Roles and permissions to monitor Copilot and agents in Microsoft 365

In my previous post How to monitor Microsoft 365 Copilot and agents usage in your organization, i have shared about Copilot and Agents usage details, i got some valuable feedback along with the minimum permissions required for those roles and how to view user names in usage reports.

This is the similar scenario when I set up Copilot monitoring for a client, the first request from their service desk was “just give us Global Reader”. Global Reader isn’t on Microsoft’s current list of roles for the usage reports, and it’s far more access than a reporting team needs anyway. Here is what each monitoring task actually needs, checked against Microsoft Learn in October 2026.

Roles in the Microsoft 365 admin center

The usage reports and the Agents pages use different role lists. That’s the part people miss.

Microsoft Learn’s current list of roles for usage reports is Global Administrator, Exchange Administrator, SharePoint Administrator, Usage Summary Reports Reader, Reports Reader, Teams Administrator, Teams Communications Administrator, User Experience Success Manager and AI Administrator. Older versions of that page also listed Global Reader (with no user details). The live page no longer does. To verify this i have tested with user with Global Reader role, the usage report still showing some details but usage details was empty as shown in below screenshot.

AI Reader is not on the usage report list either. So a monitoring account normally needs two roles: Reports Reader for the reports and AI Reader for the Agents pages. I prefer that pair over AI Administrator, because a reporting account should never be able to approve or block an agent.

Product admins only see their own product. A Power Platform Administrator can govern Copilot Studio agents in the Power Platform admin center, not the tenant-wide Agents Registry.

Assign the roles in Microsoft 365 admin center

1. Sign in to the Microsoft 365 admin center as a Privileged Role Administrator or Global Administrator.
2. Select Roles > Role assignments.
3. Search for AI Reader and select it.
4. Select Assigned > Add users, pick the monitoring account and select Add.

5. Repeat for Reports Reader. Now you can start seeing User details with minimum access.

If you use Privileged Identity Management, make these eligible assignments with a reason, not permanent ones.

Show user names in usage reports

User names in every usage report are hashed by default. Only a Global Administrator can change this.

1. In the admin center, select Settings > Org settings.
2. On the Services tab, select Reports.
3. Clear Conceal user, group, and site names in all reports.
4. Select Save.

Now if you recheck the Copilot usage details again it is now showing Display name and Username/email

The setting also applies to the same reports in Microsoft Graph, Power BI and the Teams admin center, and the change is recorded in the Purview audit log. Get sign-off from whoever owns privacy before you clear it.

Purview audit and Power Platform

For per-prompt detail in the Purview audit log, the account needs the View-Only Audit Logs or Audit Logs role in the Microsoft Purview portal. Entra roles alone don’t cover this. The simplest route is the built-in Audit Reader role group, which can search and export but can’t switch auditing off. Add the account in Purview under Settings > Roles and scopes > Role groups > Audit Reader. Skip Audit Manager for a reporting account, since it can change audit settings.

Agent risk links behave differently. Purview Insider Risk Management alerts on an agent need IRM Analyst or IRM Investigator. Learn states that Global Administrator alone isn’t enough.

For the Copilot Studio inventory in the Power Platform admin center (Manage > Inventory), AI Reader or AI Administrator see agents, agent flows and environments only. Power Platform Administrator or Global Reader see everything, including apps and cloud flows. The Power Platform security roles (Environment Admin and so on) don’t work for this page.

Permissions for the PowerShell script

The Get-CopilotAgentUsage.ps1 script from part 1 signs in with Microsoft Graph PowerShell (Connect-MgGraph) and only reads data. It asks for these delegated permissions:

The signed-in account needs AI Administrator (or Global Administrator). This is the one place I don’t use the reader pair from above, because Learn names only those two roles for the agent list API. AI Administrator also opens the usage reports, so one role covers both calls. I’d assign it through PIM and activate it only when you run the script.

Expect an admin consent prompt the first time you run it with these scopes.

Note: the agent list API (/copilot/admin/catalog/packages) needs a Microsoft Agent 365 licence in the tenant. Without it, the script shows a warning and still writes the usage CSV.