Copilot Studio Blog articles

Introducing the Power Platform Admin Plugin in Cowork: Agentic Governance with Natural Language

Thomas_Zou — Mon, 26 Oct 2026 00:42:49 GMT

Ask a Copilot Studio or Power Platform admin a simple question: Which business-critical assets are owned by people who have left the organization?

Answering it often means checking multiple admin views, the user directory, connector lists, and sharing settings. The information is already in your tenant. Bringing it together is the hard part.

That is why we are introducing the Power Platform Admin plugin for Copilot Cowork. It brings tenant-specific Power Platform data and governance context into Cowork, so IT admins can ask questions in natural language and get answers grounded in their environments.

Behind the plugin is a governance intelligence layer that connects information about assets, usage, ownership, policies, licensing, connectors, and other platform signals.

The goal: spend less time gathering data and more time understanding what needs attention.

Three governance challenges the plugin helps address

1. Fragmented data

Agent inventory, usage, data policies, capacity, costs, and environment controls live in different places. Each tool answers part of the question, leaving admins to connect the findings themselves.

2. Data without enough business context

Asset and policy telemetry can provide useful signals, but it can also create noise. Without business context, IT teams can struggle to prioritize the actions that matter most for business-critical assets. Turning those signals into an action plan also requires Power Platform expertise.

3. Limited flexibility

A fixed set of dashboard cards cannot meet every team's needs. Building a custom governance view can mean combining PowerShell, CLI, and REST interfaces, then maintaining that integration as the platform evolves.

What the Power Platform Admin plugin delivers

A connected view of governance data

The plugin brings together previously siloed inventory, usage, security, licensing, and connector information. Admins can explore what exists, what it means, and how it connects without assembling a separate data pipeline for every question.

By connecting these signals, the plugin helps admins investigate questions that span multiple governance domains.

Ask Power Platform governance questions in natural language with the Power Platform admin plugin in Cowork.

Answers grounded in your organization

The plugin synthesizes asset and policy telemetry to help admins understand their tenant, rather than simply retrieve raw data.

For example, an admin can describe experimentation and production zones, then ask for recommendations on the policy boundaries appropriate to each. The admin remains in control: ask in plain language, review the recommendations, and validate important findings before making changes through an authorized admin workflow.

Visualize your tenant's governance posture directly with the admin plugin.

Outputs tailored to different audiences

Use the plugin's findings in Cowork to create reports, executive summaries, and governance dashboards tailored to how your organization works. Your platform team, Finance team, and executives can work from the same findings without needing the same presentation.

Create audience-specific executive summaries in Cowork.

Build tailored governance dashboards with Cowork.

Automate recurring governance tasks

Once a governance review produces useful findings, you shouldn't have to recreate it every week. Use Cowork to schedule recurring reviews that bring together tenant insights and compare findings against a saved baseline.

Establish a consistent governance rhythm so admins can spend less time repeating checks and more time reviewing changes, investigating exceptions, and deciding what needs attention.

Schedule a recurring Power Platform governance review in Cowork.

Extend the governance practices you already use

Existing Power Platform governance solutions help organizations establish visibility and control. As the organization and its Power Platform estate evolve, those reports and processes can require ongoing maintenance.

The Power Platform Admin plugin augments, rather than replaces, existing governance solutions and admin experiences. It adds a natural-language way to investigate tenant data and connect findings across governance domains. Cowork can then help turn those findings into reports, views, and repeatable workflows.

You do not need one predefined dashboard to answer every governance question.

Put agentic governance into practice

Start with the questions taking up your time today. Then turn useful investigations into a repeatable governance practice through four stages:

ReactiveSystematicCustomizedAutomated

1 Reactive: investigate what needs attention

Goal: understand your Power Platform estate and identify where attention is needed first.

Start with a real question you would normally investigate across multiple admin views. Combine available usage, ownership, environment, and connector context, then use follow-up questions to narrow the findings.

Try asking:

Which apps in the default environment were used by more than 10 people in the last 30 days? Give me a table with the owner and a link to each app.

Show me the apps and flows whose owner has left the organization.

