Your Copilot Agents Are Live. Who's Governing Them?
If you turned on Copilot agents in Dynamics 365 this year, in Sales, Customer Service, or Field Service, the evaluation phase is over. An agent is qualifying leads, drafting case responses, or proposing technician schedules right now, today, without anyone reviewing every action it takes. That shift, from testing agentic AI to depending on it, is exactly where the trouble starts, according to Gartner's June 2025 prediction.
In June 2025, Gartner predicted that more than 40 percent of agentic AI projects will be cancelled by the end of 2027, and the reasons it gave were not about what the models could do. Back in August, we wrote about what agentic AI readiness looks like before you turn an agent on. This is the harder question for organizations already past that point. Who is actually governing the Copilot agents you already have running, and what happens if the honest answer is nobody?
What Gartner's 40% cancellation prediction actually says
The prediction is precise enough to be worth quoting directly. Gartner said more than 40 percent of agentic AI projects will be cancelled by the end of 2027, due to escalating costs, unclear business value, or inadequate risk controls. Anushree Verma, Senior Director Analyst at Gartner, put it this way: "Most agentic AI projects right now are early stage experiments or proof of concepts that are mostly driven by hype and are often misapplied. This can blind organizations to the real cost and complexity of deploying AI agents at scale, stalling projects from moving into production."
None of Gartner's three stated causes are about model capability. They are about how the organization runs the agent once it exists: whether costs were scoped honestly, whether the business case was ever measured against a baseline, and whether anyone put controls around what the agent is allowed to do. Gartner's own January 2025 poll of 3,412 webinar attendees found only 19 percent of organizations had made significant investments in agentic AI, with 42 percent investing conservatively, 8 percent making no investment at all, and 31 percent still watching and waiting. Most agentic AI deployments today are still early, which means most organizations still have time to fix this before their project becomes part of the 40 percent.
The two failure modes that are governance problems, not technology problems
Strip Gartner's three causes down and two governance failures do most of the damage. The first is the agent with no named owner. An agent gets stood up in Copilot Studio or added to a Dynamics 365 workflow, it works well enough that nobody revisits it, and six months later no single person can say who is accountable for what it touches or whether its access should be narrower than it is.
This is the same failure mode identity teams have fought with service accounts and API keys for a decade, just wearing new branding. An unowned agent does not get shut down when it starts drifting. It gets discovered, usually after something has already gone wrong.
The second is the agent with no review cadence. A project launches with a business case, the agent goes live, and nobody comes back to check whether it delivered what the business case promised or whether its scope quietly expanded along the way. Costs creep as usage climbs, the original ROI math never gets revisited, and by the time finance asks hard questions, there is no data to answer them with.
Both failure modes are entirely fixable with process, not more sophisticated AI. That is also why they are easy to overlook. Neither shows up as a technical bug, and neither will surface in a demo.
What "shadow agents" are, and why they're the new shadow spreadsheet
Every finance and operations leader already knows the shadow spreadsheet problem: a critical calculation or process lives in a workbook one person built and maintains, nobody in IT knows it exists, and the business quietly depends on it anyway. Shadow agents are the same pattern with more reach. A shadow agent is an AI agent, built in Copilot Studio, configured inside a Dynamics 365 workflow, or connected through a low-code tool, that a business user set up to solve a real problem without IT ever approving, reviewing, or logging it. Unlike the spreadsheet, it can read customer records, send messages, and update data on its own.
The scale of this is not hypothetical. Gartner projects that shadow AI will be a contributing factor in 40 percent of enterprise AI failures by 2027, and separately expects 40 percent of enterprise applications to include task-specific AI agents by the end of 2026, up from less than 5 percent in 2025. That means the population of agents inside a typical Dynamics 365 tenant is about to grow far faster than most governance processes are built to track. A shadow spreadsheet can produce a wrong number. A shadow agent with write access to your CRM or ERP data can produce a wrong action, at machine speed, before anyone notices.
What Microsoft's Agent 365 and Entra Agent ID do, and don't, solve for you
Microsoft's own response to this problem is itself a signal that the gap is real. Microsoft Agent 365 reached general availability on May 1, 2026, positioned as a control plane to observe, govern, and secure AI agents across Microsoft and partner ecosystems from one place. The usage estimator underneath it already covers Dynamics 365 agents by name, including the Sales Qualification Agent and Customer Service Agent, so an organization running those agents can, for the first time, see them alongside every other agent in the tenant rather than treating them as a Dynamics 365-only concern. Underneath Agent 365 sits Microsoft Entra Agent ID, which gives each agent its own identity object rather than borrowing a shared service account, and requires that identity to carry a named human sponsor accountable for its access and lifecycle. When that sponsor leaves the organization, sponsorship transfers automatically to their manager, which closes off the most common way governance breaks down: the agent nobody remembers owning.
What this platform does not do is decide any of this for you. It gives you the tooling to name a sponsor, but it will not tell you which person in your organization should hold that job for the Customer Service Agent. You get a place to see every agent in the tenant, though someone still has to look at that list on a schedule and act on what they find.
Several of the more advanced controls, including Conditional Access and Identity Protection for agents, sit behind Entra ID P1 or P2 licensing that not every mid-market organization already carries, and agents built before this year may need manual review to confirm they picked up a proper identity rather than the older, less governed setup. Agent 365 and Entra Agent ID are real infrastructure improvements. They are not a governance program, and treating them as one is how an organization ends up with excellent tooling and the same unanswered questions about ownership it had before.
A short governance checklist: inventory, ownership, permissions, review cadence
Inventory. List every Copilot agent running against your Dynamics 365 environment, including ones built by business users in Copilot Studio that IT did not commission. If a row on that list cannot be completed today, that gap is the first thing to close, not a detail to fill in later.
Ownership. Assign a named person, not a department, as the accountable sponsor for every agent on that list. "IT owns it" is not an answer, because IT rarely has the business context to know whether an agent's access or behavior still matches what it was approved for.
Permissions. Review what each agent can actually read, write, and send, and compare it against what it was scoped for at launch. Agent access tends to expand quietly as new use cases get bolted onto an existing agent instead of prompting a new review.
Review cadence. Put a recurring date on the calendar, monthly or quarterly depending on how many agents you run, to revisit the inventory, confirm ownership is still current, and check usage against the original business case. A governance checklist that only gets read once, at launch, is not governance.