is going to happen.

888
00:37:13,240 --> 00:37:14,480
And it's actually very simple.

889
00:37:14,480 --> 00:37:16,680
It comes down to how your costs scale.

890
00:37:16,680 --> 00:37:19,960
In the old model of manual governance, your costs scale with your head count.

891
00:37:19,960 --> 00:37:22,760
You need more admins because your environment is getting bigger.

892
00:37:22,760 --> 00:37:25,880
You need more compliance officers because the rules are getting more complex.

893
00:37:25,880 --> 00:37:28,880
You need more security analysts because the threats are getting smarter.

894
00:37:28,880 --> 00:37:31,520
Every time things get more complicated, you have to hire someone.

895
00:37:31,520 --> 00:37:34,720
But if you have 500 teams, maybe you need three people to watch them.

896
00:37:34,720 --> 00:37:37,520
But if you have 5,000 teams, you might need 30 people.

897
00:37:37,520 --> 00:37:38,960
The math is relentless.

898
00:37:38,960 --> 00:37:41,520
As your environment grows, your team grows with it.

899
00:37:41,520 --> 00:37:45,560
And those people come with salaries, benefits, and training costs that never go away.

900
00:37:45,560 --> 00:37:48,680
But with automated governance, your costs scale with your policy.

901
00:37:48,680 --> 00:37:49,680
Not your people.

902
00:37:49,680 --> 00:37:51,200
You define a team's policy once.

903
00:37:51,200 --> 00:37:55,080
That same policy works for five teams, five thousand teams, or 50,000 teams.

904
00:37:55,080 --> 00:37:57,880
You don't have to hire more people or write more code to make it scale.

905
00:37:57,880 --> 00:38:01,720
The cost doesn't grow because the policy is a single definition that works everywhere.

906
00:38:01,720 --> 00:38:05,840
When the regulations change, you update that one policy and it applies to the whole environment

907
00:38:05,840 --> 00:38:06,840
instantly.

908
00:38:06,840 --> 00:38:09,880
When new requirements come in, you just add them to the engine.

909
00:38:09,880 --> 00:38:11,480
The cost structure is totally different.

910
00:38:11,480 --> 00:38:13,440
You pay for the platform and the engine.

911
00:38:13,440 --> 00:38:16,560
But the cost of adding complexity doesn't multiply as you grow.

912
00:38:16,560 --> 00:38:17,560
Look at the actual numbers.

913
00:38:17,560 --> 00:38:22,840
Building a custom governance agent from scratch might cost you $150,000 just for the development.

914
00:38:22,840 --> 00:38:27,080
Then you have to maintain it, which costs about $5,000 every month for updates and security

915
00:38:27,080 --> 00:38:28,080
patches.

916
00:38:28,080 --> 00:38:31,440
Over two years, that one agent has cost you $270,000.

917
00:38:31,440 --> 00:38:32,600
And that's just one agent.

918
00:38:32,600 --> 00:38:35,600
Your company probably has dozens of governance problems that need solving.

919
00:38:35,600 --> 00:38:38,280
At those prices, you're looking at millions of dollars in development.

920
00:38:38,280 --> 00:38:42,080
Now compare that to agent 365, which is $15 per user every month.

921
00:38:42,080 --> 00:38:45,640
For a 10,000 person company, that's $150,000 a year.

922
00:38:45,640 --> 00:38:49,680
For that price, you get the infrastructure for unlimited agents and full integration

923
00:38:49,680 --> 00:38:51,400
with your existing security tools.

924
00:38:51,400 --> 00:38:54,880
The gap between what you pay and the value you get shrinks by half when you move to these

925
00:38:54,880 --> 00:38:56,320
policy-driven systems.

926
00:38:56,320 --> 00:38:57,840
Custom automation is fragile.

927
00:38:57,840 --> 00:39:00,320
And when the platform updates, your custom code usually breaks.

928
00:39:00,320 --> 00:39:03,320
You end up paying for constant babysitting just to keep things running.

929
00:39:03,320 --> 00:39:05,360
But policy-driven systems are structural.

930
00:39:05,360 --> 00:39:08,440
Your policies stay in place even when the platform updates.

931
00:39:08,440 --> 00:39:10,080
So the value compounds over time.

932
00:39:10,080 --> 00:39:14,200
As you add more rules and automate more scenarios, the platform becomes more valuable.

933
00:39:14,200 --> 00:39:16,240
You aren't buying a new tool every time.

934
00:39:16,240 --> 00:39:18,880
You're just using the infrastructure you already have.

935
00:39:18,880 --> 00:39:21,600
This is where the ROI finally becomes something you can measure.

936
00:39:21,600 --> 00:39:23,840
In the manual world, ROI is a guess.

937
00:39:23,840 --> 00:39:25,080
You hired more people.

938
00:39:25,080 --> 00:39:26,760
But did you actually get better results?

939
00:39:26,760 --> 00:39:27,840
It's hard to say.

940
00:39:27,840 --> 00:39:30,240
In autonomous governance, the numbers are clear.

941
00:39:30,240 --> 00:39:34,040
Your incident response time drops from four hours down to 15 minutes.

942
00:39:34,040 --> 00:39:36,160
Your policy violations go down by 80%.

943
00:39:36,160 --> 00:39:39,920
Your audits take two weeks instead of three months because the evidence is already collected.

944
00:39:39,920 --> 00:39:41,120
Those are direct savings.

945
00:39:41,120 --> 00:39:45,960
A security incident that would have cost $100,000 to fix is now stopped in seconds.

946
00:39:45,960 --> 00:39:49,080
That is risk reduction with a real dollar value attached to it.

947
00:39:49,080 --> 00:39:51,520
This economics is why this transition is inevitable.

948
00:39:51,520 --> 00:39:54,560
You're going to see your competitors move to autonomous systems.

949
00:39:54,560 --> 00:39:56,760
And they'll have faster response times and lower costs.

950
00:39:56,760 --> 00:39:59,160
The business case is going to become impossible to ignore.

951
00:39:59,160 --> 00:40:03,680
You can't stay competitive using manual IT when everyone else is running at machine speed.

952
00:40:03,680 --> 00:40:05,280
The equation has tipped.

953
00:40:05,280 --> 00:40:08,880
And this investment is becoming a requirement for staying in the game.

954
00:40:08,880 --> 00:40:10,720
Copilot as the automation builder.

955
00:40:10,720 --> 00:40:13,360
Copilot isn't just a tool for writing emails.

956
00:40:13,360 --> 00:40:16,120
It's becoming the interface for building autonomous systems.

957
00:40:16,120 --> 00:40:18,680
And this shift changes who actually gets to build them.

958
00:40:18,680 --> 00:40:20,920
For decades, automation was a specialist skill.

959
00:40:20,920 --> 00:40:22,200
You had to know PowerShell.

960
00:40:22,200 --> 00:40:24,480
You had to understand graph API documentation.

961
00:40:24,480 --> 00:40:27,320
You needed to grasp rest semantics and OAuth flows.

962
00:40:27,320 --> 00:40:29,560
Basically, you had to think like a programmer.

963
00:40:29,560 --> 00:40:33,880
That barrier meant that only IT specialists and developers created automation.

964
00:40:33,880 --> 00:40:35,640
Business analysts couldn't do it.

965
00:40:35,640 --> 00:40:36,880
Operations leaders couldn't do it.

966
00:40:36,880 --> 00:40:41,040
The people who actually lived the operational pain every day couldn't express that pain

967
00:40:41,040 --> 00:40:42,040
in code.

968
00:40:42,040 --> 00:40:45,640
They could describe the problem to a developer who then translated it into a script.

969
00:40:45,640 --> 00:40:46,840
This created friction.

970
00:40:46,840 --> 00:40:47,920
It caused delays.

971
00:40:47,920 --> 00:40:49,360
It lost nuance.

972
00:40:49,360 --> 00:40:51,400
The specialist became a bottleneck.

973
00:40:51,400 --> 00:40:53,080
Natural language scripting inverts this.

974
00:40:53,080 --> 00:40:55,280
You describe what you want to automate in plain English.

975
00:40:55,280 --> 00:40:59,680
You tell the system you want to find all teams, without owners, identify who created them

976
00:40:59,680 --> 00:41:02,360
and ask them to assign an owner within two weeks.

977
00:41:02,360 --> 00:41:05,600
You add a condition that if they don't, a manager gets assigned instead.

978
00:41:05,600 --> 00:41:06,600
That's it.

979
00:41:06,600 --> 00:41:09,560
In the old model, translating those requirements into PowerShell or GraphCores would take

980
00:41:09,560 --> 00:41:13,040
a developer an hour of writing, testing, and debugging.

981
00:41:13,040 --> 00:41:16,280
Now, Copilot reads your description and generates the GraphCalls itself.

982
00:41:16,280 --> 00:41:17,920
It builds the workflow structure.

983
00:41:17,920 --> 00:41:19,920
It creates the notification templates.

984
00:41:19,920 --> 00:41:20,920
It sets the schedule.

985
00:41:20,920 --> 00:41:22,080
You describe the intent.

986
00:41:22,080 --> 00:41:23,800
And Copilot handles the implementation.

987
00:41:23,800 --> 00:41:25,280
Workflow generation goes even further.

988
00:41:25,280 --> 00:41:29,680
Copilot Studio agents can now be built by business analysts instead of professional developers.

989
00:41:29,680 --> 00:41:32,960
An analyst who understands teams' governance can sit down and describe the agent they

990
00:41:32,960 --> 00:41:33,960
want to build.

991
00:41:33,960 --> 00:41:35,600
Copilot generates the structure.

992
00:41:35,600 --> 00:41:37,040
It generates the decision logic.

993
00:41:37,040 --> 00:41:38,880
It generates the remediation workflows.

994
00:41:38,880 --> 00:41:40,840
The analyst just refines it and deploys it.

995
00:41:40,840 --> 00:41:42,920
The specialist barrier dissolves.

996
00:41:42,920 --> 00:41:46,520
Automation becomes accessible to the people who actually understand the business need.

997
00:41:46,520 --> 00:41:50,240
This democratization is revolutionary because it expands what gets automated.

998
00:41:50,240 --> 00:41:53,960
Previously, only the biggest problems got developer attention.

999
00:41:53,960 --> 00:41:57,960
Specialists have limited time, so they focus on the initiatives that save the most money.