Compare the findings from my previous questions and identify what needs attention first.

Field note

be specific. Include the environment, time period, threshold, and output format you want. A precise question gives the plugin more context to work with.

2 Systematic: establish a governance baseline

Goal: move from investigating individual issues to consistently understanding your governance posture.

Once you know which questions provide useful signals, broaden the scope. Look across environments, assets, usage, ownership, connectors, and policies. Identify the questions your governance team should revisit regularly.

Try asking:

Give me a security and governance overview of my tenant.

Analyze the security posture of my default environment.

If I block the [connector name] connector, which apps, flows, and agents would be affected, and who owns them?

The mindset shifts from "What is wrong right now?" to "How do I consistently understand what is happening?" That baseline can become the foundation for regular governance reviews.

Field note

do not stop at the first response. Ask Cowork to suggest follow-up questions, then investigate the findings that matter most.

3 Customized: shape governance around your organization

Goal: turn governance findings into outputs that support different audiences and decisions.

Your platform team, Finance team, business-unit leaders, and executives do not need the same view. Once you have a useful baseline, ask Cowork to reshape the findings instead of rebuilding the analysis elsewhere.

Try asking:

Break down app, flow, and agent usage by owner for the last 30 days. Where department information is available, add each owner's department and summarize usage by department.

Turn these findings into a one-page executive briefing.

Build a self-contained HTML report from these results with tables I can filter and sort.

The result can be an operational report for the governance team, a departmental view for Finance, or a concise briefing for leadership.

Field note

think beyond the answer. Who needs this information, and what format will help them use it? Review the report's contents and sharing permissions before distributing it.

4 Automated: make useful reviews repeatable

Goal: spend less time repeating known checks and more time reviewing changes and exceptions.

When a question, analysis, and output consistently prove useful, make the process repeatable. Where your Cowork setup supports scheduling and the required integrations, use those capabilities to run recurring reviews. Confirm the data access, comparison history, delivery method, and time zone before enabling a schedule.

Example requests for supported scheduling workflows:

Every Monday at 8 AM in my time zone, review changes in my Power Platform tenant from the previous week and prepare a one-page briefing for me.

Create a reusable skill from this conversation and report. Schedule it to run every Monday and highlight changes since the previous review.

The goal is not automation for its own sake. It is a consistent governance practice that helps admins focus on what changed, what may be at risk, and where human judgment is needed.

Field note

start small. Save prompts that consistently produce useful results, then automate the proven workflow. Validate important AI-generated findings before using them to make governance or policy changes.

Get started

Start with one question you would normally investigate across multiple admin views.

Follow the Power Platform Admin in Cowork documentation for setup and installation.
Explore the Power CAT agentic governance guidance for practical scenarios, reusable prompts, and ways to turn findings into reports and recurring workflows.

Introducing the customer conversation harness in Microsoft Copilot Studio

omar_aftab — Wed, 21 Oct 2026 15:00:19 GMT

By Omar Aftab, Vice President, Conversational AI

The way customers interact with brands is fundamentally changing. More and more interactions are driven by conversational AI, and customers increasingly expect every interaction to be deeply personalized and contextual. With millions of people interacting with sophisticated AI systems every day, consumers are no longer willing to put up with legacy IVRs, restrictive menus, and loss of context.

Engaging with customers has been central to Microsoft Copilot Studio from the very start. Copilot Studio customers have created thousands of agents that engage with their customers, whether those customers are chatting on a website, speaking with a voice agent on the phone, or using an AI agent embedded in an app or kiosk.

Today we’re announcing the public preview of our new customer conversation harness in Copilot Studio. This is a purpose-built harness and builder specifically designed to create powerful conversational agents for customer engagement. It supports the full arc of a customer interaction in a modern world: connecting to customers across channels, understanding what they need, drawing on the right knowledge and tools, interacting with human representatives as needed, and providing a swift resolution – whether the customer is speaking or typing.

To enable this, the harness introduces a set of core new conversational capabilities. These range from teams of agents that work together, more seamless interactions between generative skills and deterministic topics, powerful omnichannel conversations across chat and voice, to better human-agent interactions. The harness also enables integration with third-party contact centers through our new Microsoft Contact Center Intelligence product that we also announced today.

