OpenAI Is Now a Microsoft Copilot Subprocessor. Here's What Actually Changed.

Microsoft recently announced that OpenAI is now a subprocessor for Microsoft Online Services, including Microsoft Copilot. At first glance, this may sound like a major shift in Microsoft's AI strategy. However, the reality is more nuanced.

The announcement does not change Microsoft's security, compliance, or privacy commitments for organizations. Instead, it introduces a new way for OpenAI models to be delivered within Microsoft Copilot while remaining under Microsoft's enterprise governance framework.

What Is a Subprocessor?

A subprocessor is a third-party organization that processes customer data on Microsoft's behalf to help deliver an online service.

In this model:

• Microsoft remains the primary service provider.

• OpenAI acts as a Microsoft-approved subprocessor.

• Microsoft Product Terms and the Microsoft Data Protection Addendum (DPA) continue to apply.

• Enterprise Data Protection remains in effect.

• Microsoft retains oversight through contractual, technical, and organizational safeguards.

For enterprise customers, this means OpenAI is operating within Microsoft's service delivery framework rather than directly providing a standalone AI service to your organization.

What Actually Changed?

Historically, Microsoft Copilot primarily relied on OpenAI models operated by Microsoft through Azure OpenAI Service.

Microsoft has now introduced an additional option:

• OpenAI models operated by Microsoft (Azure OpenAI)

• OpenAI models operated by OpenAI as a Microsoft subprocessor

According to Microsoft, this new model delivery path provides:

• Faster access to the latest AI model innovations

• Greater model flexibility

• Quicker availability of newer OpenAI model families, beginning with GPT-5.6

Update: It's Not Just OpenAI Anymore

Since this rollout, Microsoft has extended the same subprocessor model to Anthropic. Anthropic models are now enabled by default for most commercial customers (excluding EU/EFTA and UK) across Microsoft Copilot, Researcher, Copilot Studio, and Power Platform. This confirms the pattern isn't a one-off OpenAI arrangement — it's Microsoft building Copilot into a genuinely multi-provider platform, exactly the direction the "My Take" section below argues for.

This is the real story behind the announcement.

The rollout has happened in stages. OpenAI was added to Microsoft's Online Services Subprocessors List on June 23, 2026, with OpenAI-operated models becoming available from July 9. As of July 24, 2026, Microsoft enabled OpenAI-operated models for all users in eligible commercial customers unless administrators explicitly selected “No users” in the Microsoft 365 admin center.

The change is less about privacy and more about how Microsoft can bring advanced AI capabilities into Copilot faster while still maintaining enterprise protections.

What Has NOT Changed?

"This is where many initial reactions and social media discussions have created confusion.

Microsoft explicitly states that:

• Security commitments remain unchanged.

• Compliance commitments remain unchanged.

• Privacy protections remain unchanged.

• Microsoft Product Terms and DPA continue to apply.

• Enterprise Data Protection remains in place.

• Prompts, responses, and Microsoft Graph data are not used to train foundation models used by Microsoft Copilot.

In addition, Microsoft Copilot continues to respect existing Microsoft 365 permissions. Users can only access content they already have permission to view within Microsoft 365.

For most organizations, existing controls such as:

• Microsoft Purview

• Conditional Access

• Entra ID governance

• Data Loss Prevention (DLP)

• Information Protection

continue to form part of the organization's existing Microsoft 365 security and governance framework.

The Important Fine Print

One detail that caught my attention is Microsoft's statement that OpenAI-operated models are currently excluded from certain in-country processing commitments where applicable.

This distinction is particularly relevant for organizations with strict data residency requirements. Microsoft states that Microsoft Copilot continues to support existing privacy, security, compliance, and EU Data Boundary commitments, while separately noting that OpenAI-operated models are currently excluded from certain in-country processing commitments where applicable. Organizations should therefore distinguish between broader data residency commitments and country-specific processing requirements when assessing the impact.

The practical distinction to track: 

• Where data is stored

• Where AI processing may occur

For organizations in highly regulated industries, this is worth discussing with privacy, legal, compliance, and risk teams.

Microsoft also documents specific compliance and cloud-availability exclusions for OpenAI-operated models, making it important for regulated organizations to review the applicable requirements before enabling the provider.

New Admin Controls

Microsoft has also introduced administrative controls that allow organizations to manage access to OpenAI-operated models.

Administrators can:

• Enable access for all users

• Disable access entirely

• Restrict access to specific users or groups

Importantly, these controls apply specifically to OpenAI-operated models delivered through OpenAI as a subprocessor. They do not affect OpenAI models operated by Microsoft through Azure OpenAI.

This gives organizations greater flexibility to align AI usage with governance and compliance requirements.

Why This Matters for Copilot Governance

From a governance perspective, this announcement is bigger than it may initially appear.

For years, most discussions focused on:

Which AI model is Copilot using?

Now organizations may also need to ask:

Who is operating the model?

That introduces a new governance consideration around:

• AI providers

• Model operators

• Data processing locations

• Regulatory requirements

• Vendor oversight

These are conversations many organizations already have for cloud services, and they are increasingly becoming relevant for AI services as well.

My Take

I believe this announcement is less about OpenAI and more about the future direction of Microsoft Copilot.

Microsoft recently introduced broader documentation around AI subprocessors, suggesting that Copilot may continue evolving into a platform capable of supporting different model providers and delivery methods.

Today, the conversation is about Azure OpenAI versus OpenAI-operated models.

That future is already here: with Anthropic now following the same subprocessor path, organizations need governance frameworks that address: 

• Multiple model providers

• Different AI operating environments

• Provider-specific compliance considerations

• AI provider approval processes

In many ways, AI governance is beginning to look a lot like cloud governance.

I also see this as a sign that Microsoft wants to bring the latest AI innovations into Copilot faster, without being limited to a single model delivery approach. While Azure OpenAI remains a key part of Microsoft's AI strategy, this move provides additional flexibility that could benefit both Microsoft and its customers.

Final Thoughts

OpenAI becoming a Microsoft Copilot subprocessor does not mean Microsoft is handing customer data directly to OpenAI or weakening enterprise protections.

What it does mean is that Microsoft is creating a more flexible AI architecture that can bring new model innovations into Copilot faster while continuing to operate under Microsoft's enterprise commitments.

For IT leaders, Copilot administrators, and governance teams, the key takeaway is not panic. It's understanding the architecture.

Know which models are available, who operates them, what controls exist, and whether those choices align with your organization's compliance and data residency requirements.

As Microsoft continues expanding its AI ecosystem, governance discussions will increasingly shift from simply asking:

"Which AI model are we using?"

to asking:

"Which AI provider are we trusting?"

That may ultimately be the bigger story behind Microsoft's OpenAI subprocessor announcement.

References

• OpenAI as a Subprocessor in Microsoft Online Services

• Overview of AI Subprocessors

• Data, Privacy, and Security for Microsoft Copilot

• Data Residency for Microsoft Copilot and Copilot Chat

• Advanced Data Residency in Microsoft 365

• Anthropic models in Microsoft Online Services

What It Takes for an Organization to Become a Frontier Firm

"Frontier Firm" has become the industry's word of the year. Microsoft's 2026 Work Trend Index put it at the center of its annual report, and every vendor, consultant, and MVP seems to have an opinion on it. But strip away the marketing gloss, and there's a genuinely useful operating model underneath — one that matters directly to anyone running Modern Workplace, Copilot, or AI governance at enterprise scale.

