Microsoft Purview DSPM in 2026: Securing Data, AI Apps and Agents

Back in November 2025, I wrote about Microsoft Purview at Ignite and the growing role of Data Security Posture Management (DSPM) in protecting data in an increasingly AI-driven world.

Fast forward to 2026, and the story has evolved significantly. DSPM is no longer just about knowing where sensitive data resides. It is becoming a unified security posture layer for data, AI applications, and AI agents.

DSPM and DSPM for AI Are Now One Solution

The biggest structural change is that the new DSPM experience brings together capabilities that were previously delivered through DSPM (classic) and DSPM for AI (classic).

• Outcome-based guided workflows, where administrators select a security objective such as Prevent oversharing of sensitive data and Purview guides them through the entire remediation process.
• The conversation shifts from "Which Purview solution should I configure?" to "What data security outcome am I trying to achieve?"
• Existing classic policies are carried forward automatically with no administrator action required.

AI Observability Becomes a Core Capability

For organizations deploying Microsoft 365 Copilot, Copilot Studio agents, or other generative AI solutions, observability is becoming a foundational security requirement.

As AI adoption moves into production workloads, understanding how AI interacts with enterprise data becomes just as important as protecting the data itself.

• Visibility into which AI applications and agents are actively being used, including Microsoft 365 Copilot, Copilot Studio agents, and supported third-party AI services.
• Tracking of sensitive data interactions, oversharing risks, exfiltration events, and unusual access patterns associated with specific agents.
• For supported AI workloads, prompts and responses can be captured through Purview auditing, providing security teams with an investigative trail showing how AI systems interacted with enterprise data.

You can no longer assume that protecting the data repository is enough. Organizations must also understand how AI systems are using the data they can access.

Copilot Studio Agents Enter the Governance Conversation

Perhaps the most significant shift since the original DSPM story is that organizations are rapidly moving from using Copilot to building their own agents.

Purview now treats Copilot Studio agents as enterprise workloads requiring governance rather than simply another business application.

Supported capabilities for Copilot Studio agents now include:

• DSPM
• Auditing
• Data Classification
• Sensitivity Labels
• Data Loss Prevention (DLP)
• Insider Risk Management
• Communication Compliance
• eDiscovery
• Data Lifecycle Management
• Compliance Manager

Microsoft has also extended coverage to agents grounded in Dataverse data, while providing visibility into unauthenticated interactions with Copilot Studio agents.

Microsoft Agent 365 Raises the Stakes Further

Microsoft's Agent 365 vision introduces agents as first-class organizational entities capable of collaborating with people, tools, and other agents.

Purview extends the same governance capabilities, including DSPM, auditing, classification, DLP, Insider Risk Management, eDiscovery, and compliance controls, to Agent 365 interactions.

The bigger shift is that Purview now audits:

• Agent-to-human interactions
• Human-to-agent interactions
• Agent-to-tool interactions
• Agent-to-agent interactions

This expands the security model from protecting users and applications to protecting an environment where humans and autonomous agents interact with data, tools, and each other.

AI Is Also Being Used to Secure the Data

An interesting feedback loop is emerging. Microsoft is not only using Purview to secure AI but also using AI to help secure data.

• Embedded Security Copilot experiences allow administrators to ask natural-language questions about their data security posture.
• AI-assisted remediation can act directly on findings by removing public sharing links, applying DLP policies, or revoking excessive permissions.
• Administrators remain in control, with actions available for review, approval, and customization, while maintaining full auditability.

Proactive Investigations, Not Just Dashboards

DSPM now integrates with Data Security Investigations, which can automatically create and refresh investigations analyzing recently exfiltrated sensitive data using defined risk categories.

The real challenge is no longer collecting more telemetry. It is finding the right signal within that telemetry, and AI-assisted investigation and triage are increasingly helping organizations focus on the highest-risk events.

Coverage Extends Well Beyond Microsoft 365

DSPM now spans Microsoft 365, Azure, Fabric, and integrated third-party SaaS environments, including Google Cloud Platform, Snowflake, and Databricks, through partner integrations with Varonis, Cyera, BigID, and OneTrust.

The direction is clear: moving toward a more unified view across the enterprise data estate rather than focusing solely on Microsoft workloads.

Microsoft Foundry Becomes Part of the AI Security Picture

The same strategy is extending to Microsoft Foundry, where Microsoft Purview delivers data security and compliance controls for Foundry AI interactions.

Capabilities include:

• DSPM
• Auditing
• Data Classification
• Sensitivity Labels
• Data Loss Prevention
• Insider Risk Management
• Communication Compliance
• eDiscovery
• Data Lifecycle Management

This brings custom-built AI solutions into the broader Purview governance and security ecosystem.

The Model Has Genuinely Broadened

The evolution of Microsoft Purview DSPM over the last year can be summarized in a single diagram:

The scope has expanded from protecting data alone to securing the complete AI ecosystem around that data.

What This Means for Organizations

An employee opening a sensitive document represents one type of risk.

An AI agent that can access thousands of documents, correlate signals across systems, and take autonomous action introduces an entirely different risk profile.

Organizations now need to think across five interconnected layers:

• Data Security: Who can access the data?
• AI Security: Which AI applications can process it?
• Agent Security: Which agents can access it and act upon it?
• Governance: Is activity monitored, auditable, and compliant?
• Posture Management: Can risks be continuously detected and remediated?

Bottom Line

DSPM has quietly become one of the most important governance surfaces in the Microsoft ecosystem.

Not because of a single headline feature, but because it answers the question every security team is increasingly being asked:

"Do you know where your sensitive data is going once AI and AI agents begin interacting with it?"

The shift from 2025 to 2026 is more than incremental. It represents an expansion from protecting data from AI to also using AI to protect data.

In many ways, Microsoft Purview DSPM is becoming the governance backbone of Microsoft's AI ecosystem. As organizations move from experimenting with AI to deploying autonomous agents at scale, visibility, governance, investigation, and remediation become just as important as data protection itself.

With Microsoft 365 Copilot, Copilot Studio, Microsoft Foundry, and Agent 365 accelerating the move toward an agentic workplace, this is a topic worth understanding before the next security review cycle.