Build intelligent conversational agents that work together

At the center of the new harness is the new conversational agent builder. Makers can now build state-of-the-art experiences for voice and chat within a single agent. Every agent is omnichannel out of the box and has the skills you’d expect any versatile customer-facing representative to have. They speak conversationally. They understand multiple languages. They are channel-aware. You can move between digital and voice channels without losing context, and the agents maintain memory across them.

Connect a team of specialized agents to business knowledge and tools

The customer conversation harness makes it easy to orchestrate multiple agents to work together as a team of specialists. Each sub-agent can have its own knowledge and its own tools to hand its own specialized tasks. At GA, each agent will also be able use its own model. This means makers can choose which model is best suited to the kinds of jobs and intents each specialist agent handles. Some tasks call for deep reasoning, while others benefit from models optimized for cost and latency. The harness is designed to orchestrate and combine these agents seamlessly into one customer engagement system.

What's more: Microsoft Foundry extensibility is built in. You can create a custom agent with code in Foundry and add it to the team of agents with just a few clicks. The harness handles the complexity and does the heavy lifting, allowing you to build on your existing assets or more easily leverage pro-code capabilities.

Finally, Microsoft IQ, which helps ground AI experiences in your organization's work context and business data, is also backed into the harness and available to each agent. With Work IQ, agents can draw on information from the Microsoft 365 apps your team uses every day. For example, an agent helping resolve a billing dispute could reference a refund policy stored in SharePoint and also reference an exception that was agreed to in a Teams thread. The agent accesses this information with its own identity, respecting existing enterprise data access and security policies.

Agents can also connect to Foundry IQ for large-scale knowledge sources, such as product manuals, warranty terms, and documents indexed in Azure AI Search; Fabric IQ for reasoning over business data; and more.

Combine generative skills with topics

Each agent in the team handles multiple jobs - whether it's recommending a credit card, looking up a balance, or taking a payment. And just like when giving a task to an employee, you can provide general instructions for some tasks, and provide specific turn-by-turn directions for others.

In the new harness, each agent skill can either be fully generative - you simply provide a prompt and let the model use its own judgment (e.g. “Go and gather the credit card information from the user”) - or fully deterministic, using a topic (commonly used, for example, in IVRs or voice trees where exact, step-by-step instructions are desired). This flexibility is key for large customer engagement systems and has been a recurring customer ask. In the past, an agent could do one or the other. Now, each agent in your team can seamlessly handle a mix of both, depending on the job to be done.

Deliver natural experiences across voice and chat

Because the harness is natively omnichannel, voice is a first-class experience for both makers and customers. You can choose among speech models and configure rich voice capabilities. These include voice fonts for more natural and customized interactions, speech instructions to guide the agent’s tone and speaking style, DTMF behavior, speech sensitivity settings, and more.

When you're ready to publish, you can even acquire phone numbers and deploy your agent to them, making the agent accessible to customers over the phone. And you can test and evaluate all of this right within the experience.

Make customer verification easier with voice biometrics

Authentication can be one of the most frustrating parts of a customer service call. Traditional verification methods, from security questions to one-time passcodes, can add time and friction before customers can even explain why they're calling. Verifying a customer's identity is essential, but it shouldn't get in the way of a great service experience.

The new harness, together with Contact Center Intelligence, supports enterprise grade state-of-the-art voice biometrics that help authenticate customers in real time. Rather than ask a rigid set of questions to validate identity, customers can continue to speak about why they’re calling in while the system validates the caller's identity with a unique voiceprint designed to meet the precision level required by the organization. This also means that if a call drops and the customer calls back, the conversation can seamlessly resume.

Connect customer conversations to the enterprise

Conversational agents and human representatives work best when they can collaborate to resolve customer needs, and the customer conversation harness in Copilot Studio provides built-in handoff capabilities for different kinds of escalation paths to live representatives.

