AI Is Having Its Dropbox Moment

Remember when employees started using Dropbox before IT approved it?

AI agents feel a lot like that moment.

People are building them because they're useful. Not because they were told to. The surprise isn't that agents are showing up across the enterprise, it's how quickly they're multiplying.

In this episode of the AI Proving Ground Podcast, Softchoice's Craig McQueen and Stephanie Donahue discuss Microsoft's answer to a problem many organizations are only beginning to see: AI adoption is outpacing governance.

We explore Microsoft 365 E7, the rise of shadow AI and why organizations are starting to think differently about identity, visibility and accountability in a world where agents can take action on their own.

The challenge isn't getting employees to use AI, it's figuring out what they've already built.

Support for this episode provided by: HP Poly

More about this week's guests:

Craig McQueen is Vice President of Digital Acceleration at Softchoice, where he helps shape the company's technology strategy and go-to-market vision. He leads the development of customer-focused services and solutions that help organizations securely adopt and scale emerging technologies across cloud, data center, collaboration and the digital workplace. Working closely with customers and partners, Craig focuses on turning technology innovation into measurable business outcomes.

Stephanie Donahue is Director of AI Business Solutions at Softchoice, where she helps organizations adopt and scale AI-powered ways of working. Her focus includes Microsoft 365, Copilot, agents and the broader technologies shaping the future of work. A Microsoft Regional Director and MVP, Stephanie works closely with customers to turn emerging technologies into practical business outcomes while helping organizations navigate AI adoption, governance and workforce transformation.

The AI Proving Ground Podcast leverages the deep AI technical and business expertise from within World Wide Technology's one-of-a-kind AI Proving Ground, which provides unrivaled access to the world's leading AI technologies. This unique lab environment accelerates your ability to learn about, test, train and implement AI solutions. 

Learn more about WWT's AI Proving Ground.

The AI Proving Ground is a composable lab environment that features the latest high-performance infrastructure and reference architectures from the world's leading AI companies, such as NVIDIA, Cisco, Dell, F5, AMD, Intel and others.

Developed within our Advanced Technology Center (ATC), this one-of-a-kind lab environment empowers IT teams to evaluate and test AI infrastructure, software and solutions for efficacy, scalability and flexibility — all under one roof. The AI Proving Ground provides visibility into data flows across the entire development pipeline, enabling more informed decision-making while safeguarding production environments. 

Transcript

— It's Happening Again

SPEAKER_00 0:00

You know, I had one particular customer. Uh they were actually called by Dropbox and said, You have so many independent Dropbox accounts, you should really be managing this at an enterprise level. And they went, What? I thought everyone was attaching their documents to emails.

SPEAKER_01 0:15

Somewhere in your organization right now, an agent is running. You didn't deploy it, your IT team doesn't know about it, and when you go looking for how many of those agents are actually out there, and you better believe organizations are starting to look, the number is almost always more than anyone expected. Even Microsoft, when they turned on their own agent monitoring tools, said they were shocked. This is the governance problem Microsoft is trying to solve with 365E7. A licensing upgrade, sure, but also a bet that Enterprise AI has passed the point where individual productivity tools are enough. That agent needs identities. The sprawl needs a registry. And the organizations moving fastest right now are the ones building the infrastructure to govern what they've already set loose. So on today's episode of the AI Proven Ground podcast, we're talking with Stephanie Donahue and Craig McQueen from SoftChoice, who've been in the middle of these conversations with real organizations at real decision points. Here's what they're seeing. Well,

— Microsoft's Answer To Agent Sprawl

SPEAKER_01 1:19

we're going to talk about Microsoft 365 E7, which looks like licensing news maybe on the surface, Stephanie, but uh you know, it feels more like maybe a signal of where Microsoft seems to be heading, especially as we talk about AI and AI adoption. But let's set the table here. Stephanie, just you know, what is E7 as a platform and what what real challenges is it looking to tackle on behalf of customers that are using using it?