Read More

• Microsoft Purview Data Security Posture Management
• Microsoft Purview data security and compliance protections for generative AI apps
• Microsoft Purview for Copilot Studio
• Microsoft Purview for Agent 365
• Microsoft Purview for Microsoft Foundry
• What's new in Microsoft AI security

Copilot in 30: Microsoft's New SMB Copilot Trial Explained

Microsoft just opened a new, limited-time door into Microsoft 365 Copilot Business — but it's a door built for one specific segment. Here's what it actually offers, who qualifies, and where Enterprise customers stand instead.

What Is Copilot in 30?

Copilot in 30 is a new, CSP partner-led Microsoft 365 Copilot Business trial, live since August 1, 2026 and available through December 31, 2026.

• 25 users, 30 days, $0 cost

• Delivered through CSP New Commerce (product ID CFQ7TTC0MM8R, SKU 006Z)

• One trial per customer — no extensions or seat changes mid-trial

• Auto-renews to a paid subscription by default, with a 7-day cancellation window

It's part of Microsoft's broader FY27 push to accelerate Copilot adoption through its partner ecosystem.

Who Actually Qualifies

This is the part worth getting right before recommending it to anyone.

Eligible:

• Organizations with fewer than 300 employees

• Microsoft 365 Business customers

• Customers onboarded through a CSP partner

Not eligible for Copilot in 30:

• Individuals — there's no consumer path into this trial

• Enterprise tenants on E3, E5, or E7

• Direct (non-CSP) purchase motions

Eligibility is tied to the offer and licensing model, not simply company size. A 40-person company on E5 does not qualify for Copilot in 30 — being an SMB by headcount does not override the enterprise SKU.

Where Enterprise Customers Stand

If you're on E3 or E5, Microsoft 365 Copilot remains a $30/user/month add-on at standard list pricing. However, the Copilot in 30 offer is not the trial route available to those enterprise SKUs.

If you're on Microsoft 365 E7 — the Frontier Suite — Copilot is already included. E7, at $99/user/month, bundles:

• Microsoft 365 E5 as the base

• Microsoft 365 Copilot — included natively, no add-on required

• The full Microsoft Entra Suite

• Agent 365 — the new control plane for governing AI agents

For E7 tenants, there's simply nothing to trial — Copilot is already part of the license, working inside Word, Excel, PowerPoint, Outlook, and Teams from day one.

The bigger E7 proposition, however, isn't just the included Copilot. It's the combination of Copilot, identity, security, and agent governance in a single enterprise suite.

Quick Reference

Copilot in 30 — SMB

• Copilot cost: $0 for 30 days
• Eligibility: Organizations with fewer than 300 employees, eligible Microsoft 365 Business customers, through a CSP partner
• Duration: 30-day trial, 25 users
• Delivery: CSP partner

Microsoft 365 E3 / E5 — Enterprise

• Copilot cost: $30/user/month add-on
• Eligibility: Eligible enterprise base license
• Duration: Ongoing
• Delivery: Direct or CSP

Microsoft 365 E7 — Enterprise

• Copilot cost: Included
• Eligibility: E7 subscription
• Duration: Ongoing
• Delivery: Direct or CSP
• Includes: Microsoft 365 E5 + Microsoft 365 Copilot + Microsoft Entra Suite + Agent 365

Copilot in 30 is a well-targeted SMB on-ramp, not a universal Copilot trial. If you're under 300 employees and on an eligible Microsoft 365 Business plan through a CSP partner, this is worth a conversation before the December 31, 2026 window closes.

If you're already on E3 or E5, you're looking at the standard Copilot add-on — and it's worth running the numbers on whether selective Copilot licensing or the broader E7 proposition makes more sense long-term.

And if you're already on E7, there's nothing to trial — Copilot is already included. The bigger opportunity is taking advantage of the broader E7 capabilities around identity, security, and agent governance.

Know your SKU before you go looking for a trial; it decides which door you're standing at.

Read here to know more: From AI curiosity to Copilot adoption in 30 Days – Microsoft Partner Blog

Also review: Prepare for Microsoft Copilot by comparing E3, E5, and E7 license features – Microsoft Learn

Microsoft Unifies Copilot: Work IQ Takes Center Stage

Microsoft is making another significant change to Copilot. The company is bringing Microsoft Copilot and Microsoft 365 Copilot closer together through a unified experience, while positioning Work IQ as a foundational intelligence layer for Microsoft 365 Copilot.

Microsoft has also announced updates to the Copilot app experience — personal and work accounts can now coexist within a single application, while maintaining separate security and compliance boundaries.

At the same time, many users are noticing changes to the familiar Work/Web experience. Microsoft hasn't officially announced the retirement of Work or Web modes — but recent updates suggest identity, context, and intelligent grounding are becoming more important than manually picking a mode.

This follows Microsoft's broader Copilot strategy announced earlier this year, where consumer and commercial Copilot efforts were brought together under unified leadership and product vision.

Work IQ Takes Center Stage

One of the most interesting developments here is Microsoft's growing emphasis on Work IQ.

Work IQ acts as Microsoft's workplace intelligence layer — helping Copilot and agents understand your business context across:

• Emails
• Meetings
• Teams chats
• Files and documents
• Organizational knowledge

Rather than simply responding to a prompt, Copilot can reason over relevant business information and organizational context to generate more meaningful assistance. Microsoft describes Work IQ as helping Copilot ground its responses in files, meetings, chats, and business data.

You'll increasingly see messaging like this in Microsoft 365 Copilot:

"Answers are powered by Work IQ, which reasons over your meetings, emails, chats, files, and more."

The goal isn't just to provide answers — it's to understand the context surrounding the work itself.

Is Work/Web Going Away?

Understandable confusion here.

Some users have reported the familiar Work and Web options changing or disappearing from parts of the Copilot experience. But based on Microsoft's published documentation, it would be inaccurate to say work grounding and web grounding have been eliminated.

In fact, Microsoft's July 2026 Copilot updates introduced Domain Exclusion for Web Grounding — letting admins exclude up to 1,000 domains from Copilot's web-grounded responses. That confirms web grounding is still very much part of the platform.