Partner with your human agents in Teams

Out of the box, the new harness has better support for partnering with your internal employees in Teams. You can escalate incoming calls to a Teams queue, and very soon directly to Teams chats. Think of a scenario: Oh, that’s an invoice coding issue, it should go to…Sally in accounting. And you can send that call to Sally with just a few clicks, right from within the UX.

Or connect to your existing contact center

When a full-fledged contact center is needed, connecting to one is simple. The new harness is designed to integrate seamlessly with our new Microsoft Contact Center Intelligence product and is also accessible within it. You can connect to your existing contact center, modernize your existing IVR systems and chat bots, partner with your existing human agents, configure advanced biometrics, score your calls, get insights on how your human-AI partnerships are working, and more - while retaining your existing telephony, routing, and queues. All with a few simple clicks.

Govern agents with Microsoft Agent 365

Finally, like all Copilot Studio agents, these conversational agents are fully part of Microsoft’s Agent 365 governance story. Every agent built on the customer conversation harness will show up in Agent 365 upon creation. Admins should immediately see the details of the agent, including owner, channels, Entra agent ID, knowledge, tools, permissions, usage, etc. Centralized governance helps admins apply and update existing policies comprehensively across the enterprise. And, like the rest of Copilot Studio, the customer conversation harness uses Copilot Credits with usage-based billing, so it's easy to get started.

Get started with the customer conversation harness

With the new customer conversation harness in Copilot Studio, we're helping organizations build more natural, intelligent, and effective customer experiences - wherever they engage with customers. Many of these capabilities are available now in public preview, with more rolling out over the coming weeks.

Together with the launch of our new Contact Center Intelligence offering, this is the first step in a journey to transform how everyone on the planet interacts with a brand. Head over to Copilot Studio, click "more ways to build" to try out our new customer conversation harness, and start changing how you engage with your customers today.

For more information as you get started, explore the resources below:

Are bigger agents better? How to design agents that scale

GaryPrettyMsft — Thu, 08 Oct 2026 18:18:59 GMT

There is a moment every maker hits. An agent works, so you add another tool. Then another knowledge source. Then instructions for an exception that appeared last week or an entirely new use case you want your agent to be able to tackle. Each addition is useful on its own, and the agent can now do more.

But "can do more" and "reliably does the right thing" are different properties. As an agent’s scope increases, the model has more choices to distinguish, more context to process, and more possible execution paths to manage. That doesn’t mean large agents are bad. It means that as capability grows, the challenge increasingly becomes a design problem.

The key to scaling an agent isn't giving it more. It's being deliberate about what it sees, what it decides, and what it delegates.

What changes as an agent grows

The agent scaling challenge

Consider a supplier-onboarding agent. The first version collects supplier details, checks that the request is complete, and starts an approval. Over time, makers add tools for ERP records, tax validation, sanctions screening, bank verification, contract storage, service tickets, email, and reporting. They add knowledge for regional policies and instructions for exceptions.

Eventually, a request such as "Onboard our newest supplier" might present the agent with several supplier-search tools, multiple ways to create or update a record, and overlapping policy sources. The agent still has all the required capabilities, but choosing the right path is harder.

The agent scaling challenge tends to show up in four places:

Selection: Similar tool names and descriptions make the correct action harder to identify.
Context: Tool definitions, instructions, knowledge, conversation history, and tool outputs all compete for a finite context window.
Execution: More possible paths create more opportunities for unnecessary calls, retries, and inconsistent outcomes.
Operations: A larger capability surface is harder to evaluate, secure, govern, and maintain.

A recent post from Microsoft Research discusses one part of this problem: Tools that work well independently can reduce end-to-end performance when they compete in a large or overlapping set. Often, the problem isn’t one bad tool. It is the ambiguity between several reasonable ones.

Figure 1: As a supplier-onboarding agent grows, overlapping tools, instructions, and knowledge compete for attention before the agent begins the task.

More context comes with a cost

There is also a direct cost associated with an expanding toolset. A tool consumes tokens even when it is never called because its name, description, and parameter schema are included in the context presented to the model. When it is called, its output becomes part of the agent's ongoing context. More context can mean more spend, as well as less reliable selection.

The goal isn’t a smaller agent. It is a system where each decision sees only the context, authority, and capabilities it needs. Success is measured by business outcomes, reliability, cost, and control.