SPEAKER_00 1:43

Stephanie Yeah, so when we talk about the the e-suite from a Microsoft 365 standpoint, right, that's the core licensing that Microsoft uses for things like Microsoft Teams, your Outlook or Exchange, SharePoint, et cetera. And so when we look at what is E7, then it's everything that has traditionally been in the E5, which, you know, was all those things I just mentioned, plus more of the premium security features. So the things like Defender, Purview, et cetera. And so E7 continues to build on that. So E7 is E5 plus Microsoft 365 Copilot plus Entra Suite and Agent 365. So when we look at what Microsoft's doing here, you know, they're just leaning heavily into the security features that E5 has been bringing to the table. And then additionally treating Copilot as a core part of the platform and not an add-on.

SPEAKER_02 2:40

Yeah, and what's what's fascinating is it's so interconnected across your technology estate, whether it's data, security, or what we use from a workforce tools. And so that's why I think it makes a lot of sense. Well, combine these all into one platform so it just makes it easier for an organization to move forward with AI, because everything they need for AI, the security, the data, the large language models with Copilot are all in one place and much easier to implement when in an organization.

SPEAKER_01 3:12

So, Stephanie,

— When AI Starts Taking Action

SPEAKER_01 3:13

do you think it's kind of fair to say that maybe where Microsoft is heading is you know you're not just buying all the functionality within 365, but with E7, you're starting to buy more of a governed AI workplace and something that you can use to scale responsibly.

SPEAKER_00 3:26

I think what we're experiencing is that the AI platforms are shifting from being that chat-based into being something that's agentic, right? And taking actions and in some cases working independently. And so we know we have to shift the way that we manage AI and very specifically agents, right? And that's where in the E7, the Entra Suite and Agent 365 comes in. And so when we look at this, this is what differentiates Microsoft from its competitors. Microsoft has long been kind of the safer, trusted platform in comparison to some of their AI competitors. So, you know, those other competitors might be on the bleeding edge, right? We're hearing a lot about Claude, and traditionally we've heard a lot about Chat GPT, right? But they don't have that full, complete strategy put together around security, specifically in the workplace. And when we know all of our content sits in Microsoft 365, if you're on the Microsoft platform, and so what we're really bringing to the table here is that fully governed stack of all the things you need to protect as part of a corporate and in many cases large enterprise environment.

SPEAKER_02 4:39

What's fascinating is Microsoft is taking a multi-model approach, and people don't quite understand this. But when you use co-work, it's anthropic underneath. And we'll increasingly see Microsoft having model choice within that platform and even the models working together, as Stephanie said, in an agentic fashion, so that you get those specialized models doing the purpose-built tasks, and the the user gets a better result because it's it's got the combined effort of those models.

SPEAKER_01 5:12

The

— The Agents Already In Your Environment

SPEAKER_01 5:13

agent world seems to be a little bit of the wild west right now. People just creating these things right and left. How much housekeeping do we have to do before jumping into to an E7 suite, if any at all?

SPEAKER_02 5:26

It's it's exactly that. Is E7 with Agent 365 is proposing a fix. And, you know, even without E7, people are creating agents. And they might be Microsoft agents or they might be other platforms. And Microsoft knows that it will be a multi-vendor agent world. And so Agent 365 is designed to monitor and govern agents across different types of platforms. You know, early adopters who've turned on Agent 365 and discover how many agents are in their environment. Even Microsoft themselves were shocked, like it was much more than they they actually knew was there.

SPEAKER_00 6:03

And that's the whole reason Agent 365 includes shadow AI reporting so that you can get your arms around that. And, you know, it reminds me, I've been in IT for a while and doing Microsoft work for quite a number of years. And this is very similar to what we saw with OneDrive when it first rolled out. Everyone was a little bit afraid of the cloud. And so, you know, it it was that conversation of, well, you know, they're just sending email attachments and it's fine. And they're not, you know, they're they don't need OneDrive. And come to find out, you know, I had one particular customer, they were actually called by Dropbox and said, You have so many independent Dropbox accounts, you should really be managing this at an enterprise level. And they went, What? I thought everyone was attaching their documents to emails. Well, come to find out, you know, they had they had blocked a certain size attachment, attachment size in emails. And so, you know, their policies were kind of working against each other and they thought they were doing the right thing. They thought they were doing valuable exchange policies, right? And and they thought they had it under control. And I look at this very similar, where we've got all these users that are kind of just like, hey, I've got this functionality, I know how it works, I know what's going to make my job better. And so now I'm taking that on as a person and saying, I think I know what I can and should and should not put into my own personal AI tools. And we're leaving that decision-making process out to the user. And that's a little bit scary, right? Especially if you think about the younger generation, interns, we talked about interns earlier before the show, and and how they're brand new to corporate and and they are really great at AI, but do they truly understand the importance of intellectual property within a corporate organization? I don't know yet, right? And and so we really need to kind of look at that and say, how do we do our best to protect the organization? And that's what I love about this Shadow AI reporting that's built in the agent 365, is that now we're not guessing, we're not making assumptions. We can actually see what's going on in the environment and make decisions based on real data instead of assumptions.