The distinction between organizational information, public web information, identity/permissions, and security/compliance boundaries remains extremely important.

A better way to think about the transition:

Work/Web Selection → Work IQ + Context

(not "Work/Web Removal")

The grounding mechanisms remain. The user experience is evolving.

One App Does Not Mean One Experience

Here's the important part: a single app doesn't mean every user gets the same experience. What you actually get depends on:

• Identity
• Licensing
• Permissions
• Available data sources

Work account experience: signed in with a Microsoft 365 Copilot license, Copilot can pull from Outlook, Teams chats, meeting transcripts, SharePoint, OneDrive, organizational knowledge, Graph data, and Work IQ grounding — a fully workplace-aware experience.

Personal account experience: Copilot operates within your personal account and connected services. The app may look similar, but available data, grounding sources, and capabilities differ significantly. Work and personal accounts stay separated, with enterprise security, compliance, governance, and privacy controls continuing to apply to work accounts.

One Copilot app does not mean one Copilot experience. The app is unified — the intelligence available to it still depends on who you are, what data you can access, and which licenses you hold.

This may explain Microsoft's increased emphasis on Work IQ, context, identity, and grounded reasoning as the Copilot experience continues to evolve.

A More Unified Copilot Experience

Microsoft is consolidating multiple Copilot experiences into a single application, combining:

• Copilot Chat
• Image creation
• Microsoft 365 capabilities
• Access to files and content
• Productivity workflows across Microsoft 365

You can sign in with a personal account, a work/school account, or both simultaneously — while security, privacy, compliance, and governance boundaries stay separate. Organizational data remains protected through existing Microsoft 365 controls.

Net result: a simpler user experience, and a shrinking line between consumer and commercial entry points.

August 18, 2026: The Transition Becomes Visible

Microsoft has announced the retirement of selected Copilot experiences, including Group Chat, Podcasts and Deep Research in the consumer Copilot app, as the updated Copilot experience rolls out.

This makes the current change more than a future roadmap item — users will start seeing the new direction in the Copilot experience now.

Why Work IQ Matters for Agents

This might be the biggest takeaway from the whole announcement.

Copilot is moving beyond the traditional chatbot experience. Take a prompt like: "Prepare me for tomorrow's customer meeting."

A generic AI assistant produces a standard checklist. A workplace-aware Copilot can reason over recent emails, calendar appointments, Teams discussions, previous meetings, shared documents, relevant stakeholders, and organizational context — to generate a genuinely useful response instead.

That's where Work IQ earns its keep: it provides the workplace context that lets Copilot and future agents move from answering questions to helping users complete meaningful work.

This direction lines up closely with Microsoft's ongoing investments in Copilot Studio, Agent 365, Copilot Chat, and context-aware agent experiences.

My Take

The most important change here isn't the new branding, icon, or app experience.

The real change is Microsoft making context a first-class component of Copilot.

Historically, many users asked: Should I use Work or Web? The emerging question is: What does Copilot need to understand about my work to help me accomplish this task?

Microsoft is moving Copilot from:

Chat → Answer

toward:

Context → Intelligence → Agent → Action

The application is becoming unified. The experience remains context-driven. And Work IQ could become one of the most important building blocks in that transition.

References

• Announcing Copilot leadership update — The Official Microsoft Blog
• Updates to Copilot and the Microsoft Copilot app — Microsoft Support
• Copilot Just Changed Again — August 2026 | Updates From A Microsoft Engineer — YouTube
• Microsoft is merging Copilot and Copilot 365 into one unified app — and retiring 3 features — MSN

Note: Microsoft has not officially announced the retirement of Work and Web modes. Observations in this article are based on Microsoft's published documentation, Work IQ announcements, Copilot app changes, and the ongoing Copilot unification initiative.

Microsoft Agent-a-Thon: Build an AI Agent, Live, in One Session

 No code. Real impact. Microsoft is running a global, hands-on Agent-a-Thon on September 17, 2026 — a live, guided build session where you walk away with an actual working AI agent, not just slides. 

The Agent-a-Thon is a free, live virtual event structured around three levels, each aligned to a different agent tool and depth of build. You pick the level that matches your skill and role, follow a short pre-learning course beforehand (delivered with Founderz), then join a live session with real-time support to actually build. 

Level 1: Explorer — Build Your First AI Agent Uses Agent Builder in Microsoft 365 Copilot. No-code, fundamentals-focused — ideal if you want to see how quickly an idea becomes a working agent.

Level 2: Maker — Build Powerful AI Agents Uses Copilot Studio. Still no-code, but focused on automating work, connecting systems, and building scalable agents that solve real organizational problems.

Level 3: Architect — Build Production-Grade Agents on Microsoft Foundry For developers, engineers, and architects. Covers orchestration, multi-agent capabilities, and secure, production-grade workflows — taking an agent from prototype to production at speed.

When and Where

All three levels run on September 17, 2026, with separate live sessions across three regional blocks:

• Americas — 11:00 AM–2:00 PM ET
• Asia (Australia, NZ, ASEAN, India, Korea, Japan, GCR) — 2:00 PM–5:00 PM AEST
• EMEA — 12:30 PM–3:30 PM (GMT+1)

Each region and level has its own registration link, so pick the one matching your timezone and the level that fits your role.

Why It's Worth Blocking the Time

This isn't a webinar you passively watch — it's a genuine build session with live support, meaning you leave with a working agent and hands-on familiarity with the tool, not just notes. There's also a competitive angle: participants can qualify for recognition and prizes, including a Microsoft Surface Pro grand prize. 

For anyone still mapping which of Microsoft's build tools fits their role — a question this blog has spent the last few weeks untangling — this is the fastest way to get real hands-on time with three of them (Agent Builder, Copilot Studio, and Foundry) in a single day, guided, with nothing to lose by trying.

Pick your level based on how deep you want to go — Explorer if you're new to agent building, Maker if you're solving a real business workflow, Architect if you're the one who'll own this in production. Either way, register early and do the pre-learning course so the live session actually lands.