What our harness can handle for you

Good agent architecture doesn't mean solving every scaling challenge yourself. The GitHub Copilot harness in Copilot Studio is built to manage some of the complexity as an agent grows.

Model improvements that don’t require agent redesign

New models are made available through the GitHub Copilot harness as they release. As more advanced frontier models become available, teams can evaluate them against their scenarios and adopt improvements without redesigning the overall solution architecture.

Model choice can also be an important factor in agent cost optimization, helping makers balance the number of tokens used against the capability needed to achieve a goal.

Manage complexity natively with tool search

The GitHub Copilot harness includes runtime capabilities designed for reasoning-heavy, multistep work. One example is tool search. When the available tool set becomes large, tool search can hold external tool definitions back and load the relevant ones on demand instead of placing every full schema in the model's context.

For the supplier-onboarding request, this can narrow a large catalog to the tools associated with finding a supplier, validating its details, and starting onboarding. The model works with a smaller, better-matched set of choices while unrelated tool definitions remain out of the way.

The harness can also plan across tools, skills, workflows, MCP servers, files, and connected agents, and adjust its path as work progresses. This all makes large, reasoning-heavy automations more practical. But runtime capabilities only solve part of the scaling challenge. How you divide responsibilities across tools, workflows, skills, and connected agents still matters.

How to design agents that scale in Copilot Studio

A scalable design starts by deciding which part of the system should own each responsibility. For instance:

Use a tool for a bounded action or lookup with a clear input and output.
Use a workflow when a sequence, approval, or business rule should execute consistently.
Use a skill for specialized instructions that are only needed for a particular task.
Use a connected agent when a domain has distinct context, ownership, or requirements.
Use the main agent to coordinate outcomes, gather information, make judgments, and handle exceptions.

These are not interchangeable building blocks. Each introduces different tradeoffs in context, flexibility, latency, cost, security, and maintenance. The goal is to use the simplest component that gives each responsibility a clear owner.

1. Make choices distinct

Start with the choices already available to the agent. Give tools, knowledge sources, and connected agents specific names and descriptions that explain both what they do and when they should be used. Merge or remove duplicate capabilities. Avoid several general-purpose tools that all appear to answer the same intent.

In the supplier example, "Search suppliers in ERP by legal name or tax ID" is easier to select correctly than a generic tool named "Search." If two tools search the same supplier records, expose one clear route rather than asking the model to choose between implementations.

Tool search itself relies on names, descriptions, and parameter metadata to find relevant tools, so good metadata improves both discovery and final selection.

2. Load specialist guidance only when it is needed

Some instructions are only relevant when an agent performs a particular task. Keeping all of them in the main agent instructions means they occupy context on every turn, even when they do not apply. Skills let makers package specialized instructions separately so the agent can load them when the task requires them.

For example, regional supplier due-diligence guidance can be packaged as a skill and loaded for suppliers in that region, rather than remaining in the main instructions for every supplier request. The principle is the same as tool search: keep relevant context close and leave unrelated context out of the current decision.

3. Split on real boundaries

When one agent contains several distinct domains, consider separating them. To clarify: Don't split an agent simply because it has grown large. Split where there is a meaningful boundary in context, ownership, security, or requirements.

In the GitHub Copilot harness, connected agents let a primary agent delegate a bounded task to another Copilot Studio agent with its own instructions, knowledge, tools, and orchestration context.

The supplier-onboarding agent could remain the front door while delegating:

Compliance assessment to a compliance agent owned by the risk team.
Supplier record creation to a finance operations agent with access to the ERP.
Contract preparation to a legal operations agent with its own templates and policies.

The primary agent now chooses between a few clearly described business capabilities instead of dozens of lower-level tools. Each specialist can be evaluated, secured, deployed, and improved independently.

Copilot Studio also supports open agent architectures. Depending on the runtime and scenario, solutions can compose Copilot Studio agents or connect supported external agents through the Agent2Agent protocol. In the supplier scenario, a specialist due-diligence agent hosted outside Copilot Studio could sit behind the same clear boundary, rather than being rebuilt as a collection of tools.