SPEAKER_01 8:07

So the agents are already there. They're in your organization right now. Some built deliberately, some built by an intern with a free trial, some built by someone who left six months ago and are still running. Microsoft's answer to that isn't a policy document, it's architecture. And that architecture is what E7 is actually built around. You talked about identity, you talk about access. So, what does that identity first security mean in an era where people are just creating agents through a variety of tools and for a variety of reasons?

SPEAKER_00 8:35

So,

— Identity For Every Agent

SPEAKER_00 8:36

with agents, what E7 is bringing to the table is that identity for the agent. So when we say entre suite, one of the things we're bringing forward here is an entre agent ID. And so going back to that frontier firm concept, right, and thinking in terms of hybrid teams, well, you now have, you know, we've always had employees that we've had to manage, right? And and they have access to things. And so we need to look at things like conditional access, what can they access and from where? What are their security permissions? How do we audit a person to know what they've accessed and what they've changed? These are all things that we've traditionally tracked for quite some time. When now we have this concept of an agent, and this agent is hopefully working autonomously at some point, and it may not be where you're at today, but that's the goal, the end goal. And so now we need this ability to manage agents in the same way that we manage people. And that's how we're gonna do it is through this entre agent ID. So now it has an identity, and we can do things like have conditional access for the agent, right? So we're able to put build-in protections to keep our IP safe in order to track and audit the activities of that agent and really know that even if it's me who's managing that agent, that it, you know, it is audited differently. That is not me who took the action, it is the agent that took the action, and that's going to get us to the next level in terms of managing things and making sure we have a full understanding and have that observability again of what's going on in the environment, who is doing the edits and the updates, and and how do we make sure to create what I call the fenced-in backyard, right? We want both people and their agents to be able to go and execute the tasks that they need to do to get their job done. But we want to build boundaries and put things in place to make sure that they're not doing things they're not supposed to do, right? From the fenced in backyard perspective, we don't want them running in the street. We want to keep them within the safety boundaries that we've drawn for them.

— Finally Seeing The Whole Picture

SPEAKER_00 10:42

So what's nice about that Agent 365 license is you know, when we look at E5, we're going to the Purview Admin Center, we're going to Defender, we're going into Entra ID, right? We're going into Power Platform to manage environments. We're all over the place in the environment, and we have many different owners that are that are managing those admin environments. And so now with Agent 365, we have a single dashboard where we can bring all of that information in. And now we can manage it more effectively because it's all in one place. You have the agent registry, you know whether it was created in Copilot Studio or Foundry. You know, we have the shadow AI in one place. So we have alerts coming in from other platforms like Defender that are helping us understand what's going on in relation to our agents, right? So there's a lot going on there that kind of pulls everything center and really allows us to manage things at the next level.

SPEAKER_02 11:38

Agents always need a parent, and you know, there's a there needs to be a business owner who can make decisions about that agent. And I can see a place where like it is a consumption-based model, so when the agent runs, it will cost money. And so you can imagine, not just from a security perspective, but you need to out potentially allocate the the costs of the agents. And already organizations are seeing orphaned agents, meaning people have built them and they've left the organization and they're still existing. If they were scheduled, they might be running on their own and you know, burning up costs and not producing any output. So being able to have traceability of this agent belongs to this human user, and and therefore this department and this cost center helps from a security perspective because that would determine the the rights of that agent, but then then also cost.