Here's what the concept actually means, and what it takes in practice to get there.

What a Frontier Firm Actually Is

A Frontier Firm isn't defined by how much AI an organization has deployed. It's defined by how deliberately leaders redesign work, matching the level of human involvement to the outcome required.

Microsoft's research frames this as a maturity journey, not a switch you flip. The organization doesn't need to push every workstream toward maximum agent autonomy — the goal is clarity on how humans and AI should work together for different types of work, and the discipline to keep reassessing that as capabilities improve.

It is also worth being precise about some of the headline numbers. Microsoft's analysis found that organizational factors accounted for 67% of the modeled importance in explaining AI impact, compared with 32% for individual factors. Microsoft notes that this represents statistical association rather than a causal effect, so these figures are best treated as directional research signals rather than hard measurements.

The underlying argument still matters: systems, processes, culture and organizational readiness can have a greater influence on AI impact than individual willingness alone.

Another figure that deserves careful interpretation is the widely discussed 16% of AI users identified as Frontier Professionals. This is not the same as saying that only 16% of organizations are Frontier Firms. Frontier Professionals describe individual AI behavior, while the Frontier Firm concept is about the interaction between individual capability and organizational readiness.

The Four Modes of Working With AI

Microsoft's 2026 Work Trend Index describes four modes of working with AI:

• Delegation: AI takes on defined work that previously required human execution, with humans retaining appropriate oversight.
• Collaboration: Humans and AI work iteratively together, combining human judgment with AI capabilities.
• Asking: People use AI to obtain information, analysis, ideas or assistance without necessarily redesigning the underlying workflow.
• Exploration: People use AI to investigate possibilities, experiment with new approaches and discover what can be done differently.

These modes are not competing stages where every organization must eventually move everything toward maximum autonomy. Different types of work call for different levels of human involvement.

As AI capabilities increase, human involvement does not disappear — it changes shape. What can decline is tactical, step-by-step execution. What becomes more important is the human ability to set direction, establish standards, exercise judgment and evaluate outcomes.

For enterprise leaders, the question therefore isn't simply "Where can we deploy an agent?"

It is:

"What should the human do, what should the AI do, and how should the work itself be redesigned?"

Building "Owned Intelligence"

This is the part of the framework I think gets underemphasized in most summaries, and it's the actual differentiator between firms that stall at pilot stage and firms that compound gains over time.

Microsoft calls it Owned Intelligence — institutional know-how that compounds, is unique to the firm, and is difficult for competitors to replicate.

Every organization pursuing this model needs to be able to answer three questions:

• Who reviews agent performance?
• Who has the authority to update the workflows agents run?
• How does a local win get captured and scaled across the organization?

Answering these requires coordinated reinvention across four roles, not just an IT rollout:

• Employees rearchitect their own work around intent, judgment and review.
• Leaders redesign processes around outcomes and appropriate levels of AI autonomy, rather than simply automating individual tasks.
• IT builds the infrastructure required to operate AI and agents at scale.
• Security ensures trust, identity, permissions, policy and monitoring are woven into the system itself rather than bolted on afterward.

That is what turns individual experimentation into organizational capability.

What This Looks Like With the Tools Already in Your Stack

The good news for Microsoft 365 shops is that much of the infrastructure needed for this journey already exists. The challenge is sequencing and connecting those capabilities deliberately rather than adopting them in isolation.

If we translate the Frontier Firm concept into the Microsoft stack, the pieces begin to line up.

For everyday assisted work and defined workflows

Microsoft 365 Copilot covers everyday assisted work — drafting, summarizing, analysis, information discovery and other knowledge-work scenarios where the human remains responsible for direction and judgment.

Copilot Studio extends this into more defined and repeatable agentic workflows. Organizations can build agents for specific scenarios such as ticket triage, employee support, onboarding or knowledge retrieval, with appropriate human ownership and governance.

For more advanced collaboration and orchestration

As organizations move toward more complex agentic workflows, the model becomes less about a person using an AI assistant and more about humans working with agents as part of a broader workflow.

Copilot Cowork, now generally available, represents Microsoft's move toward more autonomous, collaborative AI work, where agents can take on more complex tasks while people remain involved in setting goals, reviewing progress and making decisions.

Microsoft Agent 365, now generally available, provides the control plane for observing, governing, and securing agents at enterprise scale. At this stage, visibility into agents, their identities, permissions, activity and lifecycle becomes increasingly important.

The important point is that these capabilities should not be viewed simply as another set of Microsoft products to deploy. They are components of an operating model in which humans, AI and agents work together under defined governance.

The Governance Layer: Building the Evidence and Control System

This is where Microsoft Purview becomes particularly relevant.

Data Classification, Sensitivity Labels, Data Loss Prevention, Audit and AI-related activity monitoring can provide important controls and evidence across the information lifecycle.

But Purview should not be viewed as the entire agent-governance layer.

Agent governance increasingly spans identity, permissions, security, lifecycle management, policy enforcement, monitoring and auditability. That means Modern Workplace, security, identity, data governance and AI governance teams need to work together rather than treating agent governance as a single-product responsibility.

The objective is simple:

Know what the agent can access, what it is allowed to do, what it actually did, and who is accountable for the outcome.

That is the foundation required for scaling AI beyond experimentation.

From Individual Wins to Organizational Intelligence

Another important part of the Frontier Firm model is making sure that successful AI adoption doesn't remain trapped inside one team or one enthusiastic employee.

Microsoft 365 administration and Copilot analytics can help organizations understand usage and adoption patterns. The objective, however, should go beyond measuring license utilization.

The more valuable question is:

Where is AI changing the way work gets done?

A successful workflow in one team should become a candidate for institutionalization, governance and potentially broader deployment.

This is how an organization begins to build Owned Intelligence.

The Microsoft 365 maturity approach can also provide a structured way to assess progress across areas such as people, processes, governance and content management rather than treating AI maturity as simply the number of Copilot or agent licenses deployed.

Practical Starting Points for IT and Modern Workplace Leaders

If you're the one actually responsible for the rollout rather than simply setting strategy from the C-suite, here's where the real groundwork sits:

• Start with an honest AI inventory — where are Copilot, Copilot Studio, agents or other GenAI tools already being used, and what are they actually doing in each case?
• Map work to the appropriate human-AI model — don't default every process to maximum autonomy. Some work is better suited to asking, exploration, collaboration or controlled delegation.
• Define agent governance early — who reviews agent output, who can change a workflow, who owns the agent, what permissions does it have, and how are changes controlled?
• Treat this as a management system, not an IT rollout — Frontier leaders start with human ambition and business outcomes, then design the systems and guardrails around them.
• Build the maturity discipline — this isn't a one-time initiative. It requires ongoing measurement across governance, training, workflow redesign, security and content management to balance speed with safety.
• Capture what works — every successful AI-enabled workflow should create organizational learning that can be reused rather than remaining an isolated experiment.

Bottom Line

Becoming a Frontier Firm isn't about maximizing AI adoption — it's about deliberately matching human involvement to outcomes, function by function, and building the governance and institutional memory to keep improving that match over time.