1000
00:41:57,960 --> 00:42:00,800
But there are hundreds of smaller problems that should be automated.

1001
00:42:00,800 --> 00:42:03,160
You have teams without proper sharing policies.

1002
00:42:03,160 --> 00:42:05,080
You have retention settings that drift.

1003
00:42:05,080 --> 00:42:07,800
You have compliance violations in specific departments.

1004
00:42:07,800 --> 00:42:11,400
None of these are urgent enough to win developer time, so they go unaddressed.

1005
00:42:11,400 --> 00:42:16,640
Now, an operations leader can simply tell the system to build an agent that fixes the sharing

1006
00:42:16,640 --> 00:42:17,640
problem.

1007
00:42:17,640 --> 00:42:19,440
They aren't waiting for developer bandwidth.

1008
00:42:19,440 --> 00:42:21,000
They're building what they need.

1009
00:42:21,000 --> 00:42:23,600
Self-healing automation takes this a step further.

1010
00:42:23,600 --> 00:42:26,520
Copilot analyzes detected issues and suggests how to fix them.

1011
00:42:26,520 --> 00:42:30,680
When the system finds a compliance violation, Copilot suggests the full workflow.

1012
00:42:30,680 --> 00:42:33,560
It decides who to notify and what approval is needed.

1013
00:42:33,560 --> 00:42:34,880
You review the suggestion.

1014
00:42:34,880 --> 00:42:39,840
If it needs a tweak, you use natural language to tell it not to notify the user immediately.

1015
00:42:39,840 --> 00:42:43,400
You tell it to run the fix silently and send a notification the next day.

1016
00:42:43,400 --> 00:42:45,200
Copilot updates the workflow instantly.

1017
00:42:45,200 --> 00:42:49,880
What used to take a developer hours to code now takes a business person minutes to refine.

1018
00:42:49,880 --> 00:42:51,800
Continuous improvement happens automatically.

1019
00:42:51,800 --> 00:42:56,040
Copilot analyzes how these workflows perform to see which ones succeed and which ones fail.

1020
00:42:56,040 --> 00:42:57,040
It looks for patterns.

1021
00:42:57,040 --> 00:43:01,360
It might suggest an optimization because a workflow is failing 5% of the time due to an edge

1022
00:43:01,360 --> 00:43:02,360
case.

1023
00:43:02,360 --> 00:43:04,800
It's a specific condition to raise the success rate.

1024
00:43:04,800 --> 00:43:06,320
The system learns from execution.

1025
00:43:06,320 --> 00:43:07,320
It improves itself.

1026
00:43:07,320 --> 00:43:08,680
Humans provide the feedback.

1027
00:43:08,680 --> 00:43:10,280
And the automation gets better over time.

1028
00:43:10,280 --> 00:43:12,280
The shift is profound.

1029
00:43:12,280 --> 00:43:15,600
Automation is moving from a specialist skill to a business capability.

1030
00:43:15,600 --> 00:43:18,120
It's no longer something you do only if you have developer time.

1031
00:43:18,120 --> 00:43:21,200
You do it because the interface is accessible and the cost is low.

1032
00:43:21,200 --> 00:43:23,920
Copilot handles the translation from intent to implementation.

1033
00:43:23,920 --> 00:43:26,680
This is what makes autonomous IT achievable at scale.

1034
00:43:26,680 --> 00:43:28,080
You aren't waiting for specialists.

1035
00:43:28,080 --> 00:43:31,640
You're empowering the people who understand the business to automate directly.

1036
00:43:31,640 --> 00:43:33,080
It's the rise of digital workers.

1037
00:43:33,080 --> 00:43:34,960
Here's the most significant shift.

1038
00:43:34,960 --> 00:43:37,040
We're moving from tools that help humans work.

1039
00:43:37,040 --> 00:43:41,120
To work as that operate autonomously, the distinction is subtle until you see it in practice.

1040
00:43:41,120 --> 00:43:43,320
A tool amplifies what a human can do.

1041
00:43:43,320 --> 00:43:44,400
You use it when you need it.

1042
00:43:44,400 --> 00:43:45,640
You decide what it does.

1043
00:43:45,640 --> 00:43:46,640
You're in control.

1044
00:43:46,640 --> 00:43:47,440
A worker has agency.

1045
00:43:47,440 --> 00:43:48,840
It initiates tasks.

1046
00:43:48,840 --> 00:43:49,840
It makes decisions.

1047
00:43:49,840 --> 00:43:51,520
It coordinates with other workers.

1048
00:43:51,520 --> 00:43:52,880
It operates while you're sleeping.

1049
00:43:52,880 --> 00:43:56,840
It solves problems you didn't explicitly ask it to solve because it's designed to achieve

1050
00:43:56,840 --> 00:43:57,840
an outcome.

1051
00:43:57,840 --> 00:44:01,880
Not just execute a command for 30 years IT automation has been tool based.

1052
00:44:01,880 --> 00:44:03,160
You write a script and you run it.

1053
00:44:03,160 --> 00:44:04,160
It does one thing.

1054
00:44:04,160 --> 00:44:06,200
If you want five things done, you write five scripts.

1055
00:44:06,200 --> 00:44:07,440
The human is the orchestrator.

1056
00:44:07,440 --> 00:44:09,080
You decide what happens and when.

1057
00:44:09,080 --> 00:44:10,720
Autonomous agents invert this.

1058
00:44:10,720 --> 00:44:14,280
You assign an agent an outcome like keeping teams governance compliant.

1059
00:44:14,280 --> 00:44:15,760
Now the agent doesn't wait for you.

1060
00:44:15,760 --> 00:44:17,920
It continuously monitors the environment.

1061
00:44:17,920 --> 00:44:19,520
It detects deviations.

1062
00:44:19,520 --> 00:44:21,320
It evaluates what needs to happen.

1063
00:44:21,320 --> 00:44:22,720
It remediates and reports.

1064
00:44:22,720 --> 00:44:25,080
It does all of this without a human triggering every step.

1065
00:44:25,080 --> 00:44:26,760
You define the outcome once.

1066
00:44:26,760 --> 00:44:28,640
The agent pursues it relentlessly.

1067
00:44:28,640 --> 00:44:34,040
Agent-driven workflows handle multi-step tasks from start to finish with no human handoff.

1068
00:44:34,040 --> 00:44:36,800
Think about a typical governance process today.

1069
00:44:36,800 --> 00:44:38,960
A compliance check finds orphaned teams.

1070
00:44:38,960 --> 00:44:40,280
A ticket gets created.

1071
00:44:40,280 --> 00:44:41,840
Someone reads that ticket and investigates.

1072
00:44:41,840 --> 00:44:43,920
They identify the creator and draft a message.

1073
00:44:43,920 --> 00:44:44,920
They wait for a response.

1074
00:44:44,920 --> 00:44:47,640
If they don't get one, they escalate and reassign ownership.

1075
00:44:47,640 --> 00:44:51,120
That's six to eight separate human actions spread across multiple people over several

1076
00:44:51,120 --> 00:44:52,120
days.

1077
00:44:52,120 --> 00:44:54,480
An autonomous agent does this end-to-end in seconds.

1078
00:44:54,480 --> 00:44:58,880
It detects the team, identifies the creator, sends the notification and escalates if needed.

1079
00:44:58,880 --> 00:45:00,920
The human never touches the process.

1080
00:45:00,920 --> 00:45:02,360
Because the agent owns the capability.

1081
00:45:02,360 --> 00:45:05,760
And what's really profound is that agents coordinate with other agents.

1082
00:45:05,760 --> 00:45:07,440
This isn't one agent doing one job.

1083
00:45:07,440 --> 00:45:11,160
This is a system of agents handling complex problems across different domains.

1084
00:45:11,160 --> 00:45:14,680
A security agent might detect unusual activity on a high privilege account.

1085
00:45:14,680 --> 00:45:15,920
It doesn't just send an alert.

1086
00:45:15,920 --> 00:45:19,080
It coordinates with the identity agent to check permission changes.

1087
00:45:19,080 --> 00:45:21,400
It talks to the access agent to see what was accessed.

1088
00:45:21,400 --> 00:45:24,120
It works with the ordered agent to collect evidence.

1089
00:45:24,120 --> 00:45:27,600
All specialized agents work together to solve a problem holistically.

1090
00:45:27,600 --> 00:45:29,960
Orchestration becomes a system-level capability.

1091
00:45:29,960 --> 00:45:33,640
It emerges from how agents are designed to coordinate, not from manual process design.

1092
00:45:33,640 --> 00:45:35,480
The human role fundamentally changes.

1093
00:45:35,480 --> 00:45:37,000
Humans move to exception handling.

1094
00:45:37,000 --> 00:45:40,440
You intervene when a policy decision requires judgment the system can't make.

1095
00:45:40,440 --> 00:45:43,760
You intervene when an agent encounters a situation it wasn't designed for.

1096
00:45:43,760 --> 00:45:47,040
You intervene when the risk is high enough that a human needs to be consulted.

1097
00:45:47,040 --> 00:45:50,440
This is different from the operational role admins hold today.

1098
00:45:50,440 --> 00:45:51,800
Today's admin is an executor.

1099
00:45:51,800 --> 00:45:53,080
They execute tasks.

1100
00:45:53,080 --> 00:45:54,520
Tomorrow's admin is a supervisor.

1101
00:45:54,520 --> 00:45:56,480
They set policy and monitor results.

1102
00:45:56,480 --> 00:45:58,000
The cognitive load is different.

1103
00:45:58,000 --> 00:46:00,760
You aren't remembering commands or troubleshooting syntax.

1104
00:46:00,760 --> 00:46:02,360
You're evaluating business risk.

1105
00:46:02,360 --> 00:46:04,120
You're mentoring the process.

1106
00:46:04,120 --> 00:46:07,160
Organizational structure changes because agents handle the routine work.

1107
00:46:07,160 --> 00:46:11,680
Right now, a 50 person IT team might have 35 people doing routine administration.

1108
00:46:11,680 --> 00:46:14,840
In an autonomous IT model, that shifts dramatically.

1109
00:46:14,840 --> 00:46:16,800
Maybe only eight people handle routine tasks.

1110
00:46:16,800 --> 00:46:18,880
15 people focus on policy and oversight.

