Microsoft Entra ID · Viva & Employee Experience
AI Administrator
Manage all aspects of Microsoft 365 Copilot, Microsoft Agent 365, and AI-related enterprise services including extensibility and copilot agents. Has tenant-wide visibility and full governance authority over agents in the Microsoft 365 admin center.
Scope: Full administrative control over Microsoft 365 Copilot, Microsoft Agent 365, and AI services tenant-wide
Permissions
- Manage Microsoft 365 Copilot settings
- Manage AI-related enterprise services
- Approve and publish copilot agents
- Install, modify, approve, and manage agent configurations in Microsoft 365 admin center (Agent 365)
- View the complete agent inventory across Copilot Studio, SharePoint, Agent Builder, AI Foundry, and connected platforms
- Approve pending agent requests and manage agents without owners
- Configure extensibility settings
- Manage integrated apps for AI
- View usage reports and adoption insights
- Create and manage support tickets
Common use cases
- Copilot deployment and configuration
- AI agent governance via Microsoft Agent 365
- Approving agent requests and assigning agent ownership
- Reviewing publisher attestation and Microsoft 365 Certification on agents
- Copilot extensibility management
- AI usage monitoring
- Plugin and connector approval
- AI adoption tracking
Best practices
- Define AI governance policies first
- Review and approve agents carefully
- Monitor Copilot usage patterns
- Configure data access appropriately
- Train users on responsible AI use
- Document approved extensions
Security considerations
- This is a PRIVILEGED role - controls AI data access
- Copilot can access organizational data
- Agent extensions may have data permissions
- Monitor for data exposure risks
- Consider data residency implications
Common questions
When should I assign the AI Administrator role?
Assign AI Administrator when you need to: Copilot deployment and configuration; AI agent governance via Microsoft Agent 365; Approving agent requests and assigning agent ownership; Reviewing publisher attestation and Microsoft 365 Certification on agents; and Copilot extensibility management. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the AI Administrator role do?
The AI Administrator role grants permissions including: Manage Microsoft 365 Copilot settings; Manage AI-related enterprise services; Approve and publish copilot agents; Install, modify, approve, and manage agent configurations in Microsoft 365 admin center (Agent 365); View the complete agent inventory across Copilot Studio, SharePoint, Agent Builder, AI Foundry, and connected platforms; and Approve pending agent requests and manage agents without owners. See the Permissions section above for the full list.
What are the security risks of the AI Administrator role?
Key considerations when assigning AI Administrator: This is a PRIVILEGED role - controls AI data access; Copilot can access organizational data; Agent extensions may have data permissions; and Monitor for data exposure risks. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.