* Vendor-supplied and unaudited.

Srini Raghavan, Corporate Vice President of the Microsoft 365 Copilot Ecosystem, published the Agent Store announcement on April 13 with a premise worth taking seriously. The problem he named is real: AI has made it dramatically easier to generate insights, but acting on those insights still requires leaving the tool that generated them. A marketer drafts a campaign brief in Copilot, then opens a design application to build the asset, then returns to Copilot to revise the copy. The insight lives in one place. The action belongs somewhere else. Each context switch requires rebuilding mental state. At enterprise scale, that friction compounds into measurable drag.

The Agent Store is Raghavan's answer to that problem. Ten launch partners — Adobe Express, Figma, Box, monday.com, Miro, Coursera, Optimizely, Wix, Base44, and Dynamics 365 — now surface their interfaces and execute actions directly inside a Copilot chat thread. The brief becomes the asset without a tab switch. The board update happens without opening another application. Intent becomes execution in the same window where the conversation started.

That productivity premise is sound. What the announcement does not fully address is what happens when organizations take the same logic and run it outside the store entirely.

The back door is open by design

The Agent Store integration framework runs on the Model Context Protocol, or MCP, an open standard that any developer can implement. Microsoft's own documentation encourages external builders to do exactly that. The store creates a curated front door with quality and security requirements. The protocol creates a back door with no equivalent bar.

This is not a design flaw. Open protocol adoption is how Microsoft builds ecosystem scale. It is, however, a governance gap that most enterprise IT organizations have not priced in. The agents a line-of-business team builds this quarter, pointing at Copilot through MCP without IT involvement, will not arrive in the Agent Store. They will arrive in production.

Microsoft Agent 365, the control plane embedded in the new Microsoft 365 E7 bundle launching May 1, is designed to surface those agents in the IT admin console. Visibility, though, is not governance. Knowing an agent exists and having the policy architecture to control its behavior are different capabilities. Most organizations have the first. Few have built the second.

The Agent Store raises the floor on sanctioned agents. It does nothing about the ceiling on agents no one sanctioned.

Adobe built the model. Most partners have not.

At Adobe Summit 2026, the keynote made something explicit that the Agent Store announcement left implicit: Adobe's integration into Copilot requires human approval before any agent action executes. Not as a user preference. As an architectural commitment. The agent can generate, preview, and propose. A person confirms before anything is written or published.

That design choice is not accidental and it is not simple. It requires Adobe to build approval state into the integration layer, to handle cases where approval is declined or deferred, and to ensure the agent does not route around the confirmation step as the workflow grows more complex. Adobe has the engineering depth and the regulatory awareness from its content authenticity work to build that. It built it.

The question worth asking about the other nine launch partners is whether they have made the same commitment or whether human-in-the-loop is an option in their implementation rather than a requirement. The store does not publish that information. CIOs should ask before their teams start using these integrations at scale.

The harder question is what happens outside the store entirely.

Agent slop is a shadow IT problem at agent speed

The concern about agent proliferation — too many agents, too little oversight, outputs that no one can trace back to a decision — is not hypothetical. Every organization that has given developers and business analysts access to a large language model platform in the last two years has already experienced a version of it. Agents make it faster and less visible.

Shadow IT accumulated over years because spinning up an unsanctioned SaaS tool required a credit card and a browser. Shadow agents accumulate faster because they require only a prompt and an API key. The organizational risk is the same — ungoverned data access, no audit trail, no remediation path when something goes wrong — but the velocity is higher and the surface area is larger.

I have been tracking this dynamic since the early days of Amazon Connect deployments, when contact center teams stood up call flows weeks before IT knew the integration existed. The pattern is identical. The tools get easier. The governance conversation gets harder.

The Agent Store, at its best, is a counter-pressure to that dynamic. It says: here is a set of agents that have been vetted, integrated under known terms, and given a governance layer through Agent 365. Use these. Adobe's human-in-the-loop standard is what that counter-pressure looks like when a serious vendor takes it seriously.

The store cannot enforce that standard on agents built outside it. Only enterprise policy can do that — and policy requires IT leadership to define what an acceptable agent looks like before the business teams have already deployed fifty of them.

A practical note on the experience of writing this post. I attempted to generate the header image using Microsoft Copilot's image tools. I could not complete it. Repeated Cloudflare security challenges blocked access, each asking me to confirm I was human. The irony is not subtle. An AI governance conversation, interrupted by an AI gatekeeping system that could not resolve whether the person trying to use it was a person. If that is the current state of the human-in-the-loop experience on Microsoft's own surface, the gap between the governance architecture Raghavan described and what enterprises will actually encounter is worth a direct conversation with Microsoft's product team.