4. Put fixed sequences in workflows

Use the agent where the next step requires judgment. Use a workflow where the sequence, approval, or control must remain consistent. This helps preserve adaptability without making every part of the process probabilistic.

For example, supplier onboarding might always require the same core sequence: validate required fields, check for an existing supplier, run mandated compliance checks, create the record, and route it for approval. A workflow can own that sequence. The agent can still decide when to start it, gather missing information, and handle exceptions.

This reduces the number of low-level decisions the model must make and gives makers one place to enforce approvals, retries, and audit requirements.

The supplier-onboarding agent, redesigned

So let’s go back to the original agent in our example. It had one long instruction set, several knowledge sources, and dozens of tools. The redesigned system doesn’t eliminate that agent. It gives it a clearer job: coordinating the overall outcome while other components take on more specialized responsibilities. That gives us a system:

The main supplier-onboarding agent understands the request, collects any needed details, delegates as needed, handles exceptions, and responds.
Tool search limits the external tools loaded for the current request.
Clear metadata separates supplier lookup, compliance, finance operations, and contract tasks.
A workflow owns the fixed onboarding and approval sequence.
Skills provide regional guidance only when the supplier's location requires it.
Connected agents own compliance, ERP, and legal domains where those boundaries justify separate agents.

Figure 2: The same capability as a composed system: a coordinating agent retains judgment, the harness discovers relevant tools, workflows own fixed sequences, and specialist agents own bounded domains.

The result is the same overall capability, but as a composed system with clearer responsibilities and less for any one decision to reason over.

Evaluate for the outcome

Each approach discussed above has limits. A stronger model cannot compensate for unclear instructions or overlapping tools. Tool search reduces what the model sees, but it does not create boundaries that have not been designed. Workflows and skills reduce what the main agent must reason over, but they add components to maintain. And connected agents can provide clearer ownership and security boundaries, but each handoff adds token use, another failure point, and more to govern.

Designing agents that scale means managing all four components of the agent scaling challenge together: making selection easier with distinct choices and clear boundaries, controlling context with tool search and skills, making execution more predictable with workflows and deliberate delegation, and strengthening operations through components that can be evaluated, secured, governed, and improved independently.

Agent scale is not a tool-count contest.

Models, requirements, and available tools will keep changing, but these principles give you a more durable way to evolve an agent without letting added capability become added confusion. The goal is not the biggest agent; it is a composed system that reliably does the right work, at the right cost, with clear ownership.

Governance is becoming agentic, too: How enterprises can operate AI at scale

niravshah — Tue, 22 Sep 2026 15:15:00 GMT

Organizations have spent the past few years trying to get people building with AI. That effort is working: Agents are moving beyond experimentation and into real business processes.

For IT teams, this kind of successful adoption creates a new set of questions.

What agents exist across the organization? Who owns them and what systems and data can they access?
How are they being used, and what do they cost to operate?
Are they healthy?
And how do you know when an agent’s risk profile or behavior changes?

These questions get harder as the agent estate of an organization grows. Agents may be built by different teams or on different platforms. Some may operate outside the Microsoft ecosystem entirely. Their capabilities can also change as they connect to new data and tools.

We’ve been thinking a lot about this challenge as we prepare for the Microsoft Power Platform Conference (PPCC) in October 2026. One idea comes up again and again: Scaling agents doesn’t just mean governing more things. It requires changing how governance itself works.

Inventories, reviews, and administrator controls remain important. But they need to become part of a more continuous operating model. I see that evolution in three parts: observe continuously, respond proportionately, and automate where appropriate.

Observe continuously

You can’t govern what you can’t see. And when it comes to agents, visibility means more than maintaining an inventory. It means understanding each agent in context: its ownership, identity, access, usage, health, and behavior.

It is important to note that that context isn’t static. A maker or admin could give an agent access to a new tool or data source. They could change the agent's owner. The way people use it in production may reveal something about the build that wasn’t apparent during development. And, of course, usage of that agent (hopefully) will grow over time. That makes observability, defined as visibility into agent activity and behavior through telemetry, an ongoing requirement.