1111
00:46:18,880 --> 00:46:21,400
The rest move to strategy and new capabilities.

1112
00:46:21,400 --> 00:46:23,400
The total headcount might stay the same.

1113
00:46:23,400 --> 00:46:24,560
But the composition changes.

1114
00:46:24,560 --> 00:46:28,400
You need fewer people executing tasks and more people thinking at the policy level.

1115
00:46:28,400 --> 00:46:31,640
The implication is that staffing models become team composition models.

1116
00:46:31,640 --> 00:46:33,880
You aren't hiring three new admins to handle growth.

1117
00:46:33,880 --> 00:46:37,560
You're deploying three new agents with three humans overseeing them.

1118
00:46:37,560 --> 00:46:39,720
You aren't budgeting for 20 operational roles.

1119
00:46:39,720 --> 00:46:43,360
You're budgeting for 12 roles plus the infrastructure for agents.

1120
00:46:43,360 --> 00:46:45,880
Organizational design shifts from how many humans you need.

1121
00:46:45,880 --> 00:46:49,360
To how you optimally compose teams of humans and agents.

1122
00:46:49,360 --> 00:46:54,640
This is the structural transformation that makes autonomous IT economically inevitable.

1123
00:46:54,640 --> 00:46:56,920
Security implications of autonomous IT.

1124
00:46:56,920 --> 00:47:01,080
Autonomy introduces new risks and understanding them is the only way to deploy safely.

1125
00:47:01,080 --> 00:47:05,480
When you automate governance at scale, when agents make decisions and take actions every

1126
00:47:05,480 --> 00:47:06,480
second.

1127
00:47:06,480 --> 00:47:10,200
When policy is enforced by algorithms instead of people, you've built something new and

1128
00:47:10,200 --> 00:47:11,880
new systems have new vulnerabilities.

1129
00:47:11,880 --> 00:47:14,240
This isn't a question of whether autonomous IT is secure.

1130
00:47:14,240 --> 00:47:15,720
It is if you design it correctly.

1131
00:47:15,720 --> 00:47:19,680
If we have to recognize the threat models that didn't exist in the manual world, in this new

1132
00:47:19,680 --> 00:47:22,200
model agents become high value targets.

1133
00:47:22,200 --> 00:47:23,200
They have broad permissions.

1134
00:47:23,200 --> 00:47:26,240
They operate continuously that makes them incredibly attractive to attackers.

1135
00:47:26,240 --> 00:47:29,720
A human admin might have high level rights, but they work business hours.

1136
00:47:29,720 --> 00:47:32,400
They aren't accessing the system every second of every day.

1137
00:47:32,400 --> 00:47:33,400
An agent is different.

1138
00:47:33,400 --> 00:47:35,720
An agent has permission to read and modify teams.

1139
00:47:35,720 --> 00:47:37,200
It can change permissions.

1140
00:47:37,200 --> 00:47:38,800
It can enforce retention policies.

1141
00:47:38,800 --> 00:47:39,880
It operates at 3am.

1142
00:47:39,880 --> 00:47:41,040
It operates on Christmas.

1143
00:47:41,040 --> 00:47:44,480
It operates every minute of every day without getting tired or suspicious.

1144
00:47:44,480 --> 00:47:48,840
If you're an attacker looking for the best credential to steal, an agent with constant access to governance

1145
00:47:48,840 --> 00:47:51,360
is more valuable than almost any human account.

1146
00:47:51,360 --> 00:47:52,680
The agent is the skeleton key.

1147
00:47:52,680 --> 00:47:54,760
If you get it, you get systemic access.

1148
00:47:54,760 --> 00:47:56,720
This changes the entire attack calculus.

1149
00:47:56,720 --> 00:47:58,720
Attackers aren't hunting for a human admin anymore.

1150
00:47:58,720 --> 00:48:00,000
They're hunting for an agent.

1151
00:48:00,000 --> 00:48:03,040
They want to inject malicious code into the execution environment.

1152
00:48:03,040 --> 00:48:06,000
Or modify the policy the agent enforces.

1153
00:48:06,000 --> 00:48:09,920
Or redirect the agent's attention toward a goal that serves the attacker.

1154
00:48:09,920 --> 00:48:11,160
The agent isn't just a tool.

1155
00:48:11,160 --> 00:48:12,160
It's a target.

1156
00:48:12,160 --> 00:48:15,080
It targets need defenses designed specifically for them.

1157
00:48:15,080 --> 00:48:18,480
Misconfigured autonomy is actually worse than manual processes.

1158
00:48:18,480 --> 00:48:22,000
In a manual system, if someone makes a mistake, the blast radius is small.

1159
00:48:22,000 --> 00:48:23,400
One admin makes a bad call.

1160
00:48:23,400 --> 00:48:25,520
It affects the few resources they touched.

1161
00:48:25,520 --> 00:48:27,760
One team's policy change is applied wrong.

1162
00:48:27,760 --> 00:48:30,000
And it only hits the teams that admin modified.

1163
00:48:30,000 --> 00:48:31,680
The mistake is bounded.

1164
00:48:31,680 --> 00:48:33,320
Autonomous systems invert this.

1165
00:48:33,320 --> 00:48:37,640
When the policy engine has a misconfiguration, that mistake hits everywhere at once.

1166
00:48:37,640 --> 00:48:43,440
A bad policy that says revoke all external sharing hits every team in your tenant in seconds.

1167
00:48:43,440 --> 00:48:45,280
Tens of thousands of teams are affected.

1168
00:48:45,280 --> 00:48:47,560
Collaboration breaks, uses panic.

1169
00:48:47,560 --> 00:48:51,000
Now you have to reverse it, which is just another massive change applied at scale.

1170
00:48:51,000 --> 00:48:55,360
The damage from one policy mistake in an autonomous system can exceed the damage from a thousand

1171
00:48:55,360 --> 00:48:56,360
manual mistakes.

1172
00:48:56,360 --> 00:48:59,000
This is why policy correctness isn't a nice to have.

1173
00:48:59,000 --> 00:49:00,040
It's the foundation.

1174
00:49:00,040 --> 00:49:02,640
The blast radius expands because friction is gone.

1175
00:49:02,640 --> 00:49:07,160
In manual IT, the damage a thief can do is limited by what one person can physically

1176
00:49:07,160 --> 00:49:09,120
click before someone notices.

1177
00:49:09,120 --> 00:49:10,800
They have to remember how to make changes.

1178
00:49:10,800 --> 00:49:12,320
They have to navigate the UI.

1179
00:49:12,320 --> 00:49:13,520
They have to type commands.

1180
00:49:13,520 --> 00:49:15,280
Friction slows them down.

1181
00:49:15,280 --> 00:49:19,720
In autonomous IT, a compromised agent can hit thousands of resources before a human even

1182
00:49:19,720 --> 00:49:20,720
sees an alert.

1183
00:49:20,720 --> 00:49:22,840
The agent doesn't need to remember how to make changes.

1184
00:49:22,840 --> 00:49:23,840
It already knows.

1185
00:49:23,840 --> 00:49:24,840
It doesn't need to navigate.

1186
00:49:24,840 --> 00:49:26,000
It has API access.

1187
00:49:26,000 --> 00:49:27,000
It doesn't need to type.

1188
00:49:27,000 --> 00:49:28,720
It executes programmatically.

1189
00:49:28,720 --> 00:49:32,120
A compromised agent can revoke thousands of permissions and delete thousands of files

1190
00:49:32,120 --> 00:49:35,680
in the time it takes for a human to notice a weird log entry.

1191
00:49:35,680 --> 00:49:38,440
The speed of the system amplifies the speed of the attack.

1192
00:49:38,440 --> 00:49:43,560
Supply chain risk also multiplies because agents are constantly calling external APIs.

1193
00:49:43,560 --> 00:49:46,200
Every external dependency is a potential way in.

1194
00:49:46,200 --> 00:49:48,640
An agent calls your CM to pull security data.

1195
00:49:48,640 --> 00:49:52,360
But if the CM is compromised, the agent might be too and agent integrates with your HR

1196
00:49:52,360 --> 00:49:53,800
system to sync roles.

1197
00:49:53,800 --> 00:49:57,040
And if that integration breaks, the agent's decision making is corrupted.

1198
00:49:57,040 --> 00:49:59,000
Every external call is a new attack surface.

1199
00:49:59,000 --> 00:50:03,120
As you build sophisticated agents that coordinate across more systems, you are expanding that

1200
00:50:03,120 --> 00:50:04,120
risk surface.

1201
00:50:04,120 --> 00:50:05,640
The requirement is clear.

1202
00:50:05,640 --> 00:50:09,000
Security must be embedded in the agent architecture, not added later.

1203
00:50:09,000 --> 00:50:11,840
You can't secure agents the way you secure old applications.

1204
00:50:11,840 --> 00:50:16,080
By putting firewalls and endpoint protection around them, agents live inside your cloud,

1205
00:50:16,080 --> 00:50:19,880
they need security baked into how they're designed, how they get permissions, and how

1206
00:50:19,880 --> 00:50:20,880
they're monitored.

1207
00:50:20,880 --> 00:50:25,120
This is architecture work, not a bolt-on, the human in the loop problem.

1208
00:50:25,120 --> 00:50:27,520
Here's the tension that defines the next decade.

1209
00:50:27,520 --> 00:50:31,600
The security risks are real, but they're small compared to the fundamental challenge.

1210
00:50:31,600 --> 00:50:33,400
Autonomy requires humans to step back.

1211
00:50:33,400 --> 00:50:38,120
It asks us to let systems make decisions and to trust algorithms more than our own instinct.

1212
00:50:38,120 --> 00:50:39,880
And humans are fundamentally resistant to that.

1213
00:50:39,880 --> 00:50:41,320
We evolve to be in control.

1214
00:50:41,320 --> 00:50:44,480
We evolve to take action when we see a problem.

1215
00:50:44,480 --> 00:50:48,560
Asking humans to monitor instead of due, to set policy instead of execute, to intervene

1216
00:50:48,560 --> 00:50:50,640
only when it's absolutely necessary.

1217
00:50:50,640 --> 00:50:52,160
That requires a cultural shift.

1218
00:50:52,160 --> 00:50:54,280
Most companies aren't ready for.

1219
00:50:54,280 --> 00:50:57,160
The technical architecture of autonomous IT is almost solved.