Read here to know more: Microsoft Agent-a-Thon – Official Event Page

Zero Trust Workshop + Assessment: Microsoft's Two-Tool Framework for Your Zero Trust Journey

Zero Trust isn't a single project — it's a journey that needs both a plan and a way to measure progress. Microsoft just brought those two pieces together under one roof, with fresh pillars on both sides. Here's the roundup. 

The Framework: Two Tools, One Mission

Microsoft now frames Zero Trust around a simple pairing: plan with the Workshop, assess with the Assessment. Both live together at the new Microsoft Zero Trust hub, alongside a step-by-step guide for running a full Zero Trust strategy session.

Tool 1: Zero Trust Workshop — Now with DevSecOps

The Workshop is the planning side — an interactive tool to build your Zero Trust roadmap. It just picked up an 8th pillar: DevSecOps, bringing application security and dev practices formally into the framework. 

• 8 pillars, including the new DevSecOps pillar
• First-Then-Next structure to prioritize what to tackle and when
• Auto-generated summaries and implementation plans tailored to your org

Try it: Launch Workshop →

Tool 2: Zero Trust Assessment — Expanded Coverage

The Assessment is the measurement side — it connects to your Microsoft Entra tenant and automates posture checks. Coverage now spans 7 pillars, with Infrastructure, Security Operations, and AI added this round, plus a revamped Overview page for aggregated insights. 

• 7 pillars, including Infrastructure, Security Operations, and AI
• Connects directly to your Entra tenant for automated checks
• Guides you through prioritized, actionable remediation
• New Overview page for a single view of risk across pillars

Try it: Run Assessment →

(We covered the Assessment's pillar expansion in our previous roundup — this is the fuller picture, now paired with the Workshop.)

See It First

Not ready to connect a tenant yet? Walk through a live demo of the Assessment experience — including the new Infrastructure, Security Operations, and AI pillar views — before you run it for real. 👀

Explore: View Assessment Demo →

Go Deeper

• Step-by-Step Delivery Guide — for running a full Zero Trust strategy session, partner or internal

• Zero Trust Guidance Center

• Zero Trust Partner Kit

• GitHub Repo

Bottom Line

Plan with the Workshop, measure with the Assessment — that's Microsoft's Zero Trust pitch now, and the toolset finally matches it. If you've only run the Assessment so far, the Workshop's new DevSecOps pillar is worth a look. 

Copilot Studio, Agents Toolkit, Copilot Agent Kit, Agent 365 — Untangling Microsoft's Agent Naming Maze

If you've tried to figure out which Microsoft tool actually does what in the agent-building space, you're not alone. The names sound almost interchangeable — Agents Toolkit, Copilot Agent Kit, Agent Builder, Agent 365 — but they solve completely different problems. Here's the map, straight from Microsoft's own documentation.

Start With the Question: Build, Manage or Govern?

Most of the tools in this space fall into the below broad layers:

• Build — Agents Toolkit, Copilot Studio, Agent Builder, SharePoint agents
• Manage & optimize — Copilot Agent Kit
• Govern & secure — Agent 365

Mixing these up is where most of the confusion starts.

The Build Tools: Four Options, No-Code to Pro-Code

Microsoft's own comparison guide lists four supported tools for building a declarative agent for Microsoft 365 Copilot, spanning pro-code, low-code, and no-code approaches:

• Microsoft 365 Agents Toolkit (pro-code) — built for developers who need full control over their coding environment, source control, and direct API integration. It supports custom API actions, advanced Adaptive Cards, the Microsoft 365 Agents SDK, CI/CD integration, and local testing through the Microsoft 365 Agents Playground — without needing a developer tenant or a tunneling tool like ngrok. New capabilities are often available first here before reaching Copilot Studio or Agent Builder. The trade-off: no drag-and-drop Power Platform connectors, and agents built here can't be reused in low-code tools like Copilot Studio.

• Copilot Studio (low-code) — a drag-and-drop interface with Power Platform integration and hundreds of prebuilt connectors. Don't mistake "low-code" for "small-scale": Microsoft's guidance positions it for agents that integrate external data sources, call APIs, orchestrate complex workflows, and connect to systems beyond Microsoft 365 — ideal for departmental or enterprise-wide solutions, with prebuilt governance and deployment tooling built in.

• Agent Builder (no-code) — built directly into Microsoft 365 Copilot. Users just describe what the agent should do, with no coding experience required. Ideal for quick, lightweight agents — a writing coach, an onboarding buddy — for personal or small-team productivity.

• SharePoint agents (no-code) — created by site owners or editors, drawing only on a specific site's document libraries. Easy to access since they're integrated directly into SharePoint and discoverable in Teams, but not built for large-scale or highly complex use cases.

Two details worth knowing:

• Agents Toolkit and Copilot Studio are not interchangeable paths — Agents Toolkit and Copilot Studio follow different development models and artifacts. Migration or reuse is not a simple lift-and-shift exercise.
• Agent Builder and Copilot Studio, by contrast, do connect: Microsoft documents a Copy to Copilot Studio option directly inside Agent Builder's menu, letting you start lightweight and graduate an agent into Copilot Studio's advanced lifecycle management, analytics, and governance controls once you outgrow the in-chat builder.

The Management and Governance Tools: Two, Scoped Very Differently

Copilot Agent Kit, built and maintained by the Power CAT team, provides tools to build, test, govern, and optimize custom agents in the Copilot Studio ecosystem. It's not a separate agent-building platform — it's a toolkit that adds testing, debugging, governance, analytics, and optimization capabilities around your agents.