The organizations getting real value from Copilot and agentic AI aren't necessarily the ones with the most licenses deployed. They are the ones redesigning the work itself and building the governance, skills and organizational mechanisms required to scale what works.

The technology is increasingly available.

The harder transformation is organizational.

For anyone leading Modern Workplace or Copilot governance today, the practical takeaway is straightforward:

Your AI rollout plan needs a workflow-redesign plan sitting right next to it.

Without that pairing, adoption numbers can go up while real transformation still doesn't happen.

Related Reading: 

How Frontier Firms are rebuilding the operating model for the age of AI – Microsoft

2026 Work Trend Index: Agents, human agency and the opportunity for every organization – Microsoft WorkLab

How to start your Frontier Transformation: 3 strategies to start with people – Microsoft Cloud Blog

Microsoft's Next Step for Frontier Firms

Microsoft recently launched Microsoft Frontier Company, a new initiative focused on helping organizations move beyond AI experimentation and achieve measurable business outcomes through embedded AI engineering expertise and outcome-driven delivery. This reinforces the vision that successful Frontier Firms combine technology, process transformation, and organizational change. Microsoft describes the model as embedding engineering and AI experts directly alongside customer teams to build, deploy, and continuously improve AI solutions tied to business outcomes and KPIs. 

Learn More: Microsoft Frontier Company

The EU AI Act Enters Enforcement: What It Really Means for Microsoft 365 Copilot

The EU AI Act stopped being a purely "future compliance deadline" this month.

As of August 2, 2026, the European Commission's AI Office and national competent authorities gained enforcement powers for the provisions that have become applicable, while the Act's new Article 50 transparency obligations also started applying.

The timing is particularly significant for organizations using Microsoft 365 Copilot, Azure AI, Microsoft Foundry, Copilot Studio agents, and other generative AI services across their workforce.

But there's an important distinction to get right: August 2, 2026 is not the date when all high-risk AI obligations suddenly became enforceable. Following the EU's AI Omnibus, many high-risk obligations have been pushed to 2027 and 2028. What's arrived now is a combination of enforcement powers, transparency requirements, and continued obligations around prohibited AI practices and General-Purpose AI (GPAI).

For organizations running Copilot, the practical question isn't simply "are we compliant with the AI Act?" It's: where are we using AI, what role does each system play, and what obligations apply to that particular use case?

What Changed on August 2, 2026

The EU AI Act entered into force on August 1, 2024, but its requirements were deliberately phased. The major milestones:

• February 2, 2025: Prohibited AI practices and AI literacy obligations began applying

• August 2, 2025: Governance provisions and obligations for providers of General-Purpose AI models began applying

• August 2, 2026: The Act's general application date arrived — enforcement powers became operational for applicable provisions, and Article 50 transparency obligations began applying

• December 2, 2027: High-risk AI systems under many Annex III use cases — employment, education, biometrics, critical infrastructure — become subject to high-risk requirements, per the AI Omnibus timeline

• August 2, 2028: High-risk AI systems embedded in regulated products under Annex I receive their extended transition period

The European Commission's July 2026 guidance makes an important distinction here: the AI Act is now in its enforcement phase, but not every obligation applies today. That's a far more accurate way to describe the August 2026 milestone than "everything just became mandatory."

Article 50: The Transparency Rules That Matter Now

The most visible change is Article 50, introducing transparency requirements for certain AI systems. The European Commission published its final guidelines on July 20, 2026, shortly before the obligations began applying.

1. People must know when they're interacting with AI Providers of AI systems designed to interact directly with people must design them so individuals are informed they're dealing with an AI system, not a human. This matters most where AI-powered assistants are exposed directly to customers, employees, or citizens.

2. AI-generated and manipulated content must be identifiable Providers of systems that generate or manipulate synthetic content must implement machine-readable marking so the artificial origin can be detected — covering images, audio, video, text, and other synthetic content under Article 50. In most scenarios, this obligation sits with the provider through metadata or technical markers, not a visible label on every piece of content. Systems already on the market before August 2, 2026 get an extended compliance window until December 2, 2026 for this specific marking obligation.

3. Deepfakes must be disclosed Deployers must disclose when people are exposed to AI-generated or manipulated image, audio, or video content that constitutes a deepfake — relevant to marketing material, training content, corporate communications, and synthetic media.

4. Certain AI-generated public-interest text requires disclosure This is not a blanket rule requiring every piece of Copilot-assisted writing to carry an AI label. There's an important exception where content has undergone appropriate human review and a person assumes editorial responsibility. That distinction matters for everyday Copilot usage — rewriting an email, summarizing meeting notes, or improving a document doesn't automatically require an AI-generated label. Context and the nature of the AI's contribution matter.

What Does This Mean for Microsoft 365 Copilot?

This is where the AI Act's risk-based structure becomes important. Copilot is not automatically "high-risk" simply because it's an AI system. Classification depends on the AI system and, critically, how it's used.

For ordinary workplace activities — drafting emails, summarizing meetings, creating document outlines, generating first drafts, finding information across permitted organizational content — the use case will generally not become high-risk merely because Copilot is involved.

The situation changes when AI is incorporated into a regulated or high-impact decision process:

• Recruiting or candidate evaluation
• Employee selection or promotion
• Worker performance or employment-related decisions
• Access to essential services
• Creditworthiness or credit decisions
• Other Annex III use cases

Calling the technology a "copilot" doesn't remove the regulatory obligations — the use case matters more than the marketing name. And per the Commission's updated timeline, many Annex III high-risk requirements are now scheduled for December 2, 2027, not August 2026.

Key takeaway: don't classify the product — classify the use case. The same Copilot that drafts an email may be low-risk, while an AI-driven hiring workflow may fall into a regulated category with additional obligations.

Microsoft, Copilot, and the GPAI Responsibility Split

Another area worth getting the wording right on: the relationship between Microsoft, Copilot, and the underlying AI models.

Microsoft provides AI systems and services and, in relevant circumstances, may also carry obligations as a provider of General-Purpose AI models — but it's too simplistic to say "Microsoft is the GPAI model provider behind Copilot" and leave it there. The AI Act creates responsibilities across the entire AI value chain, and depending on the service and architecture, different organizations can carry responsibilities as model providers, AI system providers, deployers, downstream providers, distributors, or other actors.

For an enterprise using Microsoft 365 Copilot, the organization is generally acting as the deployer of the AI system within its own environment. That means Microsoft cannot simply be expected to solve the customer's entire AI Act compliance challenge. Customers still need to understand:

• What is Copilot being used for?
• Who is affected by its outputs?
• Is it involved in a regulated decision?
• What human oversight exists?
• What information is being processed?
• Can the organization demonstrate how the system is governed?

What This Means for Large Enterprises

For large enterprises, the immediate priority isn't rebuilding Copilot deployments. It's understanding where AI is influencing decisions, documenting those use cases, and ensuring appropriate governance, transparency, risk management, and human oversight controls are in place — not just for Microsoft 365 Copilot, but also Copilot Studio agents, autonomous AI agents, Azure AI services, Microsoft Foundry solutions, third-party AI platforms, and custom-developed AI applications.

Organizations that understand their AI estate today will be significantly better positioned as additional AI Act obligations begin applying in 2027 and 2028.