1220
00:50:57,160 --> 00:50:58,760
The human architecture is not.

1221
00:50:58,760 --> 00:51:01,120
This resistance shows up in very specific ways.

1222
00:51:01,120 --> 00:51:03,840
Imagine an agent detects a user with too many permissions.

1223
00:51:03,840 --> 00:51:06,920
The policy says those permissions should be revoked automatically.

1224
00:51:06,920 --> 00:51:10,720
The system is right, the policy is sound, but those permissions were granted by a powerful

1225
00:51:10,720 --> 00:51:14,120
director for a special project, the director doesn't like surprises, so instead of the

1226
00:51:14,120 --> 00:51:15,440
agent just fixing it.

1227
00:51:15,440 --> 00:51:18,920
An approval workflow triggers, the director gets a notification, the director has to

1228
00:51:18,920 --> 00:51:20,120
approve the change.

1229
00:51:20,120 --> 00:51:22,880
The process that should have taken seconds now takes days.

1230
00:51:22,880 --> 00:51:26,840
Or the director denies it, the permission stays, and the policy is violated because a human

1231
00:51:26,840 --> 00:51:28,080
wanted an override.

1232
00:51:28,080 --> 00:51:32,040
This isn't a system failure, it's humans being unwilling to embrace the model.

1233
00:51:32,040 --> 00:51:35,160
Of course, high impact decisions still need human judgment.

1234
00:51:35,160 --> 00:51:37,640
This is the legitimate reason to keep humans in the loop.

1235
00:51:37,640 --> 00:51:41,920
An agent might try to revoke a CFO's access because of an unusual pattern, but the CFO is

1236
00:51:41,920 --> 00:51:45,320
actually running a sensitive financial audit, cutting them off during that audit would be

1237
00:51:45,320 --> 00:51:46,320
a disaster.

1238
00:51:46,320 --> 00:51:49,120
The system needs to understand context and impact.

1239
00:51:49,120 --> 00:51:52,640
Some things like transferring large budgets, changing governance rules for thousands of

1240
00:51:52,640 --> 00:51:53,640
people.

1241
00:51:53,640 --> 00:51:56,720
Or accessing regulated healthcare data aren't routine.

1242
00:51:56,720 --> 00:52:00,200
They can't be fully automated because the consequences matter too much.

1243
00:52:00,200 --> 00:52:03,920
The challenge is designing workflows that are fast enough to stay out of the way.

1244
00:52:03,920 --> 00:52:07,160
But thorough enough to catch errors, this is the engineering problem of the next five

1245
00:52:07,160 --> 00:52:08,160
years.

1246
00:52:08,160 --> 00:52:11,640
If your workflow requires a human to manually approve every single agent action, you've

1247
00:52:11,640 --> 00:52:13,320
solved the control problem.

1248
00:52:13,320 --> 00:52:14,920
But you've killed the benefit of autonomy.

1249
00:52:14,920 --> 00:52:16,560
The system now moves at human speed.

1250
00:52:16,560 --> 00:52:19,440
If you have no human review, you have speed, but you've lost control.

1251
00:52:19,440 --> 00:52:20,920
The balance point is very narrow.

1252
00:52:20,920 --> 00:52:22,920
Low impact decisions should be automatic.

1253
00:52:22,920 --> 00:52:25,040
High impact decisions need a pair of eyes.

1254
00:52:25,040 --> 00:52:27,600
The system has to be smart enough to know which is which.

1255
00:52:27,600 --> 00:52:29,640
Override mechanisms are also essential.

1256
00:52:29,640 --> 00:52:32,880
Humans must be able to stop or reverse an agent when things go sideways.

1257
00:52:32,880 --> 00:52:36,520
If an agent implements a policy that has unintended consequences.

1258
00:52:36,520 --> 00:52:39,040
An override lets a human hit the brakes while they figure it out.

1259
00:52:39,040 --> 00:52:41,480
This isn't a sign of weakness, it's a safety feature.

1260
00:52:41,480 --> 00:52:44,120
Autonomous systems are powerful because they operate at scale.

1261
00:52:44,120 --> 00:52:47,040
But that scale means mistakes can be catastrophic.

1262
00:52:47,040 --> 00:52:48,240
Reversibility is the safety net.

1263
00:52:48,240 --> 00:52:52,000
The agent fixes something, a human sees it was wrong, and they reverse it, they fix

1264
00:52:52,000 --> 00:52:53,000
the policy.

1265
00:52:53,000 --> 00:52:54,000
And the agent tries again.

1266
00:52:54,000 --> 00:52:55,960
No permanent damage.

1267
00:52:55,960 --> 00:52:58,920
This need for reversibility shapes the entire architecture.

1268
00:52:58,920 --> 00:53:00,920
The actual balance looks like this.

1269
00:53:00,920 --> 00:53:02,280
Humans set the policy.

1270
00:53:02,280 --> 00:53:03,600
They define what should happen.

1271
00:53:03,600 --> 00:53:04,960
They own the governance model.

1272
00:53:04,960 --> 00:53:07,200
Agents enforce that policy reliably and at scale.

1273
00:53:07,200 --> 00:53:08,920
They execute the decisions.

1274
00:53:08,920 --> 00:53:11,200
Humans intervene when the policy isn't enough.

1275
00:53:11,200 --> 00:53:14,000
Or when a situation pops up that the policy didn't predict.

1276
00:53:14,000 --> 00:53:15,760
This isn't humans managing agents.

1277
00:53:15,760 --> 00:53:18,160
It's humans and agents working as a single system.

1278
00:53:18,160 --> 00:53:20,240
The human provides the judgment and oversight.

1279
00:53:20,240 --> 00:53:22,200
The agent provides the scale and speed.

1280
00:53:22,200 --> 00:53:23,680
Neither one replaces the other.

1281
00:53:23,680 --> 00:53:25,080
They just stay in their lanes.

1282
00:53:25,080 --> 00:53:27,720
This is why Autonomous IT is an organizational journey.

1283
00:53:27,720 --> 00:53:29,760
Not just a technical project.

1284
00:53:29,760 --> 00:53:31,280
The PowerShell question.

1285
00:53:31,280 --> 00:53:32,280
Will it survive?

1286
00:53:32,280 --> 00:53:34,200
Let's look at one of the big predictions.

1287
00:53:34,200 --> 00:53:36,040
Is PowerShell dead by 2030?

1288
00:53:36,040 --> 00:53:37,120
The answer is no.

1289
00:53:37,120 --> 00:53:39,480
But the reason why matters more than the answer itself.

1290
00:53:39,480 --> 00:53:40,480
PowerShell isn't dying.

1291
00:53:40,480 --> 00:53:42,280
It's just evolving into something different.

1292
00:53:42,280 --> 00:53:44,440
Today, PowerShell is a tool humans use.

1293
00:53:44,440 --> 00:53:45,440
You learn the syntax.

1294
00:53:45,440 --> 00:53:46,440
You write the scripts.

1295
00:53:46,440 --> 00:53:48,800
You execute them and then you debug them when they break.

1296
00:53:48,800 --> 00:53:51,320
It's a human interface for the Microsoft ecosystem.

1297
00:53:51,320 --> 00:53:53,520
In five years, PowerShell will still be here.

1298
00:53:53,520 --> 00:53:55,280
Its primary user won't be you.

1299
00:53:55,280 --> 00:53:56,240
It will be other systems.

1300
00:53:56,240 --> 00:53:57,400
It will be co-pilot.

1301
00:53:57,400 --> 00:53:58,440
It will be agents.

1302
00:53:58,440 --> 00:54:00,680
It will be automation frameworks generating code

1303
00:54:00,680 --> 00:54:02,920
that runs without a human ever looking at it.

1304
00:54:02,920 --> 00:54:05,240
We can already see this shift in how co-pilot works.

1305
00:54:05,240 --> 00:54:06,920
When you ask it to automate a task,

1306
00:54:06,920 --> 00:54:08,960
co-pilot generates PowerShell code.

1307
00:54:08,960 --> 00:54:11,080
It doesn't do this because it expects a human to read

1308
00:54:11,080 --> 00:54:12,280
or maintain that code.

1309
00:54:12,280 --> 00:54:14,800
But because PowerShell is the execution engine

1310
00:54:14,800 --> 00:54:18,160
for Microsoft 365, the code gets generated, stored,

1311
00:54:18,160 --> 00:54:19,080
and executed.

1312
00:54:19,080 --> 00:54:21,360
Maybe a human reviews it or tweaks a line here and there.

1313
00:54:21,360 --> 00:54:22,960
But more and more, code is being

1314
00:54:22,960 --> 00:54:25,160
born and executed inside automated pipelines.

1315
00:54:25,160 --> 00:54:27,720
Your role is shifting from the writer to the reviewer.

1316
00:54:27,720 --> 00:54:29,120
You aren't the creator anymore.

1317
00:54:29,120 --> 00:54:30,120
You're the auditor.

1318
00:54:30,120 --> 00:54:32,520
This is a massive shift because it means PowerShell usage

1319
00:54:32,520 --> 00:54:35,000
actually goes up even as you spend less time typing it.

1320
00:54:35,000 --> 00:54:37,200
More PowerShell will be running than ever before,

1321
00:54:37,200 --> 00:54:38,440
but it won't be handcrafted.

1322
00:54:38,440 --> 00:54:40,920
It will be AI generated, tested by machines,

1323
00:54:40,920 --> 00:54:42,520
and monitored by other systems.

1324
00:54:42,520 --> 00:54:44,720
The language stays the same, but the audience changes.

1325
00:54:44,720 --> 00:54:46,960
PowerShell is becoming the language that machines use

1326
00:54:46,960 --> 00:54:48,160
to talk to each other.

1327
00:54:48,160 --> 00:54:49,560
You don't need to be fluent anymore

1328
00:54:49,560 --> 00:54:51,320
because the machines have that covered.

1329
00:54:51,320 --> 00:54:52,680
Think about what happened with Cycle.

1330
00:54:52,680 --> 00:54:55,480
30 years ago, database admins wrote every query

1331
00:54:55,480 --> 00:54:57,040
and stored procedure by hand.

1332
00:54:57,040 --> 00:54:58,360
They lived in that language.

1333
00:54:58,360 --> 00:55:01,160
Today, or M's and data frameworks generate almost all of it.