SPEAKER_01 12:35

So that's the architecture, an identity for every agent, a registry that knows who built it, who owns it, and what it can touch. A single dashboard instead of five admin consoles. That's how you govern what's already running. But there's a bigger question underneath all of that. What does an organization look like when it actually succeeds with this? What does Microsoft mean when they call it a frontier firm? This episode is supported by HP Poly. HP Poly designs premium audio and video solutions that empower teams to communicate and collaborate seamlessly, whether in the office, at home, or anywhere in between. From professional headsets and speakerphones to advanced video conferencing systems. HP Poly delivers crystal clear sound and smart, reliable performance. Elevate every meeting and make every voice heard with HP Poly.

— What Microsoft Means By Frontier Firm

SPEAKER_01 13:25

Microsoft is using the word frontier a lot, I've noticed on on this rollout. And frontier is a word I see all over the place frontier labs, frontier models, now frontier users. Can you just give some clarity around what Microsoft means by frontier and why that might be an important signal for us to pick up on?

SPEAKER_00 13:42

So I I loved what they did when they described what a frontier firm looks like. So Microsoft has kind of come out and said, hey, we are really reaching into the future and looking at how are we going to work in in a very different way. And that includes AI and agents. And we're going to be hybrid, right? We're going to have teams that are humans, but also agents. And we're going to work together. And when we look at that, that future, then we know that things are going to work very differently and that we're going to have, hopefully, as humans, we'll have, you know, the harder things to do in some cases, and the things that maybe AI doesn't do as well. And maybe we'll get to offload some of those tasks that we find boring or repetitive. Or maybe, you know, they're just something that AI is really geared really well for, like deep research, right? It can do that way faster than we could manually. And so we look at how do we take these things that are, you know, really making us more productive, but then upscaling that to far more than what we see in just our day-to-day productivity. It's not just about writing an email faster. It's not about finding a document faster. It's really about how do we transform the way that an organization works and how do we plug it, and it's not just AI, it's automation as well, right? How do we really look at what's available to us and find efficiencies throughout the organization? And we do that by, you know, looking at things like the KPIs that we already measure our business by and we apply the tools to those KPIs in order in a way to figure out how to be more efficient and hopefully for every business making more money and not working quite as hard, right? That we're doing things we couldn't get to previously. And so I I think that's how Microsoft's starting to put their arms around it.

SPEAKER_02 15:36

I'm going to pick up on that frontier firm a little bit, because I think there's a bit of a fun analogy. If I mean we've all heard Star Trek, space, the final frontier. Or you go back in time, the Wild West, well, that was their frontier. And it's this concept of uncharted territory, but having the confidence that there is something exciting out there. So we're going to invest and head forward. And so when we think about a frontier firm, there's the belief that yes, AI is going to change what we're going to do. And there's an executive commitment of we will carve out the time and money to help change our organization. And so what it isn't is giving some licenses to a few people, letting them do a few, you know, webinars and hoping they, you know, can write emails better and faster. That's not a frontier firm. It's someone who looks at what are the key drivers of our business? How does our sales organization work? How does our operations work? How does our customer support work? And then redesigning it with AI in mind. And that, you know, those are bigger steps and bigger commitments. But that that's what's meant by a frontier firm is the redesign of an organization using AI.

SPEAKER_01 16:51

Redesigning an organization using AI, that's the

— The Data Problem Behind AI

SPEAKER_01 16:54

goal. Executive commitment, a process audit, KPIs you're already tracking. SoftChoice didn't just advise clients on this, they ran the experiment themselves. And the number they came back to was hard to ignore. A lot of users are still looking to get and drive ROI just from you know co-pilot alone. What do we need to be getting right there before we get E7 right?

SPEAKER_00 17:15

I'll just give a couple examples because there's a lot there. But the one we hear a lot about is preparing our data for copilot. So one of the concerns is, you know, I get into copilot and I've always had enterprise search, but but now with copilot, it's so much easier to bring data forward that I didn't even know existed. I don't have to know where it lives anymore. Copilot can just find it for me. So when we look at those additional security features, what can an E5 bring to the table? In that scenario, we have Microsoft Purview, we can look at DLP, we can look at labels, right? And now we have additional protections that we can provide attaching those labels to the document, and now we can kind of decide what gets encrypted and how does it, or does it get surfaced or not within Copilot? And how can it be shared? Because that oversharing conversation is so important as we look at what gets surfaced in co-pilot. So we have all these additional features within E5 that kind of help us with that security story, whether that's you know, Defender, whether that's purview. So there's a lot there where we start to kind of narrow down what we can do all of these things. And some of those features are even available in E3, but you have to manually attach them. Whereas in E5, you have more of the automation available, right? So each suite kind of builds on the next where you can have some of the fundamentals and protect yourself in E3. We make it easier to do that in E5. And now with E7, now we can do it for agents too, right? So each one kind of builds on the next.

