Governance for Copilot & AI Agents by Rencore
Rencore GmbH · Cybersecurity & IT
Certification per Microsoft Marketplace.
Evidence tier Source Confirmed · 8 captures on record
What the publisher says
As described on Microsoft Marketplace.
Governance for Copilot & AI Agents by Rencore is a governance platform for the Microsoft AI stack and the AI tools your teams adopt alongside it. It inventories every Microsoft 365 Copilot user, every Copilot Studio agent, every Microsoft 365 Agent, and AI usage across OpenAI, Claude, Gemini, Palantir, and more, scoring risk, controlling oversharing, attesting ownership, and producing EU AI Act evidence from one tenant view.
About Rencore Governance
Show the rest of the publisher’s description (18 more lines)
Rencore Governance is a software platform that provides pre-built governance for Microsoft 365, the Power Platform, Microsoft Copilot, and AI agents. It connects to 43 services and ships with 951 policies, 361 reports, and 143 automations out of the box. Rencore inventories every workspace, guest account, shared link, AI agent, and citizen-developer app across your tenant, applies policy continuously, automates remediation, runs scheduled access reviews, and produces audit-ready evidence for GDPR, NIS2, DORA, EU AI Act, and SOC 2.
Rencore reads metadata only, never document or message contents. SOC 2 Type 2 certified, GDPR compliant, with EU hosting available. Deployable as multi-tenant SaaS or into your own Azure subscription for full data residency control. Business owners and executives see governance state through license-free dashboards without needing a Rencore seat.
For a full product overview, visit Rencore Governance.
Why teams choose Rencore for AI governance
- Microsoft AI and beyond. Microsoft Copilot, Copilot Studio, Microsoft 365 Agents, Agent Governance Toolkit, plus OpenAI, Claude, Gemini, Palantir, Glean, and more, governed from one platform.
- Oversharing detection before Copilot. SharePoint, OneDrive, and Teams oversharing becomes Copilot exposure. Rencore scans and remediates before rollout day.
- AI agent inventory. Every Copilot Studio agent, every Microsoft 365 Agent, every third-party AI tool, inventoried with ownership, data sources, risk classification, and last review date.
- EU AI Act evidence. Risk classification, documentation, review trails, and audit-ready reports for every AI system in the organization.
- License-free dashboard sharing. CISOs and compliance officers see AI governance state without needing a Rencore seat.
What Rencore detects on the first scan
- Copilot oversharing. SharePoint sites, OneDrive folders, and Teams channels reachable through Copilot prompts because permissions drifted years ago.
- AI agent sprawl. Copilot Studio agents, Microsoft 365 Agents, custom agents, and SaaS agents missing inventory, ownership, or risk classification.
- Copilot license waste. Licenses assigned to disabled accounts and inactive users who haven't engaged with Copilot in 30+ days.
- External connection risk. AI tools reading data sources that lack DLP, sensitivity labeling, or documented ownership.
- EU AI Act gaps. Agents that are not risk-classified, not documented, or not periodically reviewed.
Free trial
Start a free trial. The trial connects to your Microsoft 365 tenant and produces Copilot-relevant findings within the first hour.
Book a Rencore demo for a walkthrough with our team.
Preview
5 images
Agent build and provenance
See the full provenance
The layer-by-layer build, the evidence behind each claim, the risk basis and the cross-marketplace links are open to any account. Some rows are disclosed, some the source leaves Unknown; a free account shows you which.
Compliance
- FedRAMPConfirmedNot listed90%, registry-checkedNo FedRAMP Marketplace entry matched this vendor's domain, checked 2026-08-27registry recordas observed 2026-08-27
Confirmed means matched to a public authoritative registry. Claimed means the vendor or its listing states it, not yet cross-checked. A framework not shown was not found in any source we hold, which is not evidence against it. Not listed means a scoped registry check found no match for this vendor's domain: a No is a scoped registry check, not a compliance judgment. Confidence bands: 95% domain-verified, 90% registry-checked, 80% self-attested, 70% weak signal. Self-attested items marked “vendor's site” are gathered from the vendor's own website and are not verified by us.
Vendor
External enrichment
Sources
Publisher resources
4 linksLinked repositories
Unknown means this listing does not publish a repository. It is not a statement that the code is closed, and a linked repository is not a claim that the publisher wrote it: the registry computes that relationship privately and does not publish it.
Evidence risk is the share of the build you cannot see before you deploy, not a security rating. Sign in to see the layer-by-layer basis for this band.