AI agents can now sign in as your staff. Microsoft 365 lets you decide what they can touch.

Most nonprofits we work with are still settling how staff should use AI chat tools. Meanwhile the next thing has already shipped.

In seven weeks, three of the largest AI companies released personal AI agents and sold them directly to individuals:

• Grok Bot (xAI) entered early beta on August 11. Each bot runs on its own cloud computer and keeps working after you close your laptop.
• Muse (Meta) launched September 8 as a free app on iPhone, Android and the web. It connects to email, calendar, payments and shopping, and can fill out forms, send email and make purchases. It passed 2.5 million downloads in its first weeks, according to Sensor Tower.
• Dots (OpenAI) launched September 29 inside ChatGPT Pro and Business Premium plans. Each dot has its own cloud computer, can connect to more than 4,000 apps, and can be reached in Slack and Teams.

They don’t just answer questions. You connect one to your accounts, give it a task, and it does the work.

Any of your staff can sign up for one tonight on a personal account and connect it to their work email. Your AI policy may say they shouldn’t. The question for leadership is whether anything actually stops it.

With a chat tool, a person stays in the loop by default. The AI writes something, a staff member reads it, and the staff member decides whether to send it. If something goes wrong, it went wrong at a step a human chose to take.

An agent removes that step. Three things are different:

• It signs in as the person. Once connected to a mailbox or a donor database, the agent can see everything that person can see.
• It works unattended. It keeps going through meetings, overnight, or on a schedule.
• It can finish the job. It can send the message, submit the application or make the payment, not just draft it.

The upside is real. Much of a nonprofit team’s week goes to the work around the work: chasing a form, finding a meeting time, re-keying the same data into three portals. An agent that can carry those steps through could give a five-person team hours back every week. That’s worth pursuing deliberately rather than banning.

Agents will also start arriving from the outside. Your donors, applicants and volunteers are the people these products are marketed to. Expect a donor’s agent to ask for a year-end receipt, or an applicant’s agent to complete your intake form. It’s worth one staff conversation now about how you confirm a request really came from the person it names.

An agent isn’t risky because it’s capable. It’s risky when it’s bought by one person, connected by one person, and visible only to that person. That’s how most of these products reach a nonprofit: a staff member tries one at home, it saves them an afternoon, and on Monday they connect it to work. Here is what the organization loses when that happens.

• No one decided it was safe. The agent runs under the employee’s personal subscription and the vendor’s consumer terms. Nobody at the organization reviewed what the vendor keeps, how long it keeps it, or what happens to your donors’ information on its cloud computer.
• It inherits everything the employee can see. Connected to work email, it can read every donor conversation in that mailbox. Connected to a shared drive, it can reach every file that person can open, including the ones they were never meant to have.
• It works where your security can’t see. The agent runs on the vendor’s computers, around the clock. Your device protections and your IT person see none of it.
• One person sets the rules. The approval settings that keep an agent from sending or paying on its own belong to whoever set it up. Switching a category to “allow automatically” takes one tap, and nobody else will know.
• There’s no record you can check. If a donor asks why they got an odd email, or a board member asks what data left the building, the only activity log is in the vendor’s app, on the employee’s personal account.
• It reads things written by strangers. An agent that reads email and web pages also reads whatever an outsider puts there. Instructions hidden in a message can try to steer it, which is why security teams treat agents that both read untrusted content and take action with extra care.
• Access doesn’t end when the job does. A connection granted to an outside app stays in place until someone revokes it. When the employee changes roles or leaves, the agent may still be connected.

None of this needs bad intent. It’s a helpful tool, used by a well-meaning person, outside every control the organization relies on. Some vendors already draw the line themselves: OpenAI gives Enterprise and Edu workspaces access to Dots through a beta that administrators control, while individuals on the Pro plan can turn it on themselves. The answer for a nonprofit is the same. Bring agents inside the systems you already manage.

You don’t need a 20-page policy. You need two decisions, written down, that apply to every agent product, including one a staff member installs on a personal phone.

Both decisions fit in a paragraph of your existing AI guidance. The harder part is making them true.

If your organization runs on Microsoft 365, you already hold tools that turn those two decisions from guidance into guard rails. Microsoft builds the controls; they only help if someone configures and operates them.

Decision 1, enforced: decide what an agent can reach

Control who can grant access to work data (Microsoft Entra ID). When someone connects an outside app or agent to their work account, they see a screen asking them to allow it to read their mail or files. By Microsoft’s default, users can approve many of those requests themselves, including access to their own mailbox. You can change that setting so only apps from verified publishers qualify, or turn user consent off entirely, and turn on the admin consent workflow. Staff then request access with a reason, and a designated reviewer approves, denies or blocks it. That one setting is the most direct answer to “an employee connected an agent to their work email last night.”

Decide which devices and apps can open work data (Intune and Conditional Access). Conditional Access policies can require that a device meets your Intune compliance rules before it reaches email, SharePoint or Teams. For personal phones and laptops you don’t want to manage, Intune app protection policies keep work data inside approved apps such as Outlook and Microsoft Edge, and can restrict copy and paste out of them. The agent app a staff member installed on their own phone doesn’t get a path to the donor file.

See which AI apps are in use (Microsoft Defender for Cloud Apps). Before you decide anything, find out what staff already use. Defender for Cloud Apps discovers generative AI apps in use across the organization, gives each a risk score, and lets you mark them sanctioned or unsanctioned.

Protect the data itself (Microsoft Purview). Sensitivity labels classify donor, client and HR records, and labels that apply encryption mean outside AI apps can’t process the content even if it gets copied out. Purview data loss prevention can warn or block when someone tries to paste or upload sensitive information into an AI website, on managed Windows devices and in Microsoft Edge. Data Security Posture Management for AI shows where sensitive data is meeting AI tools in the first place.

Decision 2, enforced: give staff a governed agent, with a person in the loop

Saying no to consumer agents only works if staff have a good yes. Microsoft 365 Copilot and agents built in Copilot Studio run inside your tenant, under your identity, permission and data-protection settings, and Microsoft gives you the controls to govern them like staff.

Give every agent an identity and an owner (Microsoft Entra Agent ID). An agent gets its own identity in your directory, separate from the person who built it, with a named sponsor responsible for it. Conditional Access policies can apply to agents, access can be time-bound, and sign-in and audit records show what the agent did, not just what a user did.

Keep one inventory of every agent (Microsoft Agent 365). Agent 365 is Microsoft’s control plane for agents. Its registry lists the agents operating in your organization, Microsoft and non-Microsoft, so “how many agents do we have, and who owns them?” has an answer.

Build the approval step in. Copilot Studio workflows can pause and wait for a person before the next step runs. That’s decision 2 as configuration: the agent drafts the donor email or completes the grant form, and a named person approves before anything goes out.

Keep a record you can review (Purview Audit). Purview audit logs capture Copilot and Copilot Studio agent activity, including which files and messages were accessed and whether sensitive content was involved. When a board member asks what the agents did last month, you can show them.

Some of these capabilities are in the licensing many nonprofits already hold, such as Microsoft 365 Business Premium, which includes Entra ID P1, Intune and core Purview features. Others need add-on licensing. Part of the work is mapping what you already own before you buy anything.

This doesn’t need to be a big project. A sensible order:

1. Find out what’s in use. Discover the AI apps and agents staff already rely on.
2. Write the two decisions down. Which systems agents may reach; agent prepares, person sends.
3. Close the side door. Restrict user consent, turn on the admin consent workflow, and require compliant devices or protected apps for work data.
4. Label what matters most. Start with donor, client and HR data.
5. Offer the governed path. Pilot one agent inside Microsoft 365 for a real time sink, with an approval step and a named owner.
6. Report it. Review agent activity monthly, in terms you can show the board.

Our view at Centered Networks is that AI should be governed before it’s turned on. That isn’t a reason to wait. It’s how you get to say yes to agents without betting donor trust on every staff member’s judgment about every app.

Centered Networks has served mission-driven organizations since 2004 and holds five Microsoft Solutions Partner designations, including Security, Modern Work, and Data & AI. We configure and operate the Microsoft controls above for nonprofits, foundations and rural healthcare organizations: identity and device baselines, Purview data protection, and governed Copilot and agents. We work alongside your IT person or act as your IT team.

If personal agents are already on your staff’s phones, or you’d like them to be on purpose, start with a plan. Get Your 90-Day AI Roadmap and we’ll map what your current Microsoft licensing already covers, what to configure first, and where an agent could give your team time back.