• Batch testing with pass/fail results and latency data
• Compliance Hub, which continuously evaluates agent configurations against governance controls to flag risks and policy violations
• Agent Inventory, giving admins a tenant-wide view of every custom agent, its authentication mode, and knowledge sources
• Agent Debugger, Agent Review Tool, and an Agent Value dashboard for classifying agents by business impact

Microsoft Agent 365 governs agents at enterprise scale — Microsoft's own documentation describes it as providing the ability to observe, govern, and secure the growing number of agents within an organization, extending Microsoft's identity, data, and threat-defense capabilities across the AI ecosystem. In practice that means:

• A centralized agent registry inside the Microsoft 365 admin center, giving a unified view of agent adoption, activity, and health
• Microsoft Entra enforcing risk-based access controls for users and agents acting on their behalf
• Microsoft Purview providing visibility into data risks through information protection and DLP
• Microsoft Defender extending threat detection and protection across the agent ecosystem
• An Agent 365 SDK, for developers who want to connect existing agents to Microsoft Agent 365 for enterprise-grade visibility, governance, security, identity, and lifecycle management, regardless of where or how the agent was built.

Agent 365 extends the same infrastructure organizations already use for managing people — identity, access, compliance — to agents instead.

The Practical Takeaway

• Need full pro-code control, source control, CI/CD? → Microsoft 365 Agents Toolkit

• Need a low-code agent with workflows, integrations, and enterprise-grade lifecycle management? → Copilot Studio

• Need to build a simple agent quickly, no code? → Agent Builder

• Need an agent grounded in one SharePoint site's content? → SharePoint agents

• Need to test, debug, and optimize a Copilot Studio agent? → Copilot Agent Kit

• Need to govern every agent across the org, any platform? → Agent 365

None of these compete with each other — they sit at different layers of the same stack. The real skill isn't picking a favorite; it's knowing which layer you're actually solving for.

Worth Knowing: A Few More Pieces Not Covered Here

This post focused on the Microsoft 365 Copilot side of the agent story — but the wider Microsoft agent ecosystem goes further, and it's worth knowing these exist even though they're outside today's scope:

• Microsoft Foundry — Microsoft's broader AI platform for building, deploying, and scaling AI applications and agents. It provides access to models, agent services, tools, evaluation, observability, security, and governance, and supports agents built with different frameworks and models. It is a strong fit when an agent needs to run and scale as an Azure-based workload rather than primarily living inside Microsoft 365.

• Microsoft Agent Framework — Microsoft's unified, multi-language framework for building, orchestrating, and deploying AI agents and multi-agent workflows, with support for Python, .NET, and Go (Go currently in public preview). It brings together concepts and capabilities from Semantic Kernel and AutoGen, providing primitives for workflows, memory, tools, middleware, human-in-the-loop scenarios, and agent-to-agent interactions.

• Microsoft Entra Agent ID — provides dedicated identities for AI agents, separate from human users and traditional application identities. It provides the identity foundation for authenticating and authorizing agents, managing their lifecycle, and applying access and governance controls as agents interact with enterprise resources.

These deserve their own dedicated post rather than a rushed mention here — but if you're mapping out an enterprise agent strategy, know that the six tools above aren't the whole picture.

The Bottom Line

Microsoft's naming hasn't made this easy — the capabilities and trade-offs evolve quickly, and some capabilities may appear in Agents Toolkit before reaching Copilot Studio or Agent Builder. "But once build, management, and governance are separated, and Copilot Agent Kit and Agent 365 are understood as operating at entirely different scopes rather than competing, the picture holds together. Bookmark this if an agent strategy conversation is coming up — it'll save the same untangling exercise this post just went through.

Read here to know more: Choose the Right Tool to Build a Declarative Agent – Microsoft Learn

Also review: Copilot Agent Kit overview – Microsoft Learn

And: Microsoft Agent 365 overview – Microsoft Learn

For the wider ecosystem: Microsoft Foundry documentation and Microsoft Agent Framework overview

Also watch: Modernizing Azure Agents with Agentic Identities

Stay tuned for more updates...

Analytics Hub: Microsoft's Free Toolkit to Measure Copilot Adoption, Impact & ROI

Every enterprise rolling out Microsoft 365 Copilot eventually hits the same question from leadership: "Is it actually working?" Microsoft just made it a lot easier to answer — with data, not guesswork.

What Is Analytics Hub?

Analytics Hub is an open-source collection of 23 Power BI templates, PowerShell exporters, and web apps built to measure Copilot adoption, agent usage, sentiment, ROI, license utilization, and super-user impact — all running entirely inside your own tenant. Nothing is uploaded, no telemetry leaves, and everything is MIT-licensed, so you can fork it and adapt the measures to your own environment. 📊

Where This Fits Alongside What You Already Have

Analytics Hub isn't the first way to measure Copilot adoption — Microsoft already ships a few native options, and it's worth knowing where each one stops before you see why this toolkit matters:

• Microsoft 365 Copilot Dashboard (in Viva Insights) — the out-of-the-box starting point. Gives org-level usage trends, feature adoption, and a baseline "time saved" estimate, but stays fairly high-level and doesn't go deep on cost, license optimization, or agent-level detail.

• Viva Insights advanced reporting — richer person- and group-level behavioral data, but built for broader productivity analytics, not Copilot-specific ROI framing.

• Microsoft 365 Admin Center usage reports — solid for raw license assignment and activation counts, but not built to answer "is this actually driving value."

• Power Platform admin center analytics — covers Copilot Studio agent-level usage, but lives in its own silo, separate from M365 Copilot and GitHub Copilot data.

Each of these is genuinely useful, but they're scattered across different portals, and none of them stitch adoption, cost, and ROI into one defensible story you can take to leadership. That's the gap Analytics Hub closes — it's less a replacement for these native tools and more the connective layer on top, pulling from the same underlying data (Purview, Entra, Viva Insights, Copilot credit consumption) into a unified, fork-and-customize reporting layer.

Two Standout New Additions

• ValueLens for Microsoft Copilot Turns every Copilot and agent signal into hours saved, assisted value, and adoption maturity — a defensible ROI story instead of a raw seat count. Also covers licence readiness for renewals and agent governance for sprawl.

• Consumption Central One template covering Copilot credit consumption and cost across four products — Cowork/Work IQ, Copilot Studio, GitHub Copilot, and Azure AI Foundry. Four separate portals, finally rolled into one view — genuinely useful if you're tracking spend the way I broke down in my Copilot Credits post.

