How to configure governance in D365 Customer Service

In today’s world AI is becoming a bigger part of the customer service experience. AI is already helping customer service reps by generating email responses, find solutions to customer issues, summarizing conversations, and even handling customer interactions autonomously. And while all of that is incredibly exciting, it also brings up a pretty important question: How do we make sure the messages being sent to our customers follow the rules we care about? That could mean company policies, legal requirements, brand guidelines, privacy requirements, or simply rules that prevent the mention of competitors to customers. This is where the new governance capability in Dynamics 365 Customer Service comes in. The governance functionality in Dynamics 365 Customer Service focuses on the email channel and provides a policy enforcement layer that evaluates outbound emails, whether they were written by a customer service representative or generated by AI. Governance is about making sure we also have some guardrails around what AI, and our humans, should do. I think this is a really interesting addition to Customer Service!

Why Governance Matters

Here is an example: a customer service representative is responding to a customer who is upset about a delayed shipment. The representative writes an email and accidentally includes information that shouldn’t be shared externally. Or maybe your organization has a rule that customer emails must contain a specific legal disclaimer or a very strict policy around mentioning competitors. Let’s take that same scenario and add AI. An AI agent can generate an email response in seconds. That’s great for productivity, but organizations still need to make sure that those AI-generated responses follow the same rules as messages written by humans. That’s the problem this new governance feature is designed to address.
Governance evaluates outbound email against policies that your organization defines in Dynamics 365 Customer Service. The policy is evaluated when the email is being prepared to go out. That means your governance rules can sit right in the middle of the customer communication process and say, ‘Hey, wait a minute. This email doesn’t meet our requirements.‘ And that happens regardless of who wrote the email. (a service representative or AI agent) Every time an email violates a policy, a new row is created in the msdyn_guardrail_execution_info table, which tracks all policy violations. The email can be flagged, blocked, or a mixture of those depending on how the policy is configured. Let’s dig into the different options that are available when configuring policies.

Enable Governance

Before we can create policies, you need to make sure that the folks who will be managing these policies have global permissions (read, create, write, delete, append, append to and assign) for these tables: msdyn_governanceagent_status, msdyn_guardrail_consumer_mapping, msdyn_guardrail_execution_info, msdyn_guardrail_rule, msdyn_guardrail_rule_version, msdyn_guardrail_scenariotype. Your customer service reps will need global read permissions for the msdyn_governanceagent_status table. You’ll also need to configure Copilot Credits, as this feature does consume credits, and you’ll have to Provide consent for potential data movement across regions. Lastly you’ll need to make sure AI agents are enabled in your D365 environment. You can do this in the power platform admin center.
The feature also has to be enabled. You can do this by opening the Copilot Service Admin Center and navigating to ‘Quality Management’ under the ‘Customer Support’ section. From there you’ll see the option to click on ‘Manage’ next to ‘Governance’. All you have to do here is turn on the switch, Once governance as been enabled Supervisors with the right access levels can create governance policies that describe what they want the system to check for.

Create Policies

Supervisors should be able to manage policies, so to create a policy you’ll need to switch to the Customer Service Workspace app. You should see the ‘Governance’ navigation item on the sitemap. If you don’t see it, it’ll need to be added it to the sitemap first. When you navigate to ‘Governance’ you’ll notice there are several out-of-the-box policies available already, including policies for profanity, groundedness, and email template adherence, but you can also create brand new policies.
Under Policy Check you can click ‘+New Policy’ to (you guessed it!) create a new policy. First, you will need to give the policy a name and description. After entering the description, you can click the ‘Generate Policy Instructions’ button, which uses AI to create the instructions from your description. Unfortunately you can’t adjust the policy instructions populated by AI, so it it’s not correct you’ll need to adjust your description and regenerate the policy instructions. Below the instructions is the ‘Content to Check’ section. The Content type is set to ‘Email’ and this can’t be changed at this time. I am hoping we’ll have more content types in the future, but we’ll have to wait and see how this feature develops.
The ‘written by’ option defines which emails you want to check. You can pick from emails created by AI and/or emails created by your customer service reps.