What Should Microsoft 365 Administrators and Compliance Teams Do?

1. Build an AI inventory Identify where employees are using Microsoft 365 Copilot, Copilot Studio agents, Azure AI/Microsoft Foundry, third-party GenAI services, custom AI applications, and AI-powered business processes. The goal is understanding where AI exists in the business — not just which AI products were purchased.

2. Map AI to business processes The next question: what is the AI actually doing? A Copilot used to summarize a meeting is very different from an AI system used to rank job candidates. Map deployments against business processes and identify whether any fall within regulated or potentially high-risk use cases.

3. Strengthen human oversight For important decisions, define where human judgment is required. AI output shouldn't automatically become a business decision simply because it came from a trusted enterprise platform — particularly in employment processes, financial decisions, and other customer-impacting workflows.

4. Use Purview and Microsoft 365 governance capabilities Microsoft Purview can play an important supporting role in a broader governance architecture — Data Classification, Sensitivity Labels, DLP, Audit, Insider Risk Management, Data Lifecycle Controls, Information Protection, and AI-related Activity Monitoring. These controls don't, by themselves, make an organization compliant with the EU AI Act, but they provide important security, governance, auditability, and evidence around how AI is being used.

5. Establish an AI literacy program Employees using Copilot should understand what it can and cannot do, hallucination and accuracy risks, appropriate handling of confidential information, human review requirements, bias and fairness considerations, and when AI output shouldn't be trusted. The AI Act's AI literacy requirement has applied since February 2025 — this isn't new, but it deserves continued investment.

Bottom Line

The EU AI Act has now entered a significant new phase. August 2, 2026 is real, but it is not the date when every AI system suddenly became high-risk. What changed is that the AI Act's enforcement framework is now operational for applicable provisions, while Article 50 transparency requirements have begun applying. At the same time, the AI Omnibus has extended the timeline for many high-risk AI obligations into 2027 and 2028.

For Microsoft 365 Copilot customers, the practical lesson is straightforward: don't classify the product, classify the use case. Copilot used for everyday productivity is very different from Copilot or an AI agent embedded into recruitment, employee evaluation, financial decisions, or another regulated process.

The organizations best prepared won't necessarily be the ones with the most AI policies — they'll be the ones that can answer three simple questions: Where are we using AI? What decisions or content does it influence? Can we demonstrate that we are governing it appropriately?

That's the real shift happening with the EU AI Act in 2026.

Read here to know more: Safer and more transparent AI – European Commission

Also review: EU AI Act Compliance – Microsoft Trust Center

And: AI Act | Shaping Europe's Digital Future – European Union

Stay tuned for more updates on Microsoft, Copilot, Purview, AI governance, and the rapidly evolving regulatory landscape...

Microsoft Purview DSPM in 2026: Securing Data, AI Apps and Agents

Back in November 2025, I wrote about Microsoft Purview at Ignite and the growing role of Data Security Posture Management (DSPM) in protecting data in an increasingly AI-driven world.

Fast forward to 2026, and the story has evolved significantly. DSPM is no longer just about knowing where sensitive data resides. It is becoming a unified security posture layer for data, AI applications, and AI agents.

DSPM and DSPM for AI Are Now One Solution

The biggest structural change is that the new DSPM experience brings together capabilities that were previously delivered through DSPM (classic) and DSPM for AI (classic).

• Outcome-based guided workflows, where administrators select a security objective such as Prevent oversharing of sensitive data and Purview guides them through the entire remediation process.
• The conversation shifts from "Which Purview solution should I configure?" to "What data security outcome am I trying to achieve?"
• Existing classic policies are carried forward automatically with no administrator action required.

AI Observability Becomes a Core Capability

For organizations deploying Microsoft 365 Copilot, Copilot Studio agents, or other generative AI solutions, observability is becoming a foundational security requirement.

As AI adoption moves into production workloads, understanding how AI interacts with enterprise data becomes just as important as protecting the data itself.

• Visibility into which AI applications and agents are actively being used, including Microsoft 365 Copilot, Copilot Studio agents, and supported third-party AI services.
• Tracking of sensitive data interactions, oversharing risks, exfiltration events, and unusual access patterns associated with specific agents.
• For supported AI workloads, prompts and responses can be captured through Purview auditing, providing security teams with an investigative trail showing how AI systems interacted with enterprise data.

You can no longer assume that protecting the data repository is enough. Organizations must also understand how AI systems are using the data they can access.

Copilot Studio Agents Enter the Governance Conversation

Perhaps the most significant shift since the original DSPM story is that organizations are rapidly moving from using Copilot to building their own agents.

Purview now treats Copilot Studio agents as enterprise workloads requiring governance rather than simply another business application.

Supported capabilities for Copilot Studio agents now include:

• DSPM
• Auditing
• Data Classification
• Sensitivity Labels
• Data Loss Prevention (DLP)
• Insider Risk Management
• Communication Compliance
• eDiscovery
• Data Lifecycle Management
• Compliance Manager

Microsoft has also extended coverage to agents grounded in Dataverse data, while providing visibility into unauthenticated interactions with Copilot Studio agents.

Microsoft Agent 365 Raises the Stakes Further

Microsoft's Agent 365 vision introduces agents as first-class organizational entities capable of collaborating with people, tools, and other agents.

Purview extends the same governance capabilities, including DSPM, auditing, classification, DLP, Insider Risk Management, eDiscovery, and compliance controls, to Agent 365 interactions.

The bigger shift is that Purview now audits:

• Agent-to-human interactions
• Human-to-agent interactions
• Agent-to-tool interactions
• Agent-to-agent interactions

This expands the security model from protecting users and applications to protecting an environment where humans and autonomous agents interact with data, tools, and each other.

AI Is Also Being Used to Secure the Data

An interesting feedback loop is emerging. Microsoft is not only using Purview to secure AI but also using AI to help secure data.

• Embedded Security Copilot experiences allow administrators to ask natural-language questions about their data security posture.
• AI-assisted remediation can act directly on findings by removing public sharing links, applying DLP policies, or revoking excessive permissions.
• Administrators remain in control, with actions available for review, approval, and customization, while maintaining full auditability.

Proactive Investigations, Not Just Dashboards

DSPM now integrates with Data Security Investigations, which can automatically create and refresh investigations analyzing recently exfiltrated sensitive data using defined risk categories.

The real challenge is no longer collecting more telemetry. It is finding the right signal within that telemetry, and AI-assisted investigation and triage are increasingly helping organizations focus on the highest-risk events.

Coverage Extends Well Beyond Microsoft 365

DSPM now spans Microsoft 365, Azure, Fabric, and integrated third-party SaaS environments, including Google Cloud Platform, Snowflake, and Databricks, through partner integrations with Varonis, Cyera, BigID, and OneTrust.

The direction is clear: moving toward a more unified view across the enterprise data estate rather than focusing solely on Microsoft workloads.

Microsoft Foundry Becomes Part of the AI Security Picture

The same strategy is extending to Microsoft Foundry, where Microsoft Purview delivers data security and compliance controls for Foundry AI interactions.