What Else Is in the Toolkit

The catalog spans six categories, and there's real depth here:

• Usage & Intelligence — AI-in-One Dashboard (the flagship, unifying Copilot, Copilot Chat, Agents, and third-party AI signals), Copilot Chat & Agent Intelligence, StudioLens for Copilot Studio

• Adoption & Behaviour — Super Usage Adoption, Super User Impact, Adoption & Sentiment Report, Personal Copilot Dashboard

• Impact & ROI — Cowork Billing Report, Cowork ROI Model, Cowork Chargeback, FinOps & FOCUS Cost Report, ESS Insights

• Readiness — M365 Copilot Readiness Report (ranks users by app fluency to plan enablement waves), Cowork Policy Helper

• Developer — GitHub Copilot Impact, What I Did: Copilot Impact Report

• Tooling — PAX (Portable Audit eXporter for Purview/Entra), CustomizeCopilot add-on library

Most templates ship with a synthetic sample dataset, so you can preview the full report before pointing it at a live tenant. 

If you're accountable for Copilot adoption or spend in any capacity, this is worth exploring this week — start with the Explore Reports matrix, pick the two or three templates matching your immediate question (adoption? cost? readiness?), and run them against the sample data before touching your tenant.

A quick credit where it's due: this toolkit is built and maintained by Microsoft's Growth & Incubation team — People Scientists, Business Value Advisors, and Solutions Architects who, by their own words, read every GitHub issue and feed reader friction back into the next release. It's rare to see this level of practitioner-built, genuinely free tooling from a vendor. Worth a thank-you if it saves you the build effort. 

Read here to know more: Analytics Hub – Microsoft

Explore the full catalog: Explore Reports – Analytics Hub

The Microsoft 365 Copilot Agent's Playbook: A Free 4-Part Livestream Series

Microsoft Reactor is running a four-part livestream series featuring engineers and product makers from Microsoft — direct access to the teams building the features shaping Microsoft 365 Copilot agents today. Free, live, with Q&A.

What the Series Covers

The Microsoft 365 Copilot Agent's Playbook focuses on how modern Microsoft 365 Copilot agents — including declarative agents — are built, grounded, extended, and evaluated. Each session pairs a short presentation with live demos and open Q&A. 

What you'll walk away with:

• Extending agents with Skills and actions
• Grounding responses with enterprise context using Work IQ
• Connecting MCP apps for interactive user experiences
• Evaluating and improving agent quality with Microsoft 365 Copilot Evals

The Four Sessions

🗓️ Aug 18 — Skill Up: Adding Skills to Your Agent in Microsoft 365 Copilot How Skills extend Declarative Agents with new capabilities, actions, and knowledge for your business scenarios.

🗓️ Aug 25 — Context Is Everything: Building Agents That Know Your Work Context How Work IQ helps agents understand the people, projects, and information that matter most in your organization.

🗓️ Sep 01 — MCP Apps: Bringing Interactive UI to Microsoft 365 Copilot Connecting MCP Apps to Declarative Agents, turning agent responses into actionable, interactive workflows.

🗓️ Sep 08 — Terminal First Approach to Build and Evaluate Microsoft 365 Copilot Agents A developer-first approach using M365 Agent Evals and skill-based tooling — from the command line to production readiness.

All sessions run 4:00–5:00 PM UTC. 

Read here to know more and Register Soon: The Microsoft 365 Copilot Agent's Playbook – Microsoft Reactor

Copilot Studio Harnesses in Practice: Microsoft's Free Agent Academy

If you read my last post on Copilot Studio harnesses, the natural next question is — where do I actually learn to build on one? Microsoft has the answer, and it's free: Agent Academy, a self-paced, hands-on curriculum for mastering agent building in Copilot Studio, with a dedicated track for each harness.

What Is Agent Academy?

It's a structured, mission-based training program built around a "Recruit → Operative → Commander" progression — think of it as a field-training arc for agent builders. You start as a Recruit, work through hands-on missions, and earn an official digital badge (issued through the Global AI Community) when you complete each path. 

The Recruit rank splits into two paths, one per harness, and both start from zero:

• Standard Harness — best for rule-based, predictable conversations. Broadest coverage of classic Copilot Studio: topics, Adaptive Cards, Power Fx, agent flows.
• GitHub Copilot Harness — instruction-driven. Guide agent behavior with natural-language instructions, skills, tools, and workflows instead of manually built conversation paths.

Microsoft's own guidance: start with Standard if you want the broadest foundational coverage of Copilot Studio; start with GitHub Copilot harness if you're building on the new experience today and want the instruction-driven approach directly.

Track 1: Standard Harness (13 Missions)

The original, foundational course — comprehensive and hands-on, taking you from zero to a published, licensed agent. 🧭

What you'll build:

•  Core agent concepts — LLMs, RAG, declarative vs. autonomous agents
• A declarative agent deployed into Microsoft 365 Copilot
• A packaged, reusable solution for environment management
• A custom agent grounded in your own knowledge sources
• Adaptive Cards built with Power Fx and SharePoint
• Agent Flows triggered from Adaptive Card input
• Event-based triggers for autonomous behavior
• Publishing to Microsoft Teams and Microsoft 365 Copilot
• Licensing and billing fundamentals

Track 2: GitHub Copilot Harness (Recruit NextGen)

The newer track, built specifically around the harness I covered in my last post. It intentionally reuses the same IT support business scenario as the Standard track — so you're comparing architectures, not learning a new use case from scratch. 

What's different here:

• Instead of manually authoring topics and branching logic, you describe what your agent needs to do in natural language and let Copilot Studio generate the initial agent
• You refine the result — updating the agent name, adding knowledge sources, verifying instructions
• Missions cover adding skills, tools, and workflows rather than Adaptive Cards and agent flows
• The agent lifecycle follows create → build → test → publish → monitor

 Worth flagging before you start: this track runs on Copilot Credits — consumption-based billing during natural-language authoring, Preview, and Evaluation. Manual configuration in the Build and Monitor tabs doesn't consume credits, but the billing exception available to licensed Microsoft 365 Copilot users in authenticated employee scenarios doesn't apply here — so check your environment's credit capacity before diving in. Mission 09 covers this in full, and it lines up directly with what I covered in my Copilot Credits breakdown.

