Agents Users Build

An agent a user builds answers with the access of the person asking and adds none. What it can still do is draw on more than its builder intended, run code in Microsoft's sandbox, and, where sharing exists, reach other people. This chapter covers the builder's choices, the administrator's four settings, and the scenario to design for.

In GCC High

Every row below is a documented claim until a tenant check turns it into an observation. The basis column says which, and when.

Control	GCC High	Basis
Agent Builder (New agent in Copilot Chat)	Different Available; the administrator must grant User access first.	Documented 2026-10-05
Sharing an agent with other users	Not available	Documented 2026-10-05 ("Sharing agents with others isn't available in Agent Builder in GCCH environments.")
Publishing an agent to the organization (administrator approval)	Available	Documented 2026-10-05
Embedded files as agent knowledge	Undocumented	Documented 2026-10-05 (the page names GCC only)
Code interpreter in Agent Builder agents	Different Available to users with a Microsoft 365 Copilot license.	Documented 2026-10-05
Image generator in Agent Builder agents	Not available	Documented 2026-10-05
SharePoint agents	Not available	Documented 2026-10-08 (Not currently available)
Copilot connectors as agent knowledge	Different External connections and partner connectors are not enabled by default.	Documented 2026-10-08 (footnote 9)

#	Where to look	Microsoft documents	If the tenant disagrees
1	Copilot Chat, as a user granted Agent Builder access: the New agent entry, and inside the builder any Share option or Actions section	Agent Builder present; sharing "isn't available" in GCC High; no actions in Agent Builder in any cloud	Share present: the sharing controls move from the watch list into configuration. Actions present: a connector review.
3	A SharePoint site (GCC High): an agents entry in the site or library command bar	SharePoint agents "Not currently available" in GCC High	A second user build path exists; add it to the user-access requirement and to audit.
6	Agent Builder Configure tab: an upload option for embedded files	Unsupported in GCC; silent on GCC High	The embedded-file rules apply: the highest label gates installation through the EXTRACT right; add them to the reading-gate test.
7	An agent grounded on a Restricted Content Discovery site: whether that site's files appear in responses	Silent	If they appear, Restricted Content Discovery does not protect agent knowledge.
9	An Agent Builder agent's Configure tab: the Create documents, charts, and code setting, and whether it can be turned off. Then ask the agent to chart a short list of numbers	Code interpreter is always enabled in Agent Builder; in GCC High it needs a Microsoft 365 Copilot license	If the agent runs code, the sandbox limits apply. If the builder can turn the setting off, add that to the builder guidance.