Capabilities include:

• DSPM
• Auditing
• Data Classification
• Sensitivity Labels
• Data Loss Prevention
• Insider Risk Management
• Communication Compliance
• eDiscovery
• Data Lifecycle Management

This brings custom-built AI solutions into the broader Purview governance and security ecosystem.

The Model Has Genuinely Broadened

The evolution of Microsoft Purview DSPM over the last year can be summarized in a single diagram:

The scope has expanded from protecting data alone to securing the complete AI ecosystem around that data.

What This Means for Organizations

An employee opening a sensitive document represents one type of risk.

An AI agent that can access thousands of documents, correlate signals across systems, and take autonomous action introduces an entirely different risk profile.

Organizations now need to think across five interconnected layers:

• Data Security: Who can access the data?
• AI Security: Which AI applications can process it?
• Agent Security: Which agents can access it and act upon it?
• Governance: Is activity monitored, auditable, and compliant?
• Posture Management: Can risks be continuously detected and remediated?

Bottom Line

DSPM has quietly become one of the most important governance surfaces in the Microsoft ecosystem.

Not because of a single headline feature, but because it answers the question every security team is increasingly being asked:

"Do you know where your sensitive data is going once AI and AI agents begin interacting with it?"

The shift from 2025 to 2026 is more than incremental. It represents an expansion from protecting data from AI to also using AI to protect data.

In many ways, Microsoft Purview DSPM is becoming the governance backbone of Microsoft's AI ecosystem. As organizations move from experimenting with AI to deploying autonomous agents at scale, visibility, governance, investigation, and remediation become just as important as data protection itself.

With Microsoft 365 Copilot, Copilot Studio, Microsoft Foundry, and Agent 365 accelerating the move toward an agentic workplace, this is a topic worth understanding before the next security review cycle.

Read More

• Microsoft Purview Data Security Posture Management
• Microsoft Purview data security and compliance protections for generative AI apps
• Microsoft Purview for Copilot Studio
• Microsoft Purview for Agent 365
• Microsoft Purview for Microsoft Foundry
• What's new in Microsoft AI security

Copilot in 30: Microsoft's New SMB Copilot Trial Explained

Microsoft just opened a new, limited-time door into Microsoft 365 Copilot Business — but it's a door built for one specific segment. Here's what it actually offers, who qualifies, and where Enterprise customers stand instead.

What Is Copilot in 30?

Copilot in 30 is a new, CSP partner-led Microsoft 365 Copilot Business trial, live since August 1, 2026 and available through December 31, 2026.

• 25 users, 30 days, $0 cost

• Delivered through CSP New Commerce (product ID CFQ7TTC0MM8R, SKU 006Z)

• One trial per customer — no extensions or seat changes mid-trial

• Auto-renews to a paid subscription by default, with a 7-day cancellation window

It's part of Microsoft's broader FY27 push to accelerate Copilot adoption through its partner ecosystem.

Who Actually Qualifies

This is the part worth getting right before recommending it to anyone.

Eligible:

• Organizations with fewer than 300 employees

• Microsoft 365 Business customers

• Customers onboarded through a CSP partner

Not eligible for Copilot in 30:

• Individuals — there's no consumer path into this trial

• Enterprise tenants on E3, E5, or E7

• Direct (non-CSP) purchase motions

Eligibility is tied to the offer and licensing model, not simply company size. A 40-person company on E5 does not qualify for Copilot in 30 — being an SMB by headcount does not override the enterprise SKU.

Where Enterprise Customers Stand

If you're on E3 or E5, Microsoft 365 Copilot remains a $30/user/month add-on at standard list pricing. However, the Copilot in 30 offer is not the trial route available to those enterprise SKUs.

If you're on Microsoft 365 E7 — the Frontier Suite — Copilot is already included. E7, at $99/user/month, bundles:

• Microsoft 365 E5 as the base

• Microsoft 365 Copilot — included natively, no add-on required

• The full Microsoft Entra Suite

• Agent 365 — the new control plane for governing AI agents

For E7 tenants, there's simply nothing to trial — Copilot is already part of the license, working inside Word, Excel, PowerPoint, Outlook, and Teams from day one.

The bigger E7 proposition, however, isn't just the included Copilot. It's the combination of Copilot, identity, security, and agent governance in a single enterprise suite.

Copilot Success Planner: Turning the Trial Into a Plan

Microsoft has now layered a structured onboarding tool on top of Copilot in 30, called the Copilot Success Planner.

The idea is simple: a 30-day trial is only useful if people actually use it. So instead of leaving all 25 trial users to figure out Copilot on their own, the planner gives each user a personalized 30-day learning plan, built around role-relevant prompts and Microsoft support resources for each guided action.

The rollout works like this:

• The company sponsor completes a short, guided setup experience
• From there, the planner takes over, guiding all 25 users through the four weeks of the trial automatically
• Each user gets prompts and guidance relevant to their own role, rather than a generic "here's Copilot" walkthrough

For partners, this closes a gap that trials usually struggle with — adoption follow-through. A free trial without structure often ends in low usage and no real evaluation of value. With the Success Planner attached, Copilot in 30 becomes less of a raw trial and more of a guided 30-day rollout.

Review: Partner Alert – Copilot Success Planner

See how Planner can help your Customers to get more from their trial: aka.ms/Copilotin30

Quick Reference

Copilot in 30 — SMB

• Copilot cost: $0 for 30 days
• Eligibility: Organizations with fewer than 300 employees, eligible Microsoft 365 Business customers, through a CSP partner
• Duration: 30-day trial, 25 users
• Delivery: CSP partner

Microsoft 365 E3 / E5 — Enterprise

• Copilot cost: $30/user/month add-on
• Eligibility: Eligible enterprise base license
• Duration: Ongoing
• Delivery: Direct or CSP

Microsoft 365 E7 — Enterprise

• Copilot cost: Included
• Eligibility: E7 subscription
• Duration: Ongoing
• Delivery: Direct or CSP
• Includes: Microsoft 365 E5 + Microsoft 365 Copilot + Microsoft Entra Suite + Agent 365

Copilot in 30 is a well-targeted SMB on-ramp, not a universal Copilot trial. If you're under 300 employees and on an eligible Microsoft 365 Business plan through a CSP partner, this is worth a conversation before the December 31, 2026 window closes — and with the new Copilot Success Planner now attached, that trial comes with a guided 30-day plan for every user instead of leaving adoption to chance.

If you're already on E3 or E5, you're looking at the standard Copilot add-on — and it's worth running the numbers on whether selective Copilot licensing or the broader E7 proposition makes more sense long-term.

And if you're already on E7, there's nothing to trial — Copilot is already included. The bigger opportunity is taking advantage of the broader E7 capabilities around identity, security, and agent governance.

Know your SKU before you go looking for a trial; it decides which door you're standing at.

Read here to know more: From AI curiosity to Copilot adoption in 30 Days – Microsoft Partner Blog

Also review: Prepare for Microsoft Copilot by comparing E3, E5, and E7 license features – Microsoft Learn

Stay tuned for more updates...

Microsoft Unifies Copilot: Work IQ Takes Center Stage

Microsoft is making another significant change to Copilot. The company is bringing Microsoft Copilot and Microsoft 365 Copilot closer together through a unified experience, while positioning Work IQ as a foundational intelligence layer for Microsoft 365 Copilot.

Microsoft has also announced updates to the Copilot app experience — personal and work accounts can now coexist within a single application, while maintaining separate security and compliance boundaries.

At the same time, many users are noticing changes to the familiar Work/Web experience. Microsoft hasn't officially announced the retirement of Work or Web modes — but recent updates suggest identity, context, and intelligent grounding are becoming more important than manually picking a mode.

This follows Microsoft's broader Copilot strategy announced earlier this year, where consumer and commercial Copilot efforts were brought together under unified leadership and product vision.

Work IQ Takes Center Stage

One of the most interesting developments here is Microsoft's growing emphasis on Work IQ.

Work IQ acts as Microsoft's workplace intelligence layer — helping Copilot and agents understand your business context across:

• Emails
• Meetings
• Teams chats
• Files and documents
• Organizational knowledge

Rather than simply responding to a prompt, Copilot can reason over relevant business information and organizational context to generate more meaningful assistance. Microsoft describes Work IQ as helping Copilot ground its responses in files, meetings, chats, and business data.

You'll increasingly see messaging like this in Microsoft 365 Copilot:

"Answers are powered by Work IQ, which reasons over your meetings, emails, chats, files, and more."

The goal isn't just to provide answers — it's to understand the context surrounding the work itself.

Is Work/Web Going Away?

Understandable confusion here.

Some users have reported the familiar Work and Web options changing or disappearing from parts of the Copilot experience. But based on Microsoft's published documentation, it would be inaccurate to say work grounding and web grounding have been eliminated.

In fact, Microsoft's July 2026 Copilot updates introduced Domain Exclusion for Web Grounding — letting admins exclude up to 1,000 domains from Copilot's web-grounded responses. That confirms web grounding is still very much part of the platform.

The distinction between organizational information, public web information, identity/permissions, and security/compliance boundaries remains extremely important.

A better way to think about the transition:

Work/Web Selection → Work IQ + Context

(not "Work/Web Removal")

The grounding mechanisms remain. The user experience is evolving.

One App Does Not Mean One Experience

Here's the important part: a single app doesn't mean every user gets the same experience. What you actually get depends on:

• Identity
• Licensing
• Permissions
• Available data sources

Work account experience: signed in with a Microsoft 365 Copilot license, Copilot can pull from Outlook, Teams chats, meeting transcripts, SharePoint, OneDrive, organizational knowledge, Graph data, and Work IQ grounding — a fully workplace-aware experience.

Personal account experience: Copilot operates within your personal account and connected services. The app may look similar, but available data, grounding sources, and capabilities differ significantly. Work and personal accounts stay separated, with enterprise security, compliance, governance, and privacy controls continuing to apply to work accounts.

One Copilot app does not mean one Copilot experience. The app is unified — the intelligence available to it still depends on who you are, what data you can access, and which licenses you hold.

This may explain Microsoft's increased emphasis on Work IQ, context, identity, and grounded reasoning as the Copilot experience continues to evolve.

A More Unified Copilot Experience

Microsoft is consolidating multiple Copilot experiences into a single application, combining:

• Copilot Chat
• Image creation
• Microsoft 365 capabilities
• Access to files and content
• Productivity workflows across Microsoft 365

You can sign in with a personal account, a work/school account, or both simultaneously — while security, privacy, compliance, and governance boundaries stay separate. Organizational data remains protected through existing Microsoft 365 controls.

Net result: a simpler user experience, and a shrinking line between consumer and commercial entry points.

August 18, 2026: The Transition Becomes Visible

Microsoft has announced the retirement of selected Copilot experiences, including Group Chat, Podcasts and Deep Research in the consumer Copilot app, as the updated Copilot experience rolls out.

This makes the current change more than a future roadmap item — users will start seeing the new direction in the Copilot experience now.

Why Work IQ Matters for Agents

This might be the biggest takeaway from the whole announcement.

Copilot is moving beyond the traditional chatbot experience. Take a prompt like: "Prepare me for tomorrow's customer meeting."

A generic AI assistant produces a standard checklist. A workplace-aware Copilot can reason over recent emails, calendar appointments, Teams discussions, previous meetings, shared documents, relevant stakeholders, and organizational context — to generate a genuinely useful response instead.

That's where Work IQ earns its keep: it provides the workplace context that lets Copilot and future agents move from answering questions to helping users complete meaningful work.

From Work IQ to Cowork

Work IQ provides the context. Cowork represents what happens when that context can be used to carry out multi-step work.

This is an important distinction in Microsoft's evolving Copilot architecture. The value isn't simply that Copilot knows more about your work; it's that increasingly capable AI can use that context to help execute the work itself.

Microsoft's “(Co)work in Progress” provides a useful look at this direction.

This direction lines up closely with Microsoft's ongoing investments in Copilot Studio, Agent 365, Copilot Chat, and context-aware agent experiences.

My Take

The most important change here isn't the new branding, icon, or app experience.

The real change is Microsoft making context a first-class component of Copilot.

Historically, many users asked: Should I use Work or Web? The emerging question is: What does Copilot need to understand about my work to help me accomplish this task?

Microsoft is moving Copilot from:

Chat → Answer

toward:

Context → Intelligence → Agent → Action

The application is becoming unified. The experience remains context-driven. And Work IQ could become one of the most important building blocks in that transition.

References

• Announcing Copilot leadership update — The Official Microsoft Blog
• Updates to Copilot and the Microsoft Copilot app — Microsoft Support
• Copilot Just Changed Again — August 2026 | Updates From A Microsoft Engineer — YouTube
• Microsoft is merging Copilot and Copilot 365 into one unified app — and retiring 3 features — MSN

Note: Microsoft has not officially announced the retirement of Work and Web modes. Observations in this article are based on Microsoft's published documentation, Work IQ announcements, Copilot app changes, and the ongoing Copilot unification initiative.

Microsoft Agent-a-Thon: Build an AI Agent, Live, in One Session

 No code. Real impact. Microsoft is running a global, hands-on Agent-a-Thon on September 17, 2026 — a live, guided build session where you walk away with an actual working AI agent, not just slides. 

The Agent-a-Thon is a free, live virtual event structured around three levels, each aligned to a different agent tool and depth of build. You pick the level that matches your skill and role, follow a short pre-learning course beforehand (delivered with Founderz), then join a live session with real-time support to actually build. 

Level 1: Explorer — Build Your First AI Agent Uses Agent Builder in Microsoft 365 Copilot. No-code, fundamentals-focused — ideal if you want to see how quickly an idea becomes a working agent.

Level 2: Maker — Build Powerful AI Agents Uses Copilot Studio. Still no-code, but focused on automating work, connecting systems, and building scalable agents that solve real organizational problems.

Level 3: Architect — Build Production-Grade Agents on Microsoft Foundry For developers, engineers, and architects. Covers orchestration, multi-agent capabilities, and secure, production-grade workflows — taking an agent from prototype to production at speed.

When and Where

All three levels run on September 17, 2026, with separate live sessions across three regional blocks:

• Americas — 11:00 AM–2:00 PM ET
• Asia (Australia, NZ, ASEAN, India, Korea, Japan, GCR) — 2:00 PM–5:00 PM AEST
• EMEA — 12:30 PM–3:30 PM (GMT+1)

Each region and level has its own registration link, so pick the one matching your timezone and the level that fits your role.

Why It's Worth Blocking the Time

This isn't a webinar you passively watch — it's a genuine build session with live support, meaning you leave with a working agent and hands-on familiarity with the tool, not just notes. There's also a competitive angle: participants can qualify for recognition and prizes, including a Microsoft Surface Pro grand prize. 

For anyone still mapping which of Microsoft's build tools fits their role — a question this blog has spent the last few weeks untangling — this is the fastest way to get real hands-on time with three of them (Agent Builder, Copilot Studio, and Foundry) in a single day, guided, with nothing to lose by trying.

Pick your level based on how deep you want to go — Explorer if you're new to agent building, Maker if you're solving a real business workflow, Architect if you're the one who'll own this in production. Either way, register early and do the pre-learning course so the live session actually lands.

Read here to know more: Microsoft Agent-a-Thon – Official Event Page

Zero Trust Workshop + Assessment: Microsoft's Two-Tool Framework for Your Zero Trust Journey

Zero Trust isn't a single project — it's a journey that needs both a plan and a way to measure progress. Microsoft just brought those two pieces together under one roof, with fresh pillars on both sides. Here's the roundup. 

The Framework: Two Tools, One Mission

Microsoft now frames Zero Trust around a simple pairing: plan with the Workshop, assess with the Assessment. Both live together at the new Microsoft Zero Trust hub, alongside a step-by-step guide for running a full Zero Trust strategy session.

Tool 1: Zero Trust Workshop — Now with DevSecOps

The Workshop is the planning side — an interactive tool to build your Zero Trust roadmap. It just picked up an 8th pillar: DevSecOps, bringing application security and dev practices formally into the framework. 

• 8 pillars, including the new DevSecOps pillar
• First-Then-Next structure to prioritize what to tackle and when
• Auto-generated summaries and implementation plans tailored to your org

Try it: Launch Workshop →

Tool 2: Zero Trust Assessment — Expanded Coverage

The Assessment is the measurement side — it connects to your Microsoft Entra tenant and automates posture checks. Coverage now spans 7 pillars, with Infrastructure, Security Operations, and AI added this round, plus a revamped Overview page for aggregated insights. 

• 7 pillars, including Infrastructure, Security Operations, and AI
• Connects directly to your Entra tenant for automated checks
• Guides you through prioritized, actionable remediation
• New Overview page for a single view of risk across pillars

Try it: Run Assessment →

(We covered the Assessment's pillar expansion in our previous roundup — this is the fuller picture, now paired with the Workshop.)

See It First

Not ready to connect a tenant yet? Walk through a live demo of the Assessment experience — including the new Infrastructure, Security Operations, and AI pillar views — before you run it for real. 👀

Explore: View Assessment Demo →

Go Deeper

• Step-by-Step Delivery Guide — for running a full Zero Trust strategy session, partner or internal

• Zero Trust Guidance Center

• Zero Trust Partner Kit

• GitHub Repo

Bottom Line

Plan with the Workshop, measure with the Assessment — that's Microsoft's Zero Trust pitch now, and the toolset finally matches it. If you've only run the Assessment so far, the Workshop's new DevSecOps pillar is worth a look. 

Copilot Studio, Agents Toolkit, Copilot Agent Kit, Agent 365 — Untangling Microsoft's Agent Naming Maze

If you've tried to figure out which Microsoft tool actually does what in the agent-building space, you're not alone. The names sound almost interchangeable — Agents Toolkit, Copilot Agent Kit, Agent Builder, Agent 365 — but they solve completely different problems. Here's the map, straight from Microsoft's own documentation.

Start With the Question: Build, Manage or Govern?

Most of the tools in this space fall into the below broad layers:

• Build — Agents Toolkit, Copilot Studio, Agent Builder, SharePoint agents
• Manage & optimize — Copilot Agent Kit
• Govern & secure — Agent 365

Mixing these up is where most of the confusion starts.

The Build Tools: Four Options, No-Code to Pro-Code

Microsoft's own comparison guide lists four supported tools for building a declarative agent for Microsoft 365 Copilot, spanning pro-code, low-code, and no-code approaches:

• Microsoft 365 Agents Toolkit (pro-code) — built for developers who need full control over their coding environment, source control, and direct API integration. It supports custom API actions, advanced Adaptive Cards, the Microsoft 365 Agents SDK, CI/CD integration, and local testing through the Microsoft 365 Agents Playground — without needing a developer tenant or a tunneling tool like ngrok. New capabilities are often available first here before reaching Copilot Studio or Agent Builder. The trade-off: no drag-and-drop Power Platform connectors, and agents built here can't be reused in low-code tools like Copilot Studio.

• Copilot Studio (low-code) — a drag-and-drop interface with Power Platform integration and hundreds of prebuilt connectors. Don't mistake "low-code" for "small-scale": Microsoft's guidance positions it for agents that integrate external data sources, call APIs, orchestrate complex workflows, and connect to systems beyond Microsoft 365 — ideal for departmental or enterprise-wide solutions, with prebuilt governance and deployment tooling built in.

• Agent Builder (no-code) — built directly into Microsoft 365 Copilot. Users just describe what the agent should do, with no coding experience required. Ideal for quick, lightweight agents — a writing coach, an onboarding buddy — for personal or small-team productivity.

• SharePoint agents (no-code) — created by site owners or editors, drawing only on a specific site's document libraries. Easy to access since they're integrated directly into SharePoint and discoverable in Teams, but not built for large-scale or highly complex use cases.

Two details worth knowing:

• Agents Toolkit and Copilot Studio are not interchangeable paths — Agents Toolkit and Copilot Studio follow different development models and artifacts. Migration or reuse is not a simple lift-and-shift exercise.
• Agent Builder and Copilot Studio, by contrast, do connect: Microsoft documents a Copy to Copilot Studio option directly inside Agent Builder's menu, letting you start lightweight and graduate an agent into Copilot Studio's advanced lifecycle management, analytics, and governance controls once you outgrow the in-chat builder.

The Management and Governance Tools: Two, Scoped Very Differently

Copilot Agent Kit, built and maintained by the Power CAT team, provides tools to build, test, govern, and optimize custom agents in the Copilot Studio ecosystem. It's not a separate agent-building platform — it's a toolkit that adds testing, debugging, governance, analytics, and optimization capabilities around your agents.

• Batch testing with pass/fail results and latency data
• Compliance Hub, which continuously evaluates agent configurations against governance controls to flag risks and policy violations
• Agent Inventory, giving admins a tenant-wide view of every custom agent, its authentication mode, and knowledge sources
• Agent Debugger, Agent Review Tool, and an Agent Value dashboard for classifying agents by business impact

Microsoft Agent 365 governs agents at enterprise scale — Microsoft's own documentation describes it as providing the ability to observe, govern, and secure the growing number of agents within an organization, extending Microsoft's identity, data, and threat-defense capabilities across the AI ecosystem. In practice that means:

• A centralized agent registry inside the Microsoft 365 admin center, giving a unified view of agent adoption, activity, and health
• Microsoft Entra enforcing risk-based access controls for users and agents acting on their behalf
• Microsoft Purview providing visibility into data risks through information protection and DLP
• Microsoft Defender extending threat detection and protection across the agent ecosystem
• An Agent 365 SDK, for developers who want to connect existing agents to Microsoft Agent 365 for enterprise-grade visibility, governance, security, identity, and lifecycle management, regardless of where or how the agent was built.