Completing this path earns the Recruit NextGen badge.

What You'll Need Before Starting (Either Track)

• A Microsoft 365 Developer tenant with SharePoint enabled
• Access to Copilot Studio (trial or licensed)
• Optional: basic familiarity with SharePoint, Power Platform, or Power Fx

Each track has its own Course Setup mission to get you there.

Why This Matters

Reading about harnesses is one thing — building an actual agent, publishing it, and understanding its licensing is what turns theory into a skill you can bring to your organization. Microsoft built this as genuinely practitioner-grade training, not marketing fluff, and both tracks are free. Doing both back-to-back is also the fastest way to feel the architectural difference between topic-based authoring and instruction-driven building — rather than just reading about it. 

Read here to know more: Agent Academy – Recruit (both paths)

Standard Harness track: Recruit – Standard Harness

GitHub Copilot Harness track: Recruit – GitHub Copilot Harness

Stay tuned for more updates...

Copilot Studio Harness Explained: Types, Examples, and What Each One Costs in Copilot Credits

Every agent you build in Microsoft Copilot Studio runs on a harness — and picking the right one is now a first-order architecture decision, not an afterthought. Here's a complete breakdown of what harnesses are, the three types available, and exactly how each one hits your Copilot Credits.

What Is a Harness?

You design the agent — the tools, knowledge, actions, and workflows. The AI model supplies the reasoning and generation. The harness is the runtime that sits in between: it decides when to call the model, what to send it, how to interpret what comes back, and which tool to fire next. It's invisible in the UI, but it's the thing quietly deciding how "smart" your agent actually feels — and how it gets billed.

The Three Harness Types

Standard Harness

Rule-based agents that follow the topics, conversation paths, and branching logic you explicitly define. No dynamic planning — it executes the exact structure you built.

Example: An IT onboarding agent that routes a laptop request through a fixed approval-then-provisioning flow.

Copilot Chat Harness

Built for extending Microsoft 365 Copilot itself with your organization's own knowledge, rather than standing up a separate agent.

Example: An employee onboarding assistant inside Copilot Chat that answers questions grounded in your SharePoint content.

GitHub Copilot Harness (the new one — GA August 3, 2026)

The most capable of the three. Natural-language-first authoring, deep reasoning, planning, and multi-step tool execution across files, systems, and other agents — the same engine behind Copilot Cowork and the GitHub Copilot coding agent. 

Example: An accounts-payable agent that reads incoming invoices, matches them against purchase orders, and routes exceptions for human approval — a long, multi-step process with ambiguous decision points that the Standard harness would struggle to script.

Quick pick rule: scripted and predictable → Standard. Layering AI onto Microsoft 365 Copilot → Copilot Chat. Messy, multi-step, needs reasoning and adaptation → GitHub Copilot harness. One catch either way — agents built on one harness can't be moved to another.

Harness vs. Copilot Credits

This is the part worth flagging to finance and governance before you scale adoption. Per Microsoft's Copilot Credits Guide (August 2026):

• Standard Harness — billed through Copilot Credits, but usage is generally lower and more predictable since it's just executing pre-built flows

• Copilot Chat Harness — billed through Copilot Credits, though rates don't apply to Microsoft 365 Copilot users in authenticated B2E scenarios

• GitHub Copilot Harness — billed in two stages: Creation (authoring, preview, evaluation) and Runtime (every task execution)

For the GitHub Copilot harness specifically, runtime cost is driven by four factors: 

• Models — which AI model is used, chosen for the quality/speed/cost the task demands
• Runtime — the managed cloud orchestration keeping the agent working, including long-running tasks
• Context — understanding of people, roles, and collaboration patterns drawn from emails, files, and meetings
• Tools — the actual actions taken: sending emails, updating documents, scheduling, and more

One thing that costs nothing: manual configuration work in the Build and Monitor tabs. Only LLM-powered authoring and actual agent execution draw from your credit pool.

Buying Copilot Credits

• Pay-as-you-go: $0.01/credit, billed in arrears at month-end, no upfront commitment

• Pre-Purchase Plan (P3): one-year upfront purchase with volume discounts — starting at 5% off for 300K credits, scaling up to 20% off at 300M credits

Credits pool at the tenant level across all Copilot Credit–powered experiences (Cowork, Work IQ APIs, Copilot Studio, Business Applications), so usage across the org draws from one shared balance.

The Bottom Line

Microsoft isn't just shipping a feature here — it's signaling where Copilot Studio is headed: fewer rigid flowcharts, more goal-driven agents that plan, adapt, and recover mid-task. The harness you choose shapes what your agent can do; the credit model behind it shapes what it costs. Model both before you commit to scaling an agent org-wide.

Read here to know more: Choose a harness – Microsoft Copilot Studio

Also review: Introducing a new harness for Copilot Studio

Watch here: Inside the new agent and workflow harness | Copilot Studio Updates August 2026

Full pricing detail: Microsoft Copilot Credits Guide – August 2026 (PDF)

Stay tuned for more updates...

Microsoft Frontier Transformation Week: Turn AI Strategy Into Action

AI strategy is one thing — deploying it at scale is another. Microsoft's next big virtual event is built to bridge exactly that gap. 

Microsoft Frontier Transformation Week is a global digital event designed for anyone taking AI from potential to production — with real-world demos, expert insights, and practical next steps. It runs across multiple regions, each on its own dates, so you can register for the one that fits your time zone

• Americas: August 11–14, 2026
• Asia/APAC: August 18–21, 2026
• China (Simplified Chinese): August 18–21, 2026
• EMEA: September 14–17, 2026

There's something for every role:

• Decision-makers — walk away with a strategy, not just a story: how to articulate your organization's AI maturity, what successful Frontier Transformation looks like in your region, and the building blocks for success
• Practitioners — go from knowing what agents can do to knowing how to deploy and optimize them, with real demos and technical best practices across Microsoft's products and solutions
• Developers — get the tools and learning to build something yourself, including highlights from Microsoft Build and new innovations to support your next project
• Small and midsize businesses — get a clear path to turning AI into business impact, with right-sized approaches and practical steps to deploy your first AI agents

Why it matters: this isn't another vision keynote — it's positioned as the bridge from AI strategy to deployable know-how, with role-based tracks and local context for your region. 

