MP.AIGOV.1020 Custom agent or tool that nobody uses should be blocked or removed

Copilot AI Governance

Findings for how AI agents, agent identities, and the Copilot agent catalog are governed in Microsoft 365: sponsor/owner coverage, unused agents and tools, assignment-group ownership, broad Graph write permissions on agent identities, unclear agent and blueprint names, classic Copilot Studio servic…

By chadmcox · Version 0.7.1 · Published 11 Nov 2026

MP.AIGOV.1020 Custom agent or tool that nobody uses should be blocked or removed

Severity: MediumGraph

[!NOTE] Validated 2026-11-09 against a real Microsoft 365 test tenant, via an actual Invoke-Maester run. The run correctly Failed (true positive): one custom agent ("Vani") was never used and hadn't been modified in over 180 days. The package-detail activeUsers and lastUsedDateTime properties read and typed as expected.

Finds custom or external agents and tools in the Copilot catalog that nobody uses: not blocked, no active users in the last 30 days, last used more than StaleDays ago (or never), and not changed in StaleDays. StaleDays defaults to 180, matching Maester's own dormancy tests; 90 is a stricter option. Microsoft-published packages and App-kind packages (Office add-ins, tabs) aren't checked.

Unused agents and tools keep their permissions and data access. Blocking or removing them shrinks what a compromise or a mistake can reach.

Remediation action

Confirm with the owner that the agent or tool isn't needed, then block it in the Microsoft 365 admin center (Agents > All agents) or remove it.

Copilot AI Governance

`MP.AIGOV.1020` Custom agent or tool that nobody uses should be blocked or removed

Remediation action

Related links