Agent 365 extends the same infrastructure organizations already use for managing people — identity, access, compliance — to agents instead.

The Practical Takeaway

• Need full pro-code control, source control, CI/CD? → Microsoft 365 Agents Toolkit

• Need a low-code agent with workflows, integrations, and enterprise-grade lifecycle management? → Copilot Studio

• Need to build a simple agent quickly, no code? → Agent Builder

• Need an agent grounded in one SharePoint site's content? → SharePoint agents

• Need to test, debug, and optimize a Copilot Studio agent? → Copilot Agent Kit

• Need to govern every agent across the org, any platform? → Agent 365

None of these compete with each other — they sit at different layers of the same stack. The real skill isn't picking a favorite; it's knowing which layer you're actually solving for.

Worth Knowing: A Few More Pieces Not Covered Here

This post focused on the Microsoft 365 Copilot side of the agent story — but the wider Microsoft agent ecosystem goes further, and it's worth knowing these exist even though they're outside today's scope:

• Microsoft Foundry — Microsoft's broader AI platform for building, deploying, and scaling AI applications and agents. It provides access to models, agent services, tools, evaluation, observability, security, and governance, and supports agents built with different frameworks and models. It is a strong fit when an agent needs to run and scale as an Azure-based workload rather than primarily living inside Microsoft 365.

• Microsoft Agent Framework — Microsoft's unified, multi-language framework for building, orchestrating, and deploying AI agents and multi-agent workflows, with support for Python, .NET, and Go (Go currently in public preview). It brings together concepts and capabilities from Semantic Kernel and AutoGen, providing primitives for workflows, memory, tools, middleware, human-in-the-loop scenarios, and agent-to-agent interactions.

• Microsoft Entra Agent ID — provides dedicated identities for AI agents, separate from human users and traditional application identities. It provides the identity foundation for authenticating and authorizing agents, managing their lifecycle, and applying access and governance controls as agents interact with enterprise resources.

These deserve their own dedicated post rather than a rushed mention here — but if you're mapping out an enterprise agent strategy, know that the six tools above aren't the whole picture.

The Bottom Line

Microsoft's naming hasn't made this easy — the capabilities and trade-offs evolve quickly, and some capabilities may appear in Agents Toolkit before reaching Copilot Studio or Agent Builder. "But once build, management, and governance are separated, and Copilot Agent Kit and Agent 365 are understood as operating at entirely different scopes rather than competing, the picture holds together. Bookmark this if an agent strategy conversation is coming up — it'll save the same untangling exercise this post just went through.

Read here to know more: Choose the Right Tool to Build a Declarative Agent – Microsoft Learn

Also review: Copilot Agent Kit overview – Microsoft Learn

And: Microsoft Agent 365 overview – Microsoft Learn

For the wider ecosystem: Microsoft Foundry documentation and Microsoft Agent Framework overview

Also watch: Modernizing Azure Agents with Agentic Identities

Stay tuned for more updates...

Analytics Hub: Microsoft's Free Toolkit to Measure Copilot Adoption, Impact & ROI

Every enterprise rolling out Microsoft 365 Copilot eventually hits the same question from leadership: "Is it actually working?" Microsoft just made it a lot easier to answer — with data, not guesswork.

What Is Analytics Hub?

Analytics Hub is an open-source collection of 23 Power BI templates, PowerShell exporters, and web apps built to measure Copilot adoption, agent usage, sentiment, ROI, license utilization, and super-user impact — all running entirely inside your own tenant. Nothing is uploaded, no telemetry leaves, and everything is MIT-licensed, so you can fork it and adapt the measures to your own environment. 📊

Where This Fits Alongside What You Already Have

Analytics Hub isn't the first way to measure Copilot adoption — Microsoft already ships a few native options, and it's worth knowing where each one stops before you see why this toolkit matters:

• Microsoft 365 Copilot Dashboard (in Viva Insights) — the out-of-the-box starting point. Gives org-level usage trends, feature adoption, and a baseline "time saved" estimate, but stays fairly high-level and doesn't go deep on cost, license optimization, or agent-level detail.

• Viva Insights advanced reporting — richer person- and group-level behavioral data, but built for broader productivity analytics, not Copilot-specific ROI framing.

• Microsoft 365 Admin Center usage reports — solid for raw license assignment and activation counts, but not built to answer "is this actually driving value."

• Power Platform admin center analytics — covers Copilot Studio agent-level usage, but lives in its own silo, separate from M365 Copilot and GitHub Copilot data.

Each of these is genuinely useful, but they're scattered across different portals, and none of them stitch adoption, cost, and ROI into one defensible story you can take to leadership. That's the gap Analytics Hub closes — it's less a replacement for these native tools and more the connective layer on top, pulling from the same underlying data (Purview, Entra, Viva Insights, Copilot credit consumption) into a unified, fork-and-customize reporting layer.

Two Standout New Additions

• ValueLens for Microsoft Copilot Turns every Copilot and agent signal into hours saved, assisted value, and adoption maturity — a defensible ROI story instead of a raw seat count. Also covers licence readiness for renewals and agent governance for sprawl.

• Consumption Central One template covering Copilot credit consumption and cost across four products — Cowork/Work IQ, Copilot Studio, GitHub Copilot, and Azure AI Foundry. Four separate portals, finally rolled into one view — genuinely useful if you're tracking spend the way I broke down in my Copilot Credits post.

What Else Is in the Toolkit

The catalog spans six categories, and there's real depth here:

• Usage & Intelligence — AI-in-One Dashboard (the flagship, unifying Copilot, Copilot Chat, Agents, and third-party AI signals), Copilot Chat & Agent Intelligence, StudioLens for Copilot Studio

• Adoption & Behaviour — Super Usage Adoption, Super User Impact, Adoption & Sentiment Report, Personal Copilot Dashboard

• Impact & ROI — Cowork Billing Report, Cowork ROI Model, Cowork Chargeback, FinOps & FOCUS Cost Report, ESS Insights

• Readiness — M365 Copilot Readiness Report (ranks users by app fluency to plan enablement waves), Cowork Policy Helper

• Developer — GitHub Copilot Impact, What I Did: Copilot Impact Report

• Tooling — PAX (Portable Audit eXporter for Purview/Entra), CustomizeCopilot add-on library

Most templates ship with a synthetic sample dataset, so you can preview the full report before pointing it at a live tenant. 

If you're accountable for Copilot adoption or spend in any capacity, this is worth exploring this week — start with the Explore Reports matrix, pick the two or three templates matching your immediate question (adoption? cost? readiness?), and run them against the sample data before touching your tenant.

A quick credit where it's due: this toolkit is built and maintained by Microsoft's Growth & Incubation team — People Scientists, Business Value Advisors, and Solutions Architects who, by their own words, read every GitHub issue and feed reader friction back into the next release. It's rare to see this level of practitioner-built, genuinely free tooling from a vendor. Worth a thank-you if it saves you the build effort. 

Read here to know more: Analytics Hub – Microsoft

Explore the full catalog: Explore Reports – Analytics Hub