Register for your region:

• Frontier Transformation Week – Americas
• Frontier Transformation Week – Asia/APAC
• Frontier Transformation Week – China (Simplified Chinese)
• Frontier Transformation Week – EMEA

Microsoft's AI-Era Security Push: New Vision, New Platform, New Assessment, New Skills

AI is changing the physics of cybersecurity — and Microsoft just moved on four fronts at once: a new strategic vision, a new agentic security platform, an upgraded assessment tool, and a skilling series to build AI-specific defense skills. Here's the roundup. 

The Vision: Rethinking Security for the Age of AI

Microsoft Security EVP Hayete Gallot laid out why the old security playbook won't survive the AI era. Autonomous systems can now reason, adapt, and operate continuously — and attackers are moving at machine speed too. Microsoft's answer: a new "cyber stack," introduced as Project Perception, designed to continuously perceive risk across the entire digital estate, reason across massive context, and act at machine speed. 

Read more: Rethinking Security for the Age of AI

The Platform: Project Perception Enters Public Preview

The vision now has a name and a launch date. Project Perception is Microsoft's new agentic security platform — a workforce of specialized AI agents that reason over your security data, tools, and workflows to expose gaps, investigate threats, and remediate them continuously. It enters public preview on August 3, 2026, launching first inside Microsoft Defender. 🤖

• Red agents find potential attack paths and vulnerabilities before they're exploited
• Blue agents investigate findings and determine what represents real risk
• Green agents take corrective action and strengthen defenses
• Humans stay in control of every critical decision — this is agentic, not autonomous

Read more: Project Perception | Microsoft Security

The Assessment: Zero Trust Assessment Now Covers AI

Talk is one thing — measuring where you actually stand is another. The Zero Trust Assessment automates hundreds of security configuration checks across your tenant, aligned with the Secure Future Initiative and Zero Trust pillars — and it now spans seven pillars, including Infrastructure, Security Operations, and AI. ✅

• Connects to your Microsoft Entra tenant for an automated posture check
• Guides you through prioritized, actionable remediation steps
• Newly revamped Overview page for aggregated risk insights

Read more: Zero Trust Assessment Overview

The Skills: AI Red Team 101 Training Series

Once you know the risks and your posture, it's time to build the muscle. Microsoft's AI Red Team 101 is a modular training series covering generative AI vulnerabilities, attack techniques, and defenses — straight from lessons learned red-teaming 100+ generative AI products. 🎯

• Prompt injection (direct and indirect) with real-world case studies
• Single-turn and multi-turn attack techniques (like Skeleton Key and Crescendo)
• Defensive strategies and Microsoft's spotlighting techniques
• Automating red teaming at scale with PyRIT, Microsoft's open-source tool

Read more: AI Red Team Training

Stay tuned for more updates...

Microsoft Defender Challenge: Enroll and Complete Soon

Security teams today are defending across identities, endpoints, email, cloud workloads, and now AI environments too. Microsoft just launched a hands-on challenge to help you build exactly those skills. 

The Microsoft Defender Challenge is a free, curated learning experience running July 20 – August 21, 2026, focused on real-world skills across:

• Microsoft Defender XDR — the latest detection capabilities and unified incident response across identities, endpoints, email, and cloud apps
• Microsoft Sentinel — workspace architecture, data connectors, analytics rules, and building a mature SIEM/SOAR practice
• Microsoft Defender for Cloud — investigating, triaging, and responding to alerts across cloud and AI workloads

Who it's for: SOC analysts, security engineers, cloud security practitioners, and any IT pro looking to level up their security chops.

Complete the challenge on Microsoft Learn and submit the official sweepstakes entry form by August 21, 2026 for a chance to win one of 500 certification exam vouchers — 50% off toward:

• SC-200: Security Operations Analyst
• SC-500: Cloud and AI Security Engineer Associate

Access here to know more: Microsoft Defender Challenge

Microsoft's New Certification for AI-Powered IT Admins: AI Services Administrator Associate

AI isn't just a productivity layer anymore — it's mission-critical infrastructure. Microsoft just rolled out a certification built exactly for the admins who have to keep it secure, governed, and running. 

Microsoft 365 Certified: AI Services Administrator Associate validates your ability to configure, manage, secure, and govern Microsoft 365 tenants, workloads, and AI services — including Copilot, agents, and connected AI capabilities.

To earn it, you'll need to pass: Exam AB-650: Administering Microsoft 365 and AI Services (currently in beta)

• Configuring and managing Microsoft 365 tenants and workloads
• Securing and governing Copilot, agents, and connected AI capabilities
• Protecting data and information across users and agents
• Operating and continuously optimizing AI services at enterprise scale
• Collaborating across identity, security, compliance, and endpoint teams

Recommended background: experience with Microsoft 365 workloads and Microsoft Entra ID, an understanding of Defender XDR, and familiarity with Microsoft Graph PowerShell.

Access here to know more: New Microsoft 365 Certified: AI Services Administrator Associate Certification

Microsoft's New Certification for the Agentic Era: Multi-Agent AI Solutions Expert

The future of AI isn't a single model — it's systems of agents working together. Microsoft just rolled out a certification built exactly for that shift.

Microsoft Certified: Multi-Agent AI Solutions Expert validates your ability to design, build, and operate scalable, production-ready multi-agent AI solutions using Microsoft Foundry and Azure.

To earn it, you'll need to pass: Exam AI-500: Designing and Implementing Multi-Agent AI Solutions (currently in beta)

• Designing logical architecture for multi-agent solutions
• Building and integrating tool ecosystems
• Implementing multi-agent orchestration
• Evaluating, optimizing, and monitoring multi-agent solutions
• Securing, governing, and deploying multi-agent solutions

You'll first need the Azure AI Apps and Agents Developer Associate (AI-103) certification — it lays the Foundry and agent-development foundation that AI-500 builds on.

Access here to know more: New Microsoft Certified: Multi-Agent AI Solutions Expert Certification