Enforcement Options

The ‘How to strictly enforce’ drop down field represents what the system should do when an email violates the policy. There are three options available to choose from. The first one is the ‘Flag noncompliant content‘ option. This option only identifies the violation, it will not block the email from being sent. The sender will not receive a warning that they violated the policy, but there will be a violation recorded which can be reviewed under ‘Policy Flags’ in the msdyn_guardrail_execution_info table. I think this option is great for testing policies, users will not be interrupted during their day, and supervisors will still be able to review any violations tracked by the system.
The ‘Block noncompliant content‘ blocks the email message completely and the email will not be sent. The user will see a pop-up on the screen notifying them of the violation with only an option to review the email to make sure the policy is not violated. A violation record will be created even though the email isn’t sent.
Lastly there is the “Warn noncompliant content‘ option, which is a mixture of the previous options. When an email violates a policy with this setting, a violation record will be created. The human sender will see the same pop-up as shown during a ‘Block noncompliant content‘ violation, warning them of the violation, however, the pop-up window has an additional option to ‘send email’, allowing reps to ignore the warning and continue to send the flagged email. If the email is sent without making changes, another violation record is logged, which shows that the violation was overridden.

There is also an option to check attached files in the policy setup window. This will not just check the body of the email, but it will also check any email attachments for violations. Please note that the system only evaluates text-based content in attachments, it does not evaluate images. Supported attachment formats include .docx, .pdf, and .txt.

We can configure policy strictness for each policy, but it’s important to understand this is very different from the enforcement settings. The policy strictness determines how closely the system evaluates the content for policy violations, while the enforcement mode determines what happens when a violation is detected. There are four levels of policy strictness:

• Low: Minimal enforcement and potentially more violations may pass.
• Medium: The default, providing a balanced level of enforcement.
• High: Stricter evaluation with more potential violations flagged.
• Very High: The most aggressive enforcement, including minor deviations from the policy.

This is an important setting because you probably don’t want your perfectly innocent customer emails getting blocked every five seconds. Below the policy strictness settings are the conditions for content. You can add these conditions so that a policy only applies to certain emails. If you don’t enter any conditions, the policy evaluates all applicable emails.

Simulate

Before you roll out the policies you created, you can run simulations on your unpublished policies. This will allow you to make sure your policies are blocking the content you want them to before you publish them. You can access the simulations by clicking the ‘Simulation’ button on the Governance page in the Customer Service Workspace App. First you’ll need to give your simulation a name. Then you’ll select a data source for the simulation. There is an option to do an Excel upload or you can use rows that are in your Dynamics 365 instance (Organization Records). When you choose this option you’ll notice a section where you can filter out the rows that you want to include/exclude in the simulation. Please note you can select up to 30 emails to be used in the simulation. The ‘Simulation Scenario’ allows you to pick the policies you want to test. Once the simulation runs, you can review results in the ‘Simulation Results’ area by clicking on ‘Results’ of any simulation in the list. This takes you to the simulation overview page where you can review all the details related to the simulation including detailed results. If you used data from Dynamics 365 in your simulation, you’ll also see the Dynamics 365 emails linked in the results. To learn more about this functionality check out this link.

My Take

I really like the direction Microsoft is taking with Governance. As AI becomes more deeply embedded into Dynamics 365 Customer Service, organizations are going to need more than just AI features. They’re going to need ways to control, test, monitor, and govern those features. This new governance feature gives organizations a way to define those rules in plain language and then evaluate customer communications against them. And the simulation capability is probably my favorite part. If you’re already experimenting with Service Agent, Autonomous AI, AI-generated emails, or other AI capabilities in Customer Service, Governance is definitely something I’d put on the list to explore. Because the future of AI-powered customer service isn’t just about making AI smarter. It’s about making AI trustworthy, controllable, and aligned with the way your organization actually does business. I hope you enjoyed this article! Be sure to check in again soon for a new one, or subscribe to never miss another post!