Users can see Copilot agent in "Built by your org" but cannot add it unless explicitly granted Viewer access

Question

Users can see Copilot agent in "Built by your org" but cannot add it unless explicitly granted Viewer access

Ermal Haka 20

Issue

The agent has been successfully published.

"Show to everyone in my organization" is enabled.

The agent appears under "Built by your org" for all users.

The agent status shows "Available in App Store".

Affected users have valid Microsoft 365 Copilot licenses and can use Copilot normally.

However, when users attempt to add the agent, they receive the following error:

"You don't have permissions to add this agent. Please contact your IT admin for help."

Troubleshooting performed

Verified the agent is published and available to the organization.

Verified affected users can see the agent in the store.

Verified affected users have the required Copilot licenses.

Tested from both Microsoft 365 Copilot and Microsoft Teams.

Enabled "Show to everyone in my organization".

Tested with End user access.

Republished the agent multiple times.

Verified authentication is configured with Microsoft Entra ID.

Key findings

When a user is explicitly added to the agent as a Viewer:

The user can successfully add the agent.

The user can use the agent without any issue.

Once the explicit Viewer permission is removed and access relies only on "Everyone in organization", the issue returns immediately.

Additional observation

The issue is not limited to this specific agent. We have observed the same behavior with other agents available under "Built by your org".

This suggests the issue may be related to tenant-wide access controls, organizational sharing permissions, or a platform-level issue affecting organizational Copilot agents rather than a specific agent configuration.

Could you please advise whether there are known restrictions, tenant settings, or service issues that could cause users to see organizational agents but be unable to add them unless they are explicitly assigned access?

Ermal Haka 20 Reputation points

2026-08-03T14:14:16.3266667+00:00

Here's what the view from admin side :
Ermal Haka 20 Reputation points

2026-08-03T14:20:52.7466667+00:00

The issue is reproducible and isolated to organization-wide sharing. The same user cannot add the agent when access is granted through "Everyone in organization", but can immediately add and use the agent once explicitly assigned as a Viewer. This demonstrates that agent publication, licensing, authentication, and app store visibility are functioning correctly, while organization-wide permission assignment is not being honored.

Answer accepted by question author

0 additional answers

Your answer

Ermal Haka 20 Reputation points

2026-08-03T14:14:16.3266667+00:00

Here's what the view from admin side :
Ermal Haka 20 Reputation points

2026-08-03T14:20:52.7466667+00:00

The issue is reproducible and isolated to organization-wide sharing. The same user cannot add the agent when access is granted through "Everyone in organization", but can immediately add and use the agent once explicitly assigned as a Viewer. This demonstrates that agent publication, licensing, authentication, and app store visibility are functioning correctly, while organization-wide permission assignment is not being honored.

Answer 1

The behavior matches an access-control issue rather than a publishing issue.

Supported facts from the documented behavior:

Visibility in the store and actual usage access are separate controls. An agent can appear in Built by your org / Built for your org after admin approval, but access and use are still governed by tenant admin controls and sharing settings.
Tenant admins can restrict who can access agents. In the Microsoft 365 admin center under Agents > Settings > User access, admins can allow:
- All users
- No users
- Specific users/groups
If this is set to Specific users/groups, users can see agents in the registry or store experience, but only the selected users or groups can actually use them.
Org-wide sharing can also be restricted by admin policy. Admins can control who is allowed to share agents with the organization:
- All users
- Specific users or groups
- No users
When org-wide sharing is disabled, the Anyone in your organization option is restricted for new sharing actions.
Direct assignment working as Viewer is consistent with the platform behavior. Sharing an agent directly with users or groups adds them to the people with access list, and those users can then view/test or use the agent depending on the sharing mode. That aligns with the symptom where explicitly adding a user immediately resolves the error.
Licensing can also block use of an agent even when the agent is shared. Users must have the Microsoft 365 Copilot license required for the capabilities configured in that agent. If the license doesn’t match the agent capabilities, attempts to use the agent can result in an error.

Based on the scenario, the most likely checks are:

In Microsoft 365 admin center → Agents → Settings → User access, confirm the tenant is set to All users or that the affected users/groups are included in Specific users/groups.
Verify the affected users are in any required allowed group if Specific users/groups is configured.
Confirm the agent’s capabilities match the users’ available Microsoft 365 Copilot licensing.
If immediate access is required, continue assigning the affected users or groups directly to the agent as a workaround, since direct sharing is behaving as expected.

If the agent is visible in Built by your org, users can use other org agents, and only explicit Viewer assignment makes this specific agent usable, the strongest documented explanation is that effective access is being limited by agent access/sharing controls rather than by publication status.

References: