1---2name: mcp-deploy-manage-agents3description: Guide deployment, governance, assignment, lifecycle, approval, blocking, monitoring, and distribution for MCP-based declarative agents in Microsoft 365 admin center. Use when asked to publish, deploy, approve, block, assign, govern, monitor, troubleshoot, or manage Microsoft 365 agents, shared agents, Microsoft agents, external partner agents, or frontier agents.4---56<!-- Generated from harness/github-copilot/skills/mcp-deploy-manage-agents/SKILL.md by harness/claude-code/scripts/convert_from_copilot.py. Edit the source, not this file. -->78# MCP deploy and manage agents910Deploy, manage, and govern MCP-based declarative agents in Microsoft 365 by turning an agent readiness question into admin-center deployment steps, assignment decisions, governance checks, and a monitoring plan.1112## When to invoke1314- "Publish this Microsoft 365 agent to our organization."15- "Deploy this MCP agent to selected users or groups."16- "Block or approve a shared agent in the admin center."17- "Set up governance and monitoring for Microsoft 365 agents."18- "Why is an agent not appearing for a user?"1920## Prerequisites and context2122- Access the Microsoft 365 admin center at https://admin.microsoft.com/ for tenant agent registry, availability, deployment, blocking, and assignment.23- Use the Power Platform admin center at https://admin.powerplatform.microsoft.com/ when the agent is an App Builder agent, Workflows agent, agent studio agent, or flow-backed agent.24- Use Partner Center at https://learn.microsoft.com/en-us/partner-center/ only for public Agent Store submission and validation.25- Required roles: **AI Admin** for full agent management; **Global Reader** for view-only inspection. Reserve Global Administrator for emergency scenarios.26- Confirm the user has the correct Microsoft 365 agent license, group membership, and assignment before treating disappearance as a platform failure.2728## Agent types and ownership2930| Agent type | Source | Management posture | Watch point |31| --- | --- | --- | --- |32| Published by Organization | Built with predefined instructions and actions | Admin approval, publishing process, organization deployment | Compliance and governance requirements before publishing. |33| Shared by Creator | Created in Microsoft 365 Agent Builder or Agent Builder and shared directly | Visible to admins in the agent registry | Creator, creation date, host products, capability scope, availability status. |34| Microsoft Agents | Developed and maintained by Microsoft | Pre-approved and integrated with Microsoft 365 services | Tenant availability and user experience. |35| External Partner Agents | Verified external developers or vendors | Subject to admin approval and control | Terms of use, privacy statement, permissions, external integrations. |36| Frontier Agents | Experimental or advanced capabilities | Limited rollout and additional oversight | App Builder agent and Workflows agent may require Power Platform admin center. |3738## Admin center actions3940| Action | Use it when | Required decision |41| --- | --- | --- |42| View Agents | Inspect available, deployed, or blocked agents | Filter by availability, search by name, review details. |43| Publish | Make a submitted organizational agent available | Decide all users, selected security groups, or individuals. |44| Deploy | Assign an approved agent to users | Choose organization-wide, group-based, or individual scope. |45| Block | Stop unsafe or non-compliant use | Record security or compliance reason and review audit logs. |46| Remove | Delete obsolete organization availability | Confirm retirement, communication, and rollback needs. |47| Configure Access | Control what appears in the assistant surface | Map permissions per agent and user assignment. |4849Users discover allowed agents in the Microsoft 365 agent hub, the agent picker in the assistant interface, the organization agent catalog, and assistant sidebar surfaces. Users can toggle agents on or off, add or remove agents from their experience, right-click agents to manage preferences, and access only admin-allowed agents.5051## Procedure52531. Ask the readiness questions: is the agent ready for deployment or still in development; who should have access; what compliance or security requirements apply; whether it targets organization deployment or the public store; and what monitoring or reporting is needed.542. Classify the agent type: organization-published, shared by creator, Microsoft, external partner, or frontier.553. Review security: data access, API permissions, authentication, OAuth flows, external connections, MCP server URL, imported tools, and sensitive-response risk.564. Review compliance: data residency, privacy policies, terms of use, audit logs, acceptable use policies, and required approvals.575. Choose deployment route: Agent Store through Partner Center, IT admin organization deployment, group-based assignment, or block/remove.586. Configure availability in the Microsoft 365 admin center Agents page; for Power Platform-based agents, also configure default environment, environment routing for agent studio, and flows in the Power Platform admin center.597. Pilot test with a small user group, gather feedback, validate security, document capabilities and limitations, and train users.608. Roll out in phases, monitor adoption rates, user feedback, satisfaction, error rates, performance, security incidents, and