1334
00:55:01,160 --> 00:55:03,640
Most developers haven't written raw SQL in years.

1335
00:55:03,640 --> 00:55:05,520
Yet SQL execution is happening at a scale

1336
00:55:05,520 --> 00:55:06,560
we've never seen before.

1337
00:55:06,560 --> 00:55:07,760
The language didn't die.

1338
00:55:07,760 --> 00:55:10,160
The user base just shifted from people to systems.

1339
00:55:10,160 --> 00:55:11,720
PowerShell stays the execution layer

1340
00:55:11,720 --> 00:55:14,280
because it's the proven foundation for Microsoft 365.

1341
00:55:14,280 --> 00:55:15,560
Graph calls run through it.

1342
00:55:15,560 --> 00:55:17,440
Remediation workflows execute through it.

1343
00:55:17,440 --> 00:55:20,080
Everything across teams, SharePoint, and EntraID

1344
00:55:20,080 --> 00:55:21,080
still relies on it.

1345
00:55:21,080 --> 00:55:22,880
You could try to build autonomous governance

1346
00:55:22,880 --> 00:55:25,080
using only native APIs, but PowerShell is where

1347
00:55:25,080 --> 00:55:26,320
the infrastructure lives.

1348
00:55:26,320 --> 00:55:28,760
It's where the modules are and where the patterns are already

1349
00:55:28,760 --> 00:55:29,360
set.

1350
00:55:29,360 --> 00:55:31,440
In Enterprise software, nobody migrates away

1351
00:55:31,440 --> 00:55:33,720
from proven infrastructure because the cost of switching

1352
00:55:33,720 --> 00:55:34,800
is just too high.

1353
00:55:34,800 --> 00:55:36,760
Cross-platform needs also lock PowerShell

1354
00:55:36,760 --> 00:55:37,800
into the architecture.

1355
00:55:37,800 --> 00:55:40,640
PowerShell Core runs on Windows, Linux, and Mac OS.

1356
00:55:40,640 --> 00:55:43,400
Your autonomous agents don't care about the operating system.

1357
00:55:43,400 --> 00:55:45,440
And an agent on Linux running Graph operations

1358
00:55:45,440 --> 00:55:46,720
needs a reliable runtime.

1359
00:55:46,720 --> 00:55:47,880
PowerShell Core is there.

1360
00:55:47,880 --> 00:55:50,920
It's proven, and it plugs right into the Microsoft ecosystem.

1361
00:55:50,920 --> 00:55:53,120
As companies run workloads across different clouds

1362
00:55:53,120 --> 00:55:55,960
and OS environments, they need a unified scripting layer.

1363
00:55:55,960 --> 00:55:57,680
PowerShell Core is that layer.

1364
00:55:57,680 --> 00:55:58,760
The prediction is simple.

1365
00:55:58,760 --> 00:56:02,000
PowerShell usage goes up while direct human usage goes down.

1366
00:56:02,000 --> 00:56:03,960
By 2030, more lines of PowerShell

1367
00:56:03,960 --> 00:56:05,760
will be running in production than today.

1368
00:56:05,760 --> 00:56:07,360
More organizations will depend on it

1369
00:56:07,360 --> 00:56:09,040
for their core automation.

1370
00:56:09,040 --> 00:56:11,240
But fewer humans will be writing it or reading it.

1371
00:56:11,240 --> 00:56:12,440
It becomes infrastructure.

1372
00:56:12,440 --> 00:56:14,960
It's the runtime for agents and the language systems

1373
00:56:14,960 --> 00:56:16,080
used to coordinate.

1374
00:56:16,080 --> 00:56:17,920
You set the policy, the agent enforces it,

1375
00:56:17,920 --> 00:56:19,800
and PowerShell executes that enforcement.

1376
00:56:19,800 --> 00:56:22,360
It becomes invisible because it's just how the system works.

1377
00:56:22,360 --> 00:56:23,640
It isn't a tool you use.

1378
00:56:23,640 --> 00:56:26,480
It's the substrate that carries your intent to the finish line.

1379
00:56:26,480 --> 00:56:29,080
Your PowerShell skills won't disappear completely.

1380
00:56:29,080 --> 00:56:30,640
Some people will still need deep knowledge

1381
00:56:30,640 --> 00:56:33,040
to debug automation failures or design the frameworks

1382
00:56:33,040 --> 00:56:34,120
that agents live in.

1383
00:56:34,120 --> 00:56:35,840
But those roles will be specialized.

1384
00:56:35,840 --> 00:56:37,560
They won't be mainstream IT skills anymore.

1385
00:56:37,560 --> 00:56:39,240
There'll be governance architecture roles

1386
00:56:39,240 --> 00:56:40,480
for senior positions.

1387
00:56:40,480 --> 00:56:42,680
The average operations pro in 2030 probably

1388
00:56:42,680 --> 00:56:44,200
won't write PowerShell at all.

1389
00:56:44,200 --> 00:56:46,360
They'll write policy and configure agents.

1390
00:56:46,360 --> 00:56:48,320
PowerShell is just what's happening under the hood.

1391
00:56:48,320 --> 00:56:50,320
The 2030 organizational model.

1392
00:56:50,320 --> 00:56:52,920
Let's look forward and see what enterprise IT actually looks

1393
00:56:52,920 --> 00:56:55,360
like in five years if you navigate this transition.

1394
00:56:55,360 --> 00:56:56,400
Start with the portal.

1395
00:56:56,400 --> 00:56:58,240
Right now, your day is built around logging

1396
00:56:58,240 --> 00:56:59,400
into different centers.

1397
00:56:59,400 --> 00:57:00,840
You go to SharePoint to check sites,

1398
00:57:00,840 --> 00:57:02,920
Enter for groups, and Exchange for mailboxes.

1399
00:57:02,920 --> 00:57:04,520
Then you jump into Teams for governance

1400
00:57:04,520 --> 00:57:06,040
and purview for DLP policies.

1401
00:57:06,040 --> 00:57:08,120
Your brain is split across six different consoles

1402
00:57:08,120 --> 00:57:10,000
in a dozen authentication sessions.

1403
00:57:10,000 --> 00:57:12,400
In 2030, routine work doesn't happen in a portal.

1404
00:57:12,400 --> 00:57:15,040
You don't log into check Teams because the system is already

1405
00:57:15,040 --> 00:57:16,000
monitoring it.

1406
00:57:16,000 --> 00:57:17,840
You don't log into manage permissions

1407
00:57:17,840 --> 00:57:20,120
because agents are doing that based on your policy.

1408
00:57:20,120 --> 00:57:21,840
The portal becomes an exception interface.

1409
00:57:21,840 --> 00:57:23,560
You only log in when something breaks

1410
00:57:23,560 --> 00:57:25,520
or when a policy needs a human decision.

1411
00:57:25,520 --> 00:57:27,480
Routine operations happen without you.

1412
00:57:27,480 --> 00:57:28,560
Instead of clicking buttons,

1413
00:57:28,560 --> 00:57:30,680
you'll spend your time defining policy

1414
00:57:30,680 --> 00:57:32,080
and watching the outcomes.

1415
00:57:32,080 --> 00:57:33,160
You'll sit with business leaders

1416
00:57:33,160 --> 00:57:35,040
to answer the big governance questions.

1417
00:57:35,040 --> 00:57:37,040
You'll decide how to handle external collaboration

1418
00:57:37,040 --> 00:57:38,720
or what data counts is sensitive.

1419
00:57:38,720 --> 00:57:40,200
You'll design the retention policies

1420
00:57:40,200 --> 00:57:41,600
for different types of content.

1421
00:57:41,600 --> 00:57:43,720
These are high-value tasks that need human judgment

1422
00:57:43,720 --> 00:57:44,560
and business context.

1423
00:57:44,560 --> 00:57:46,560
Once you set the rules, you configure the system

1424
00:57:46,560 --> 00:57:47,360
to enforce them.

1425
00:57:47,360 --> 00:57:50,480
You'll watch dashboards that show compliance and remediation.

1426
00:57:50,480 --> 00:57:52,120
You'll see where the policy is working

1427
00:57:52,120 --> 00:57:53,440
and where it's hitting a wall.

1428
00:57:53,440 --> 00:57:55,080
You get in alert when something weird happens

1429
00:57:55,080 --> 00:57:57,760
and you step in when an agent needs a human to make the call.

1430
00:57:57,760 --> 00:58:00,480
Most operational decisions will be handled by agents.

1431
00:58:00,480 --> 00:58:02,200
They'll provision mailboxes for new hires

1432
00:58:02,200 --> 00:58:04,160
and assigned permissions based on their role.

1433
00:58:04,160 --> 00:58:06,400
They'll tag new content with retention labels

1434
00:58:06,400 --> 00:58:08,960
and tighten access when they see permission drift.

1435
00:58:08,960 --> 00:58:11,960
If a team has been dead for a year, the agent archives it.

1436
00:58:11,960 --> 00:58:15,120
If a sensitive document is shared wrong, the agent fixes it.

1437
00:58:15,120 --> 00:58:16,920
Incident response becomes almost entirely

1438
00:58:16,920 --> 00:58:17,760
agent-driven.

1439
00:58:17,760 --> 00:58:20,160
A security alert fires and agent analyzes it

1440
00:58:20,160 --> 00:58:21,520
and then it correlates that signal

1441
00:58:21,520 --> 00:58:22,840
with everything else it sees.

1442
00:58:22,840 --> 00:58:23,920
It makes a choice.

1443
00:58:23,920 --> 00:58:26,240
It blocks the account, revokes the tokens,

1444
00:58:26,240 --> 00:58:27,680
and isolates the device.

1445
00:58:27,680 --> 00:58:30,160
Most incidents will be over before a human even knows

1446
00:58:30,160 --> 00:58:31,080
they started.

1447
00:58:31,080 --> 00:58:32,880
The structure of human roles will change.

1448
00:58:32,880 --> 00:58:35,800
The system administrator title will start to fade away.

1449
00:58:35,800 --> 00:58:37,760
In its place, we'll see governance architects.

1450
00:58:37,760 --> 00:58:39,920
These are the people who design the policy model

1451
00:58:39,920 --> 00:58:42,320
and understand how different rules interact.

1452
00:58:42,320 --> 00:58:43,600
This is high-leveraged work.

1453
00:58:43,600 --> 00:58:46,440
One architect setting a policy can affect thousands of users.

