Free M365 Copilot Control System (CCS) — 3 Pillars
Visual map of Microsoft's Copilot Control System (CCS) — three admin pillars (Security, Management. Free mind map.
CCS is what makes M365 Copilot enterprise-safe. Three control surfaces — Security, Management, Measurement — plus Agent 365 next door.
Last reviewed
Frequently Asked Questions
What's the difference between CCS and Agent 365?
Copilot Control System (CCS) governs the M365 Copilot product itself — what data Copilot sees, who can use it, how to roll it out, how to measure adoption. Agent 365 governs custom agents built in Copilot Studio or Foundry — discovering shadow agents, managing their lifecycle, controlling what data they connect to. They're complementary: CCS = the Copilot product surface, Agent 365 = the agent ecosystem around it.
Do I need anything beyond CCS for Copilot deployment?
For most enterprises, CCS plus standard Microsoft 365 controls (Conditional Access, Intune, Purview) is sufficient for production Copilot. The biggest pre-rollout work is permissions hygiene in SharePoint and OneDrive — Copilot sees what the user can see, so over-shared sites become information leaks. Restricted SharePoint Search, sensitivity labels, and DLP policies form the security perimeter. Agent 365 only becomes essential once your makers start building custom agents.
What's Restricted SharePoint Search?
A tenant-wide setting that limits Copilot's grounding scope to a curated allow-list of SharePoint sites + the user's personal OneDrive. Useful as a transitional control during Copilot rollout while you do permissions cleanup on the rest of the tenant. Once your SharePoint estate is clean, you can switch back to org-wide search. Microsoft positions it as 'training wheels for Copilot'.
Where does Copilot Analytics fit in?
Copilot Analytics is the measurement surface inside CCS — usage reports, active users, top scenarios, prompt-success metrics, time-saved estimates. Lives in the Microsoft 365 Admin Center plus tighter Viva Insights integration for the dollars-and-hours analytics. Use it to prove ROI to your CFO and to identify which teams need more enablement.