You heard / you saw
- "A couple of our program offices are piloting Copilot Studio agents."
- A reference to the OneGov deal, "free Copilot," or new G5 entitlements during a QBR.
- "Business teams are building their own agents now. It's part of the AI use case inventory."
- An agency modernization brief listing Copilot Studio or Agent Builder alongside automation goals.
What's actually happening
The OneGov/GSA agreement gave M365 G5 users free Copilot access for up to 12 months starting September 2025. Since April 2026, Microsoft has expanded Copilot Studio into GCC and GCC-High, which means business teams can now build and publish AI agents inside the government cloud. Microsoft's own security documentation shows that agent makers can select "No authentication" when building agents. Warnings appear, but they don't block publishing. Admin data policies can enforce authentication at scale, but that requires active configuration by the security team. Agencies running Copilot Studio pilots routinely have agents in production before anyone has reviewed their authentication posture.
Ask these
-
How many Copilot Studio agents are live in your environment today, and does your security team have visibility into each one's authentication configuration? (If they can't answer the count, the governance gap is confirmed.)
-
Who approves an agent before it goes live — the program office that built it, or a centralized security review? (Tells you whether agent creation is governed or ad hoc. Most agencies are still ad hoc.)
-
Are your admin data policies configured to enforce authentication on all Copilot Studio agents, or is that still on the roadmap? (Microsoft's own docs say this is opt-in. If they haven't done it, agents may be running unauthenticated.)
-
When these agents access SharePoint or internal data stores, are they authenticating as the maker or as the end user? (Surfaces credential inheritance risk. Agents acting with the maker's permissions for every user is a finding waiting to happen.)
-
If you adopt agents from platforms beyond Microsoft next year, who governs identity across all of them? (Opens the multi-platform governance conversation. Don't pitch here. Just listen.)
Say this / Don't say this
| Say this | Don't say this |
|---|---|
| "Microsoft built governance controls into Copilot Studio, but they require your admins to actively configure them. The risk is what happens before that configuration is in place." | "Okta for AI Agents is FedRAMP authorized." — Not confirmed. Verify with your SE and federal team before making any claim in a procurement conversation. Full stop. |
| "Okta Identity Governance and Okta Workflows are FedRAMP High authorized today. They give you the governance foundation — lifecycle management, access policies, and workflow automation — that extends across your identity environment, not just within one vendor's ecosystem." | "Microsoft's agent security is broken." — It's not. Microsoft documents the risks and provides controls. The gap is configuration and centralization — the controls exist, most agencies haven't enforced them. Overstating this costs you credibility with any buyer who knows the platform. |
| "If Microsoft is your only agent platform forever, their bundled governance may be enough. Most agencies won't stay single-platform for long. A vendor-neutral governance layer gives you visibility across every agent platform you adopt, including the ones that come after Microsoft." | "Agent 365 doesn't include real governance." — It includes Entra Agent ID for Microsoft agents at $15/user/month. The limitation is ecosystem scope. Frame the gap as coverage across platforms, where a single vendor's bundled tools stop providing visibility. |
Okta for AI Agents went GA April 30, 2026, but no FedRAMP authorization has been publicly announced. OIG and Workflows are FedRAMP High authorized. If the buyer asks about AI Agents' authorization status, that is your SE handoff trigger — do not speculate.
Proof point
NIST's Center for AI Standards and Innovation found that novel attack techniques against AI agents achieved an 81% task-hijacking success rate, compared to 11% for known baseline attacks, in joint research with the UK AI Security Institute. (January 2025. Tested against a single model in a controlled environment. Say "NIST research demonstrated" — do not characterize this as a universal vulnerability rate.)
What happens next
- If the buyer confirms agents are live but security hasn't reviewed authentication configurations: Qualified opportunity. Propose a 30-minute technical session with your SE to map their agent inventory against their identity governance posture. Position it as a risk assessment. Lead with their agent inventory and exposure, then let the SE bring product into the conversation. Frame the calendar invite as "Copilot Studio Agent Identity Review" — that language lands with security teams.
- If the buyer asks about Okta for AI Agents' FedRAMP status or availability in their government cloud: This is your handoff trigger. Do not speculate. Tell them you'll get a definitive answer from your federal team within 48 hours and loop in your SE immediately.
- If the buyer says Microsoft is handling agent governance through Entra and they have no plans for agents outside the Microsoft ecosystem: Not your conversation today. Note the account for follow-up when multi-platform agent adoption surfaces. That signal reopens it.
Things to follow up on...
- Copilot Studio prompt injection CVE: Microsoft patched CVE-2026-21520 in January 2026 after researchers demonstrated that injected payloads could override agent instructions and exfiltrate data via Outlook — even though Microsoft's own safety mechanisms flagged the request as suspicious.
- NIST agent identity standards project: The NCCoE published a concept paper in February 2026 proposing a demonstration project for AI agent authentication and authorization using OAuth 2.0, SPIFFE/SPIRE, and MCP — the federal compliance scaffolding that will eventually attach to agent deployments.
- OneGov free Copilot expiration: The GSA agreement offered free M365 Copilot for G5 users for up to 12 months from September 2025, meaning agencies face a renewal decision around September 2026 that could reshape their agent licensing posture.
- GCC-High feature parity gaps: While Agent Builder is confirmed in GCC-High, the newest Copilot Studio capability — computer-use agents — is explicitly excluded from sovereign clouds including GCC and GCC-High, a parity lag worth tracking for accounts planning advanced agent deployments.