Copilot Prompt Gallery and prompt governance

Every Copilot rollout hits the same wall about a month in: the enthusiasts have found prompts that work, everyone else is typing "summarise this" and concluding Copilot is overrated. The Prompt Gallery is Microsoft's mechanism for closing that gap — a place to find, save, and share prompts inside the Copilot experience — and "prompt governance" is the small discipline that keeps it useful. This guide covers what shipped, what it does, and how much process is actually worth attaching to it.

What the Prompt Gallery is

The Prompt Gallery (it launched as Copilot Lab and was renamed) lives in the Microsoft 365 Copilot app and is reachable from Copilot in the Office apps and Teams. It has three layers:

• Microsoft's curated prompts, filtered by app (Word, Excel, Teams…), task (create, understand, catch up, ask), and job role. These are decent starting points and a good way for someone to see what a well-formed prompt looks like.
• Your saved prompts — anything you've written and chosen to save, available across apps and devices.
• Prompts shared within your organisation — prompts a colleague has published to the tenant, discoverable by everyone, with attribution.

A shared prompt is a text template with a title and description; users open it, optionally edit the placeholders, and run it. There's a "try in" affordance that launches the prompt in the right app. It is not a macro, it doesn't carry files with it, and it doesn't enforce anything — it's a well-organised text snippet with a search box.

That modesty is fine. Most of what makes Copilot useful is knowing that "Summarise the attached in five bullets for a non-technical executive, and list any decisions requested of the reader" gets a different result from "summarise." A gallery of twenty such prompts is worth more to adoption than any training video.

The tenant controls

The relevant admin control lives in the Microsoft 365 admin center under the Copilot settings: whether users can share prompts with the organisation. Off means the Gallery is Microsoft's prompts plus each user's private saved prompts; on means people can publish. There's no approval workflow built in — a published prompt is live immediately — and no per-group scoping beyond what the settings offer at the time you look. Prompts are stored as part of the user's Copilot data and follow the tenant's standard retention and audit behaviour.

Given how light the control is, the question isn't really "should we allow sharing" — you should, because the alternative is prompts circulating in Teams chats and Excel files anyway — but "how do we keep the shared set good."

A governance model that fits the feature

The mistake is treating prompt governance like app governance. Prompts are text. They carry no data, execute nothing, and grant no access. The risks are quality (bad prompts spreading), sprawl (a hundred variants of the same thing), and, at the edge, inappropriate content (someone publishing a prompt that encourages Copilot to do something it shouldn't, like draft messages impersonating a manager). Match the process to that:

One owner, not a committee. Someone in the adoption or champions team owns the shared library. Their job is a monthly ten-minute sweep: delete duplicates, tidy titles, flag anything odd.

A naming pattern. "Excel – Explain a formula in plain English," "Outlook – Decline a meeting politely." App first, then the task. It makes the search box work.

Curated ten before the free-for-all. Seed the gallery with a small set of prompts that demonstrably work in your tenant — ideally ones your pilot users already found — before opening sharing. People copy what they see.

Champions publish; everyone can. Keep sharing open, but make the champions' prompts visible and branded in the description so users know which ones are vetted.

Report the abuse path. If someone publishes something inappropriate, the owner removes it and the normal acceptable-use process applies. That's the whole incident-response plan for a text snippet.

Don't build a prompt approval workflow. It's been tried. It adds a week of friction to sharing a sentence, and the prompts end up in a SharePoint list nobody opens.

What the Gallery can't do (and what fills the gap)

• No parameters or files. A prompt that needs a specific template document has to say "attach the template first." For reusable, file-grounded workflows, the right tool is a declarative agent (built with the agent builder or Copilot Studio) — that carries instructions and knowledge sources, and it does go through governance because it's software. The line: a prompt is a suggestion; an agent is a product.
• No usage analytics per prompt. You can see Copilot adoption in the usage reports; you can't see which shared prompts get run. Ask the champions.
• No versioning. Edit a shared prompt and it's replaced. Keep the canonical set somewhere you can restore from — even a Loop page.
• No enforcement of "how we write." If the organisation wants Copilot output in plain English or a house tone, that's a Copilot memory or personalisation setting and per-prompt instruction, not a Gallery feature.

Where prompts fit in adoption

The Gallery is the delivery vehicle for the most valuable adoption content you have: proof that Copilot does specific, useful things for specific roles. A finance team that opens Copilot and sees "Excel – Reconcile two lists and flag mismatches" published by their own controller will try it. The same team shown a generic Microsoft prompt will not. Spend the effort on collecting real prompts from real users and putting them where the next user will trip over them; that is the entire strategy, and it works.

Copilot's prompt engineering fundamentals are covered in a separate guide; this one is about the plumbing. The plumbing is simple. Keep the governance simple to match.