1454
00:58:46,440 --> 00:58:47,920
It's a world away from a cis-admin

1455
00:58:47,920 --> 00:58:49,800
doing the same repetitive tasks.

1456
00:58:49,800 --> 00:58:52,480
You'll also see agent supervisors who monitor the health

1457
00:58:52,480 --> 00:58:54,760
of the AI and step in for the edge cases.

1458
00:58:54,760 --> 00:58:56,920
Security operations will move from manual triage

1459
00:58:56,920 --> 00:58:58,400
to directing agents.

1460
00:58:58,400 --> 00:59:01,640
A SOC analyst in 2030 won't spend their day reading alerts.

1461
00:59:01,640 --> 00:59:03,680
They'll be giving agent strategic objectives.

1462
00:59:03,680 --> 00:59:06,000
This creates a compounding effect on efficiency.

1463
00:59:06,000 --> 00:59:07,880
Fewer people means lower costs.

1464
00:59:07,880 --> 00:59:10,360
And faster operations mean problems get fixed

1465
00:59:10,360 --> 00:59:12,320
before they turn into disasters.

1466
00:59:12,320 --> 00:59:14,440
An incident that used to cost $50,000

1467
00:59:14,440 --> 00:59:16,240
now gets resolved in minutes.

1468
00:59:16,240 --> 00:59:19,080
Fewer human errors mean fewer incidents in the first place.

1469
00:59:19,080 --> 00:59:21,480
Automated compliance means you stop failing audits.

1470
00:59:21,480 --> 00:59:23,280
This isn't just a small improvement.

1471
00:59:23,280 --> 00:59:24,480
It's an exponential jump.

1472
00:59:24,480 --> 00:59:26,360
The organization becomes faster, cheaper,

1473
00:59:26,360 --> 00:59:28,160
and more resilient all at once.

1474
00:59:28,160 --> 00:59:30,600
The risk is huge for companies that don't make this move.

1475
00:59:30,600 --> 00:59:32,360
They'll become operationally obsolete.

1476
00:59:32,360 --> 00:59:33,720
They'll be competing against companies

1477
00:59:33,720 --> 00:59:35,720
that finish in minutes what takes them days.

1478
00:59:35,720 --> 00:59:37,320
Their staffing models won't be able to scale.

1479
00:59:37,320 --> 00:59:38,520
They'll lose their best talent

1480
00:59:38,520 --> 00:59:40,680
because manual governance work is boring

1481
00:59:40,680 --> 00:59:43,520
and the agents have already taken all the interesting problems.

1482
00:59:43,520 --> 00:59:44,880
They'll fall behind on compliance

1483
00:59:44,880 --> 00:59:48,000
because manual controls can't keep up with new regulations.

1484
00:59:48,000 --> 00:59:50,160
By 2030, this isn't a subtle advantage.

1485
00:59:50,160 --> 00:59:52,520
It's the difference between winning and losing.

1486
00:59:52,520 --> 00:59:54,480
Organizations that move to autonomous IT

1487
00:59:54,480 --> 00:59:56,960
will operate at a level that manual teams just can't reach.

1488
00:59:56,960 --> 00:59:58,680
You won't necessarily go out of business,

1489
00:59:58,680 --> 01:00:01,120
but you'll always be behind, always struggling,

1490
01:00:01,120 --> 01:00:03,080
and always spending more to get less.

1491
01:00:03,080 --> 01:00:06,680
That is the reality of 2030, the governance culture shift.

1492
01:00:06,680 --> 01:00:09,880
The technical move from manual to autonomous IT is hard,

1493
01:00:09,880 --> 01:00:11,440
but the cultural shift is harder

1494
01:00:11,440 --> 01:00:13,440
because this transition requires different assumptions

1495
01:00:13,440 --> 01:00:15,080
about trust and accountability.

1496
01:00:15,080 --> 01:00:16,840
And people hate changing their assumptions,

1497
01:00:16,840 --> 01:00:19,280
especially when those assumptions worked for decades.

1498
01:00:19,280 --> 01:00:21,160
In the old model, trust flows to people.

1499
01:00:21,160 --> 01:00:23,920
You trust the admin who configures your identity system.

1500
01:00:23,920 --> 01:00:26,360
You trust the officer who interprets regulations.

1501
01:00:26,360 --> 01:00:29,120
You trust the analyst who makes decisions during an incident.

1502
01:00:29,120 --> 01:00:30,440
These people have expertise.

1503
01:00:30,440 --> 01:00:31,360
They've proven themselves.

1504
01:00:31,360 --> 01:00:32,200
You give them authority

1505
01:00:32,200 --> 01:00:35,040
because you trust their judgment and their integrity.

1506
01:00:35,040 --> 01:00:37,760
But in autonomous IT, trust shifts to systems.

1507
01:00:37,760 --> 01:00:40,400
You trust the policy engine to evaluate decisions.

1508
01:00:40,400 --> 01:00:42,600
You trust the algorithm to surface real problems

1509
01:00:42,600 --> 01:00:43,880
instead of false positives.

1510
01:00:43,880 --> 01:00:46,080
You trust the workflow to fix issues correctly.

1511
01:00:46,080 --> 01:00:48,680
This sounds easier because algorithms are consistent.

1512
01:00:48,680 --> 01:00:50,880
But in reality, it's much harder.

1513
01:00:50,880 --> 01:00:52,400
An algorithm that makes a mistake

1514
01:00:52,400 --> 01:00:54,440
makes that same mistake for everyone.

1515
01:00:54,440 --> 01:00:56,800
If it's misconfigured, it affects thousands of users

1516
01:00:56,800 --> 01:00:58,280
before anyone even notices.

1517
01:00:58,280 --> 01:01:00,640
You can't appeal to an algorithm's good intentions.

1518
01:01:00,640 --> 01:01:03,160
You can't give a piece of code the benefit of the doubt.

1519
01:01:03,160 --> 01:01:05,160
The stakes feel higher because the scale is higher.

1520
01:01:05,160 --> 01:01:06,760
This shift requires a new belief

1521
01:01:06,760 --> 01:01:09,160
that systems can be more reliable than people.

1522
01:01:09,160 --> 01:01:10,720
It's the belief that policy engines

1523
01:01:10,720 --> 01:01:12,400
are more consistent than humans.

1524
01:01:12,400 --> 01:01:15,200
That automation is safer than manual processes at scale.

1525
01:01:15,200 --> 01:01:17,480
Most organizations haven't internalized this yet.

1526
01:01:17,480 --> 01:01:19,720
They still think the safe choice is human review.

1527
01:01:19,720 --> 01:01:21,800
They think the careful choice is human approval.

1528
01:01:21,800 --> 01:01:24,520
They think the accountable choice is human decision-making.

1529
01:01:24,520 --> 01:01:27,360
Building autonomous IT means accepting that human review

1530
01:01:27,360 --> 01:01:29,120
is often the less safe choice.

1531
01:01:29,120 --> 01:01:30,920
Human approval introduces delay

1532
01:01:30,920 --> 01:01:32,360
and delay increases risk.

1533
01:01:32,360 --> 01:01:34,800
Human decision-making introduces inconsistency

1534
01:01:34,800 --> 01:01:36,200
and inconsistency creates gaps.

1535
01:01:36,200 --> 01:01:37,240
The culture has to flip.

1536
01:01:37,240 --> 01:01:38,960
Transparency becomes mandatory.

1537
01:01:38,960 --> 01:01:41,960
And this is the part that really threatens organizational comfort.

1538
01:01:41,960 --> 01:01:44,240
In autonomous IT, every decision is auditable.

1539
01:01:44,240 --> 01:01:45,800
Every action is logged with context.

1540
01:01:45,800 --> 01:01:46,720
There is no darkness.

1541
01:01:46,720 --> 01:01:48,120
An agent took an action.

1542
01:01:48,120 --> 01:01:49,680
Here is the policy that triggered it.

1543
01:01:49,680 --> 01:01:51,280
Here is the data that informed it.

1544
01:01:51,280 --> 01:01:52,720
Here is the exact timestamp.

1545
01:01:52,720 --> 01:01:53,640
Nothing is hidden.

1546
01:01:53,640 --> 01:01:54,800
Nothing is mysterious.

1547
01:01:54,800 --> 01:01:55,880
Everything is documented

1548
01:01:55,880 --> 01:01:57,800
because documentation is now structural.

1549
01:01:57,800 --> 01:01:59,600
Not optional.

1550
01:01:59,600 --> 01:02:01,880
This transparency feels like a loss of privacy

1551
01:02:01,880 --> 01:02:03,680
to people used to opacity.

1552
01:02:03,680 --> 01:02:05,160
An admin used to be able to say,

1553
01:02:05,160 --> 01:02:06,760
"I reviewed this and decided."

1554
01:02:06,760 --> 01:02:08,080
With almost no paperwork,

1555
01:02:08,080 --> 01:02:10,000
the decision was only visible to that admin

1556
01:02:10,000 --> 01:02:11,320
and whoever they told.

1557
01:02:11,320 --> 01:02:12,560
In autonomous systems,

1558
01:02:12,560 --> 01:02:14,640
every decision path is visible to everyone.

1559
01:02:14,640 --> 01:02:15,800
This is more accountable,

1560
01:02:15,800 --> 01:02:17,160
but it feels exposing.

1561
01:02:17,160 --> 01:02:18,360
Some administrators resist

1562
01:02:18,360 --> 01:02:19,960
because they lose the ability to say,

1563
01:02:19,960 --> 01:02:21,640
"Trust me, I know what I'm doing."

1564
01:02:21,640 --> 01:02:24,840
Accountability shifts in a way that is subtle but profound.

1565
01:02:24,840 --> 01:02:26,720
Instead of asking, "Who did this?"

1566
01:02:26,720 --> 01:02:27,720
The question becomes,

1567
01:02:27,720 --> 01:02:29,360
"What policy allowed this?"

1568
01:02:29,360 --> 01:02:31,160
This shift is revolutionary.

1569
01:02:31,160 --> 01:02:34,520
It moves accountability from the individual to the system design.

1570
01:02:34,520 --> 01:02:36,520
If an agent took an action that seems wrong,

1571
01:02:36,520 --> 01:02:37,520
the question isn't,

1572
01:02:37,520 --> 01:02:39,480
"Why did the agent make that decision?"