— Who Actually Needs E7?

SPEAKER_01 18:45

Gartner's early guidance suggests that, you know, maybe evaluate E7, potentially use it for renewal leverage, but you know, don't necessarily assume that every user is going to have it or need it right away. Is that on par with what we're seeing? Or what what are some clients that we're engaging with? What are they asking about E7 right now that that would put them on a path to solid adoption?

SPEAKER_02 19:04

I I think we'll see that it's those customers that have the confidence that AI is an important part of their future. And so it's making a commitment to the AI platform. And I think that's where we'll see the early adopters of E7. We just had another customer sign today with E7, and it's because they attended one of our executive briefings and got an understanding of well, what does it mean to transform with the platform? And I know that those executive briefings of understanding AI with an organization help them make that E7 decision. If you're strictly looking at it from a financial incentive, while there is, you know, some advantages, that's that's kind of the wrong way to look at it. It really should be in the context of how do you anticipate transforming your organization over the next three years.

SPEAKER_00 19:52

Yeah, and I think it's it's interesting, right? Because it's to some level in some organizations, it's happening after the fact, right? So they've gone through copilot adoption, they're you know releasing agents into the organization, and now they kind of need E7 to come back and really get their arms around it with agent 365 and getting what we call observability, right? It's it's hard to protect what you don't know exists. And so now we've kind of finally been able to surface all of the agents. And I think even Microsoft has said they were pretty surprised at the number of agents that were kind of roaming around their organization. And, you know, on the flip side of that, we still have customers who are doing maybe a little bit of a slower adoption. They're just now getting through M365 co-pilot adoption, and they're saying, hey, I'm ready to draw the line and let's, you know, do our due diligence ahead of time and let's use this tooling so that we can be prepared and do agents the right way and make sure it's fully controlled as we roll them out, maybe a little more slowly than some of those that have kind of dove right in head first. So we're we're seeing a little bit of everything with our customers in terms of you know where they're going and who's interested and where it's gonna make

— The Roadmap Before The License

SPEAKER_00 21:02

sense.

SPEAKER_01 21:02

Just, you know, to start wrapping us up here, I know we're getting close to time. You know, what do senior leaders need to be thinking about as they start to consider E7 or move from E3 or E5 to E7? What does the senior leadership need to be talking about? What do they need to be asking themselves, or what do they need to be having, you know, a hard look in the mirror about to get ready for this?

SPEAKER_02 21:21

Yeah, great question. Uh and I think it is uh tied to what what what would their business priorities be over the next year or two, and how can AI support that? I think they need to make sure they have clarity on on some people would say AI strategy. R CEO would say, hey, it's a business strategy that's AI enabled. Because the what what you don't want to do as a senior leader is commit to an E seven purchase without a deployment and enablement plan behind it, because uh a lot of the workloads of the license will just not be used. And so it it's not just a licensing decision. It's what is the strategy to make sure that all of this technology will be utilized effectively. And you you probably need you know a one to two year roadmap of how you will have the organization adopt it to feel confident that, yeah, we're gonna get a lot of value out of this E7 license.

SPEAKER_01 22:25

Well, Stephanie, Craig, thank you so much for for taking the time out of your busy schedules to uh to join us here. Great. Thank you.

SPEAKER_00 22:30

Yeah, thanks for having us.

— You Can't Govern What You Can't See

SPEAKER_01 22:32

Okay, thanks to Stephanie and Craig for joining us today. The key lesson here, you probably already have agents running in your organization, and they're not just a security concern, they're burning compute costs and producing nothing. The governance question was always going to come. E7 or not, that conversation is overdue. This episode of the AI Proven Ground Podcast was co produced by Nas Baker and Kara Kuhn. Our audio and video engineers, John Knoblock. My name is Brian Felt. Thanks for listening. See you next time.