> ## Content Index > Fetch the complete content index at: https://www.aicoenews.com/llms.txt > Use this file to discover other available public pages before exploring further. # Microsoft splits network agents' information access from execution - URL: https://www.aicoenews.com/microsoft-splits-network-agents-information-access-from-execution-8/ - Published: 2026-10-06T16:23:58.000Z - Updated: 2026-10-06T16:23:58.000Z - Description: Microsoft says its internal network operations agents separate broad informational queries from execution limited to authorised engineers on secure… - Author: JJ Rooney - Tags: agentic AI governance, enterprise AI governance, AI operations, Microsoft Microsoft's IT organisation has described how it runs AI agents in its internal network operations using tiered access. Informational prompts are open to a broad audience. Executional prompts are restricted to authorised engineers on secure admin workstations. Ticket handoffs to partners require human approval. The account appears on Microsoft's [Inside Track blog](https://www.microsoft.com/insidetrack/blog/from-alerts-to-action-how-ai-agents-are-reshaping-network-operations-at-microsoft/), so it is a vendor describing its own deployment. The capabilities and results below are Microsoft's own claims and have not been independently verified. For leaders building an AI CoE operating model, the case matters less for its network tooling than for its design choice. Microsoft matched each agent's permissions to the risk of the action, rather than giving every agent the same level of access. ## Who owns the work and how the agents were chosen Connectivity for Microsoft's internal network is managed by Microsoft Digital, the company's IT organisation. Microsoft says the environment spans more than 900 sites, 500 datacenters, more than 75,000 devices, over 300,000 users and more than 1 million connected endpoints. The post states plainly why access had to be deliberate: we can't let just anyone log in to network devices or run changes in a secure environment. According to Microsoft, the team reviewed ticket volume and manual effort across the incident lifecycle. It then ranked agent opportunities by impact, user need and development effort. The first set of agents targeted three problems: dynamic troubleshooting, cross-system handoffs and outage communications. Microsoft built them with Azure OpenAI, Microsoft Foundry, Microsoft Agent Framework, Copilot Studio and Teams, and integrated them into its internal incident management (ICM) tool. ## Three agents, three kinds of control | Agent | Role, per Microsoft | Control described | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Falcon Agent | On-demand troubleshooting: refreshes diagnostics, retrieves logs, checks device reachability, validates restoration, enriches tickets | Executional prompts limited to the right engineering users on secure admin workstations (SAWs); informational prompts available more broadly without device-level control | | Smart Bonding Agent | Coordinates handoffs to internal teams, datacenter operations, telecoms providers and device vendors when remote fixes are not possible | Human approval required by design | | Network Outage Insights Agent | Sends targeted Teams notifications to affected IT managers and answers natural-language questions about outages | Informational; no execution role described | Falcon Agent adds an on-demand layer on top of Falcon, Microsoft's existing automation for known scenarios such as access-point-down incidents. Under Falcon, a service line defines a scenario's troubleshooting steps once, and repeat tickets are then handled without a directly responsible individual rerunning the same steps. The agent is meant to address stale results when an engineer picks up a ticket after Falcon has already run. It is available in both Teams and the ICM tool, with controls kept in place in either channel, according to Shayoni, a product manager for Falcon. On partner handoffs, Microsoft says human approval is intentional: We don't want to reduce one team's work by flooding a partner with unnecessary tickets. The post says lower-risk workflows can move toward more automation as confidence improves, but it does not define how that risk is assessed. The agent currently covers Global Datacenter Operations and Puget Sound Network Operations, and Microsoft says expansion is underway. The post refers to several flows within the agent, but the text reviewed does not list them. ## What Microsoft reports so far Microsoft says the measurable impact is still emerging. The figures it gives are: - Falcon Agent users report saving around 300 hours in the first few months, which Microsoft equates to 10–15 minutes per ticket. Microsoft also reports a 60% retention rate and 100% positive user feedback, without describing how either was measured. - Falcon, the underlying automation rather than the agent alone, handles about 60% of total incident volume. Microsoft expects that share to reach about 80% as more scenarios mature. - The Network Outage Insights dashboard recorded 149 outages in one month, with 32 hours saved on communications and reporting. Microsoft also says monthly tickets requiring human intervention peaked at about 70,000 in January 2025\. It says that figure fell to about 27,000 18 months later. Microsoft credits this drop to automation and AI in general. The post does not attribute it to these agents specifically, and it should not be read as their effect. ## Orchestration is a roadmap, not current deployment Microsoft describes linking the agents as a next step. In planned flows, Smart Bonding would engage the right party, Falcon Agent would validate the fix, outage insights would communicate status, and a post-incident agent would draft the postmortem. The future is multi-agent orchestration, said Raghavendran Loganathan, a principal software engineering manager in Microsoft Digital. None of this is described as operating today. ## What governance leaders should check **Analysis:** Microsoft's suggested pattern is to start with repeat work, place agents where people already operate, keep humans in the loop where actions carry risk, and measure whether behaviour changes. That maps onto familiar questions in agentic AI governance. However, the post leaves key operating details unstated: - Who grants the human approvals for partner handoffs, and against what criteria. - How the SAW restriction on executional prompts is enforced when the agent is reached through Teams. - What audit trail is kept of agent actions. - What evidence would justify moving a workflow to more automation. - How the time-saving, retention and feedback figures were collected. Teams adapting the model should treat these as gaps to fill in their own design, not as settled practice. ## Frequently asked questions #### How does Microsoft control what its internal network AI agents are allowed to do? According to Microsoft's [Inside Track blog](https://www.microsoft.com/insidetrack/blog/from-alerts-to-action-how-ai-agents-are-reshaping-network-operations-at-microsoft/), Microsoft Digital uses **tiered access** matched to the risk of each action. Informational prompts are open to a broad audience. Executional prompts are restricted to authorised engineers on secure admin workstations (SAWs). Ticket handoffs to partners through its Smart Bonding Agent require **human approval** by design. This is Microsoft describing its own deployment, and it has not been independently verified. #### What results has Microsoft reported from its network operations AI agents? Microsoft says measurable impact "is still emerging." It reports that Falcon Agent users saved around 300 hours in the first few months, which it equates to 10–15 minutes per ticket. It also reports a 60% retention rate and 100% positive user feedback, but does not say how these were measured. Its Network Outage Insights dashboard recorded 149 outages in one month, with 32 hours saved on communications and reporting. Microsoft says monthly tickets needing human intervention fell from about 70,000 in January 2025 to about 27,000 18 months later. It credits that drop to "automation and AI" in general, not to these agents specifically. None of these figures has been independently verified. #### What governance details does Microsoft's agent deployment leave unanswered for AI CoE leaders? Microsoft's account does not state who grants human approvals for partner handoffs, or against what criteria. It does not explain how the SAW restriction on executional prompts is enforced when the agent is reached through Teams. It also does not describe what audit trail is kept of agent actions, what evidence would justify moving a workflow to more automation, or how its time-saving, retention and feedback figures were collected. Microsoft's multi-agent orchestration is described as a roadmap, not as current deployment. Teams adapting the model should treat these as gaps to fill in their own design. AI-assisted, reviewed by **JJ Rooney** on 6 October 2026.