1573
01:02:39,480 --> 01:02:42,680
It's what policy did we write that resulted in that decision.

1574
01:02:42,680 --> 01:02:45,480
This changes everything about how you approach mistakes.

1575
01:02:45,480 --> 01:02:46,680
When a human makes a mistake,

1576
01:02:46,680 --> 01:02:47,840
you hold them accountable.

1577
01:02:47,840 --> 01:02:48,880
You might retrain them.

1578
01:02:48,880 --> 01:02:50,040
You might replace them.

1579
01:02:50,040 --> 01:02:52,160
But when a system makes a mistake at scale,

1580
01:02:52,160 --> 01:02:53,680
you examine the policy that caused it.

1581
01:02:53,680 --> 01:02:55,360
You fix the policy, you test the fix,

1582
01:02:55,360 --> 01:02:56,320
you deploy it.

1583
01:02:56,320 --> 01:02:58,080
You prevent the entire class of mistakes

1584
01:02:58,080 --> 01:03:00,080
instead of just addressing one instance.

1585
01:03:00,080 --> 01:03:02,560
Continuous improvement replaces periodic audits.

1586
01:03:02,560 --> 01:03:04,520
Your governance doesn't get reviewed once a year

1587
01:03:04,520 --> 01:03:05,480
in a compliance audit.

1588
01:03:05,480 --> 01:03:07,240
It's being tested constantly.

1589
01:03:07,240 --> 01:03:08,040
Every hour,

1590
01:03:08,040 --> 01:03:09,920
the system checks if policies are working.

1591
01:03:09,920 --> 01:03:12,080
Every day you get data on policy effectiveness.

1592
01:03:12,080 --> 01:03:15,800
Every week, you measure if autonomy is delivering the outcomes you intended.

1593
01:03:15,800 --> 01:03:18,760
This creates a feedback loop that drives constant refinement.

1594
01:03:18,760 --> 01:03:20,280
Not because of regulatory pressure,

1595
01:03:20,280 --> 01:03:22,880
but because the system itself makes optimization visible.

1596
01:03:22,880 --> 01:03:25,040
The result is an organization that is more secure

1597
01:03:25,040 --> 01:03:26,560
because it's more transparent.

1598
01:03:26,560 --> 01:03:27,920
Not because it's more restrictive.

1599
01:03:27,920 --> 01:03:30,920
That is the cultural insight that makes autonomous IT work.

1600
01:03:30,920 --> 01:03:32,440
The competitive reality.

1601
01:03:32,440 --> 01:03:33,880
This isn't theoretical.

1602
01:03:33,880 --> 01:03:34,960
It's already happening

1603
01:03:34,960 --> 01:03:37,320
and it's creating winners and losers in real time.

1604
01:03:37,320 --> 01:03:39,600
Organizations building autonomous governance

1605
01:03:39,600 --> 01:03:42,800
are seeing measurable advantages within 18 months.

1606
01:03:42,800 --> 01:03:45,360
Not that we think it will help kind of advantage.

1607
01:03:45,360 --> 01:03:47,000
The measurable quantifiable kind.

1608
01:03:47,000 --> 01:03:49,960
They are reporting efficiency gains of 20 to 30%.

1609
01:03:49,960 --> 01:03:51,760
That sounds like a consultant's promise.

1610
01:03:51,760 --> 01:03:54,840
But it's what happens when you stop having humans perform routine tasks

1611
01:03:54,840 --> 01:03:56,720
and let systems do it at machine speed.

1612
01:03:56,720 --> 01:03:57,840
Fewer people do more work

1613
01:03:57,840 --> 01:03:59,240
because the system handles volume

1614
01:03:59,240 --> 01:04:00,960
that previously required headcount.

1615
01:04:00,960 --> 01:04:04,360
That's what happens when you remove the human bottleneck from IT operations.

1616
01:04:04,360 --> 01:04:06,000
But efficiency is just the beginning.

1617
01:04:06,000 --> 01:04:08,960
Compliance actually becomes cheaper when you automate controls.

1618
01:04:08,960 --> 01:04:10,840
Right now compliance is expensive

1619
01:04:10,840 --> 01:04:12,520
because you need people to do the work.

1620
01:04:12,520 --> 01:04:14,560
You need auditors to review configurations.

1621
01:04:14,560 --> 01:04:16,280
You need analysts to verify controls.

1622
01:04:16,280 --> 01:04:18,080
You need officers to make judgments.

1623
01:04:18,080 --> 01:04:19,160
All of that is labor.

1624
01:04:19,160 --> 01:04:20,520
When controls are automated

1625
01:04:20,520 --> 01:04:22,480
and evidence is collected by the system,

1626
01:04:22,480 --> 01:04:23,800
your cost structure changes.

1627
01:04:23,800 --> 01:04:26,360
You don't audit your organization once a year anymore.

1628
01:04:26,360 --> 01:04:28,240
The system continuously audits itself

1629
01:04:28,240 --> 01:04:30,120
and surfaces evidence in real time.

1630
01:04:30,120 --> 01:04:31,400
When regulators ask for proof,

1631
01:04:31,400 --> 01:04:33,120
you don't spend three months gathering evidence.

1632
01:04:33,120 --> 01:04:35,200
You pull a report that was generated automatically

1633
01:04:35,200 --> 01:04:36,600
by your governance system.

1634
01:04:36,600 --> 01:04:38,160
Your compliance team shrinks.

1635
01:04:38,160 --> 01:04:39,640
Your audit burden shrinks.

1636
01:04:39,640 --> 01:04:41,760
Your costs go down while your assurance goes up.

1637
01:04:41,760 --> 01:04:43,120
That's not a theoretical benefit.

1638
01:04:43,120 --> 01:04:44,800
It's an immediate financial impact.

1639
01:04:44,800 --> 01:04:47,040
Incident response becomes dramatically faster.

1640
01:04:47,040 --> 01:04:48,680
Self-healing systems contain problems

1641
01:04:48,680 --> 01:04:50,080
before they become breaches.

1642
01:04:50,080 --> 01:04:53,320
A security incident that would have taken your team four hours to detect

1643
01:04:53,320 --> 01:04:55,720
now gets found in minutes and fixed in seconds.

1644
01:04:55,720 --> 01:04:57,240
The incident either never becomes visible

1645
01:04:57,240 --> 01:04:58,920
because the system fixed it.

1646
01:04:58,920 --> 01:05:01,120
Or it's contained so quickly that damage is minimal.

1647
01:05:01,120 --> 01:05:02,760
The financial impact is enormous.

1648
01:05:02,760 --> 01:05:07,200
A typical security incident costs an organization hundreds of thousands of dollars.

1649
01:05:07,200 --> 01:05:09,120
If autonomous systems cut response time

1650
01:05:09,120 --> 01:05:11,960
and incident counts by half, the savings compound.

1651
01:05:11,960 --> 01:05:13,760
That's not just operational efficiency.

1652
01:05:13,760 --> 01:05:16,240
That's risk reduction with a direct financial value.

1653
01:05:16,240 --> 01:05:19,880
Innovation accelerates because teams are freed from operational toil.

1654
01:05:19,880 --> 01:05:22,640
Right now, your best people spend their time fighting fires,

1655
01:05:22,640 --> 01:05:26,120
handling outages, troubleshooting problems, deploying patches.

1656
01:05:26,120 --> 01:05:28,480
That's necessary work, but it isn't strategic.

1657
01:05:28,480 --> 01:05:31,280
It's operational debt that consumes your capacity.

1658
01:05:31,280 --> 01:05:35,560
When automation handles that work, your team's bandwidth is freed for the work that moves the needle.

1659
01:05:35,560 --> 01:05:38,960
New capabilities, new integrations, new strategies.

1660
01:05:38,960 --> 01:05:42,600
Your team ships faster because they aren't interrupted by incidents every day.

1661
01:05:42,600 --> 01:05:45,960
And shipping faster is a competitive advantage in a software-driven world.

1662
01:05:45,960 --> 01:05:47,960
The penalty for delay is where this becomes urgent.

1663
01:05:47,960 --> 01:05:50,360
Every year you don't transition to autonomous IT.

1664
01:05:50,360 --> 01:05:52,000
Your competitors gain an advantage.

1665
01:05:52,000 --> 01:05:53,720
In year one, they are 10% faster.

1666
01:05:53,720 --> 01:05:55,280
They respond to incidents faster.

1667
01:05:55,280 --> 01:05:56,600
They deploy changes faster.

1668
01:05:56,600 --> 01:05:59,960
By year two, they are 20% faster and you haven't started.

1669
01:05:59,960 --> 01:06:01,840
In year three, you aren't just behind.

1670
01:06:01,840 --> 01:06:05,280
You're falling further behind because their system scales and yours doesn't.

1671
01:06:05,280 --> 01:06:06,880
The compounding effect is brutal.

1672
01:06:06,880 --> 01:06:10,680
By 2030, organizations that transitioned five years ago will have capabilities

1673
01:06:10,680 --> 01:06:13,440
that are orders of magnitude beyond those just starting.

1674
01:06:13,440 --> 01:06:14,520
You don't catch that gap.

1675
01:06:14,520 --> 01:06:16,680
You just accept being operationally obsolete.

1676
01:06:16,680 --> 01:06:19,240
This is where 2026 becomes a decision point.

1677
01:06:19,240 --> 01:06:22,240
The deprecations we discussed, the Graph Security API retiring,

1678
01:06:22,240 --> 01:06:26,440
the agent registry changing, the CLI retiring, these are all forcing functions.

1679
01:06:26,440 --> 01:06:28,360
Organizations will have to migrate anyway.

1680
01:06:28,360 --> 01:06:31,280
The question is whether you migrate to build autonomous governance

1681
01:06:31,280 --> 01:06:33,960
or migrate just to maintain the status quo.

1682
01:06:33,960 --> 01:06:36,400
Organizations that build autonomy will be ahead.

1683
01:06:36,400 --> 01:06:39,640
Organizations that maintain the status quo will be behind.

1684
01:06:39,640 --> 01:06:42,240
The outcome of that choice compounds for a decade.

1685
01:06:42,240 --> 01:06:43,680
Choose wisely.

1686
01:06:43,680 --> 01:06:46,760
Choose now, the path forward, what to do now.