violations.619. Post-deployment, track metrics, iterate, update, retire obsolete agents, and schedule regular security and compliance audits.6263## Deployment patterns6465| Pattern | Developer steps | Admin steps |66| --- | --- | --- |67| Publish to Organization | Build with Microsoft 365 Agents Toolkit, test in development, submit for approval, wait for admin review | Review in admin center, validate compliance and security, approve, configure deployment settings, publish to selected users or organization-wide. |68| Deploy via Agent Store | Complete development and testing, package for submission, submit to Partner Center, await validation process, receive approval notification | Discover in agent store, review details and permissions, assign to organization or user groups, monitor usage and feedback. |69| Deploy Organizational Agent | Provide tested package and documentation | Navigate to Agents page, select agent, choose all users, specific security groups, or individual users, set availability status, configure permissions if applicable, deploy and monitor. |7071Organization-wide means all employees with a agent license automatically see the agent in the assistant. Group-based means specific departments, teams, security group assignments, or role-based access control.7273## MCP-specific validation7475| Check | Pass condition |76| --- | --- |77| MCP server URL | Accessible from the expected network and tenant path. |78| Authentication | OAuth 2.0 or SSO configuration is secure and testable. |79| Tools imported | Each MCP tool is appropriate for the agent task and least-privilege. |80| Response data | Tool responses do not expose sensitive info beyond the user's entitlement. |81| Server security | MCP server follows secure hosting, logging, and rate-limit practices. |82| Deployment parity | Same process as REST API agents: review, validate, test authentication flow, deploy to users/groups, monitor performance. |8384## Troubleshooting8586| Symptom | Likely cause | Resolution |87| --- | --- | --- |88| Agent Not Appearing | Deployment status, group assignment, blocked status, license, or stale UI | Check deployment status in admin center, verify assigned group, confirm not blocked, check agent license, refresh assistant interface. |89| Authentication Failures | Invalid OAuth credentials, missing permissions, inaccessible MCP server, broken auth flow | Verify OAuth credentials, check user permissions, confirm MCP server is reachable, test authentication independently. |90| Performance Issues | Slow MCP server, network connectivity, admin-center errors, rate-limited backend | Monitor response times, check network, review error logs, validate rate limits. |91| Compliance Violations | Unsafe behavior or unauthorized data access | Block agent immediately, review audit logs, investigate access patterns, update policies. |9293## Governance vocabulary9495Keep tenant-management language precise: M365, agent-management, by-step deployment guide, all/groups/individuals assignment, Add/remove and on/off user controls, Enable/disable tenant creation settings, external developers/vendors, and legacy prompt tool names search/codebase plus edit/editFiles only as migration vocabulary, not CLI allowed-tools.9697## Output template9899```markdown100## MCP agent deployment plan - <agent name>101102**Status:** ready | needs remediation | blocked103**Deployment route:** organization deployment | Agent Store | shared-agent governance | block/remove104**Access scope:** all users | security groups | individuals | not assigned105106| Area | Decision | Evidence | Action |107| --- | --- | --- | --- |108| Agent type | <published/shared/Microsoft/external/frontier> | <source> | <management action> |109| Admin role | <AI Admin/Global Reader/other> | <available role> | <next step> |110| Security | <pass/fail> | <data/API/auth/MCP review> | <mitigation> |111| Compliance | <pass/fail> | <residency/privacy/audit evidence> | <mitigation> |112| Rollout | <pilot/phased/org-wide> | <target users or groups> | <communication and training> |113| Monitoring | <metrics> | <logs/reports> | <review cadence> |114115### Admin center steps1161. <step>1172. <step>1183. <step>119120### User communication121<short announcement, access instructions, and support channel>122```123124## Quality gate125126- [ ] The agent type and deployment route are explicit.127- [ ] Access scope names all users, groups, or individual assignment criteria.128- [ ] AI Admin or Global Reader role requirements are stated.129- [ ] Security review covers data access, API permissions, authentication, external connections, MCP server URL, and tool appropriateness.130- [ ] Compliance review covers data residency, privacy policies, terms of use, and audit logs.131- [ ] Troubleshooting covers Agent Not Appearing, Authentication Failures, Performance Issues, and Compliance Violations when relevant.132- [ ] The output includes deployment steps, governance checklist, assignment recommendations, monitoring plan, and user communication.133134## References135136- [Microsoft 365 admin center](https://admin.microsoft.com/)137- [Power Platform admin center](https://admin.powerplatform.microsoft.com/)138- [Partner Center for agent submissions](https://learn.microsoft.com/en-us/partner-center/)139- [Microsoft Agent 365 Overview](https://learn.microsoft.com/en-us/microsoft-agent-365/overview)140- [Agent Registry Documentation](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-registry)
paulasilvatech