1687
01:06:46,760 --> 01:06:48,680
So what is the practical first step?

1688
01:06:48,680 --> 01:06:50,600
The answer isn't revolutionary.

1689
01:06:50,600 --> 01:06:52,040
It's methodical.

1690
01:06:52,040 --> 01:06:54,080
Start by auditing your current state.

1691
01:06:54,080 --> 01:06:56,400
Inventory your manual processes.

1692
01:06:56,400 --> 01:06:59,120
What does your operations team actually spend time on every week?

1693
01:06:59,120 --> 01:07:02,120
What tasks keep happening just because nobody has automated them yet?

1694
01:07:02,120 --> 01:07:04,360
What decisions still require a human review?

1695
01:07:04,360 --> 01:07:06,120
Document the friction.

1696
01:07:06,120 --> 01:07:10,280
Identify the high-risk areas where manual governance is exposing you most.

1697
01:07:10,280 --> 01:07:12,640
Measure your current mean time to remediation.

1698
01:07:12,640 --> 01:07:15,680
When a compliance issue is detected, how long does it take before it's fixed?

1699
01:07:15,680 --> 01:07:19,520
When a security problem emerges, how long is the gap from detection to response?

1700
01:07:19,520 --> 01:07:23,400
These baselines matter because they show you where autonomy will have the most impact.

1701
01:07:23,400 --> 01:07:25,800
Next, map your critical operations to Graph.

1702
01:07:25,800 --> 01:07:27,800
You aren't automating everything at once?

1703
01:07:27,800 --> 01:07:32,800
You're identifying which of your critical operations could be driven by Graph APIs and policy enforcement.

1704
01:07:32,800 --> 01:07:35,800
Teams, governance, permission management, retention enforcement,

1705
01:07:35,800 --> 01:07:38,400
DLP application, security, incident response.

1706
01:07:38,400 --> 01:07:40,680
Which of these matter most to your organization?

1707
01:07:40,680 --> 01:07:42,600
Which cause the most operational pain?

1708
01:07:42,600 --> 01:07:44,600
Which represent the highest risk if they fail?

1709
01:07:44,600 --> 01:07:46,960
Map those to the graph capabilities we discussed.

1710
01:07:46,960 --> 01:07:50,840
You'll find that most core governance operations can be expressed as policies evaluated against

1711
01:07:50,840 --> 01:07:51,840
Graph Data.

1712
01:07:51,840 --> 01:07:53,080
That's your migration path.

1713
01:07:53,080 --> 01:07:55,520
Start with governance in your highest risk domains.

1714
01:07:55,520 --> 01:07:56,520
Pick one domain.

1715
01:07:56,520 --> 01:08:00,520
Maybe Teams, permission governance or SharePoint retention enforcement.

1716
01:08:00,520 --> 01:08:02,320
Define the desired state precisely.

1717
01:08:02,320 --> 01:08:03,480
Not in a document.

1718
01:08:03,480 --> 01:08:05,000
Inexecutable policy.

1719
01:08:05,000 --> 01:08:06,720
What does correct look like for a team?

1720
01:08:06,720 --> 01:08:09,400
What does correct look like for a SharePoint site?

1721
01:08:09,400 --> 01:08:12,200
What does correct look like for a retention policy?

1722
01:08:12,200 --> 01:08:13,800
Write this down as a policy definition.

1723
01:08:13,800 --> 01:08:15,280
You aren't automating the fix yet.

1724
01:08:15,280 --> 01:08:17,440
You're defining what you're trying to achieve.

1725
01:08:17,440 --> 01:08:20,560
This clarity matters because everything downstream depends on it.

1726
01:08:20,560 --> 01:08:23,280
Build detection for drift from that desired state.

1727
01:08:23,280 --> 01:08:26,920
Change notifications in graph so you're alerted when something changes.

1728
01:08:26,920 --> 01:08:30,880
Implement continuous scans so you're discovering deviations even when nobody changes anything.

1729
01:08:30,880 --> 01:08:33,720
This is the hardest part because it requires thinking in terms of state.

1730
01:08:33,720 --> 01:08:38,120
Not events, but once you have continuous detection, everything else flows from that.

1731
01:08:38,120 --> 01:08:40,720
You know what's wrong before you decide to fix it.

1732
01:08:40,720 --> 01:08:43,720
Automate remediation carefully.

1733
01:08:43,720 --> 01:08:46,240
Start with low risk fixes.

1734
01:08:46,240 --> 01:08:48,840
If a team is missing an owner, assign one automatically.

1735
01:08:48,840 --> 01:08:51,640
If a site is missing a retention label, apply one.

1736
01:08:51,640 --> 01:08:53,080
These are safe automations.

1737
01:08:53,080 --> 01:08:54,760
They won't cause problems.

1738
01:08:54,760 --> 01:08:55,760
Run them for two weeks.

1739
01:08:55,760 --> 01:08:56,960
See what happens.

1740
01:08:56,960 --> 01:09:00,160
Refine the policy based on what you learn, then expand to the next category.

1741
01:09:00,160 --> 01:09:02,160
Don't try to automate everything at once.

1742
01:09:02,160 --> 01:09:04,560
Build confidence through incremental deployment.

1743
01:09:04,560 --> 01:09:07,680
Each successful automation teaches you how to design the next one.

1744
01:09:07,680 --> 01:09:09,480
Prepare for agent 365 now.

1745
01:09:09,480 --> 01:09:13,600
Understand what the June 2026 migration deadline means for your organization.

1746
01:09:13,600 --> 01:09:16,240
Agents registered via the old API will stop working.

1747
01:09:16,240 --> 01:09:20,240
You need a plan for how you're going to register agents in agent 365 instead.

1748
01:09:20,240 --> 01:09:22,480
Start thinking about how you want to organize your agents.

1749
01:09:22,480 --> 01:09:23,840
Which agents do you want to build?

1750
01:09:23,840 --> 01:09:24,840
Who owns them?

1751
01:09:24,840 --> 01:09:26,120
What policies should constrain them?

1752
01:09:26,120 --> 01:09:30,400
This planning happens in 2025, so you aren't scrambling in June 2026.

1753
01:09:30,400 --> 01:09:31,640
Invest in skills immediately.

1754
01:09:31,640 --> 01:09:35,800
PowerShell, Graph API, Policy Design, Governance Architecture.

1755
01:09:35,800 --> 01:09:37,360
These aren't optional anymore.

1756
01:09:37,360 --> 01:09:39,240
They're core IT competencies.

1757
01:09:39,240 --> 01:09:40,240
Train your team.

1758
01:09:40,240 --> 01:09:42,280
Higher people who understand this domain.

1759
01:09:42,280 --> 01:09:45,080
Build expertise because expertise is scarce and you'll need it.

1760
01:09:45,080 --> 01:09:49,040
The organizations that move fastest are those that invested in building capable teams

1761
01:09:49,040 --> 01:09:50,880
18 months before they needed them.

1762
01:09:50,880 --> 01:09:54,320
The outcome is a roadmap from manual IT to autonomous operations.

1763
01:09:54,320 --> 01:09:56,200
Not a massive transformation in one quarter.

1764
01:09:56,200 --> 01:09:59,240
A deliberate progression that takes 18 months to two years.

1765
01:09:59,240 --> 01:10:00,520
You define policies.

1766
01:10:00,520 --> 01:10:01,680
You build detection.

1767
01:10:01,680 --> 01:10:03,280
You automate remediation.

1768
01:10:03,280 --> 01:10:04,520
You measure results.

1769
01:10:04,520 --> 01:10:06,280
You expand scope.

1770
01:10:06,280 --> 01:10:10,960
By 2027, you're operating significantly differently than you were in 2025.

1771
01:10:10,960 --> 01:10:15,920
By 2030, you're unrecognizable from the manual IT organization you were in 2024.

1772
01:10:15,920 --> 01:10:18,320
That progression is achievable if you start now.

1773
01:10:18,320 --> 01:10:20,000
The nervous system emerges.

1774
01:10:20,000 --> 01:10:22,440
Your enterprise IT will have a nervous system by 2030.

1775
01:10:22,440 --> 01:10:23,920
The question isn't whether it happens.

1776
01:10:23,920 --> 01:10:26,840
It's whether you build it intentionally or let it emerge chaotic.

1777
01:10:26,840 --> 01:10:28,360
Microsoft Graph is the substrate.

1778
01:10:28,360 --> 01:10:30,240
Agent 365 is the framework.

1779
01:10:30,240 --> 01:10:31,880
Co-pilot is the interface.

1780
01:10:31,880 --> 01:10:34,120
Together, they form the nervous system.

1781
01:10:34,120 --> 01:10:35,120
They detect problems.

1782
01:10:35,120 --> 01:10:36,400
They evaluate responses.

1783
01:10:36,400 --> 01:10:39,440
They execute remediation continuously at scale.

1784
01:10:39,440 --> 01:10:42,080
Without human intervention, except where judgment matters.

1785
01:10:42,080 --> 01:10:45,320
The organizations that thrive will be those that reframe autonomy.

1786
01:10:45,320 --> 01:10:49,320
Not as removing humans, but as elevating humans from execution to strategy.

1787
01:10:49,320 --> 01:10:51,400
You aren't building a system to replace your team.

1788
01:10:51,400 --> 01:10:55,080
You're building a system so your team can focus on the work that actually matters.

1789
01:10:55,080 --> 01:10:56,800
The structural shift is already underway.

1790
01:10:56,800 --> 01:10:58,720
Deplication deadlines in 2026.

1791
01:10:58,720 --> 01:11:01,240
Agent 365 going general availability.

1792
01:11:01,240 --> 01:11:03,600
Power shell becoming the machine to machine language.

1793
01:11:03,600 --> 01:11:04,880
These aren't optional updates.

1794
01:11:04,880 --> 01:11:07,200
They're architectural inevitabilities.

1795
01:11:07,200 --> 01:11:10,440
The competitive advantage goes to those who understand this transition early and build

1796
01:11:10,440 --> 01:11:11,960
it intentionally.

1797
01:11:11,960 --> 01:11:16,920
By 2030, the gap between organizations that transitioned and those that didn't is decisive.

1798
01:11:16,920 --> 01:11:18,440
Not subtle, decisive.

1799
01:11:18,440 --> 01:11:22,440
nervous system is waiting. The question is, will you build it or will you be built by it?