Then, at enterprise scale, there’s the question of coverage. In my experience, many enterprises plan to build agents in multiple places. They may be built with Microsoft platforms like Copilot Studio, third-party platforms, and/or custom development.

This is where cross-platform management layers like Microsoft Agent 365 become especially important. A shared agent control plane—that is, a common layer for managing and governing agents across platforms—makes observability actionable across the agent estate, rather than leaving signals isolated within individual platforms. IT can use those signals to detect changes such as risk, usage, cost, and health over time.

The Agent 365 Agents Map helps you visualize how agents fit into the broader ecosystem, connect with other agents, and perform over time to simplify monitoring and resolve issues quickly.

At PPCC, the Agent 365: Securely Managing and Governing Agents at Scale workshop will go deeper into the controls and operating practices behind this model. If these are questions you’re working through in your organization, I hope you’ll join us there.

Respond proportionately

Once you have signals, the next question is what you do with them.

Not every agent represents the same level of risk. An agent that answers employee questions from approved internal documentation is very different from one that can access sensitive data and take actions in a production system. They shouldn’t necessarily go through the same governance process.

At enterprise scale, treating every agent identically creates problems in both directions. Too little oversight introduces unnecessary risk. Too much can create bottlenecks for scenarios that fit established policies.

A more scalable approach is to align the response with the risk. Identity, permissions, data access, autonomy, and available actions all provide useful context. Organizations can use that content to determine which policies apply and where additional review is appropriate.

For example, imagine an agent gains access to a new data source. That change is a signal. What’s the appropriate response?

If the new access falls within established policies and risk boundaries, the agent may not need additional intervention. If it introduces a higher level of risk—such as access to sensitive data—it could trigger stronger controls or human review. This type of program might look something like this:

The important shift seen with this approach is that governance becomes less dependent on applying the same manual process to every agent. Instead, organizations can establish patterns for different levels and types of risk. That makes governance more predictable for builders, too. Teams know the boundaries they’re working within, while higher-risk agents can receive additional scrutiny.

We’re applying this principle inside Microsoft as well. At PPCC, How Microsoft Does IT: Managing and Governing Agents with Risk-Aligned Oversight will share how we’re approaching risk-aligned agent governance across Copilot Studio, Agent 365, Microsoft Defender, and Microsoft Purview.

Automate where appropriate

Once you can observe changes and determine the appropriate response, the next question is: Does a person need to execute that response every time? At enterprise scale, the answer increasingly needs to be no.

Many governance decisions are repeatable. Organizations already know the policies they want to enforce, the boundaries agents should operate within, and the conditions that require additional review.

This is where I think governance starts to become agentic, too. One useful way I’ve found to think about it is as a continuous loop: Observe → assess → act → escalate

At a high level, this loop represents how a more automated governance framework can work.

Basically, in such a framework: The governance system detects a relevant signal and evaluates it against the context and policies the organization has established. When the appropriate response is clear, an automated control can act. When the situation falls outside those boundaries or requires judgment, it can be escalated to a person.

The goal isn’t to automate every governance decision, but rather to automate the decisions we already know how to make. People will continue to be responsible for setting policies, defining risk tolerances, and deciding where human judgment is required. The objective here is to let automation handle more of the repeatable work inside those boundaries.

In practice, that changes the job of IT teams and Centers of Excellence (CoEs). Instead of inspecting and configuring agents one at a time, they can spend more of their effort designing how governance operates: defining trusted patterns, establishing risk thresholds, and deciding when human intervention is required.

You can see some of this shift from visibility toward action at PPCC. The Agentic Governance: Secure, Govern, and Operate Your Power Platform at Scale session will explore real-time inventory and telemetry alongside automated controls and security, using the Power Platform API as an extensibility layer for enterprise governance.

Governance must evolve with the agent estate

The goal isn’t a future where people disappear from agent governance. It’s one where their attention is used more deliberately.

As agents become more capable, the systems around them need to become better at sensing change. As the estate grows, oversight needs to reflect actual risk. And as routine governance work increases, organizations need to decide what can be handled through established policy and what needs human judgment and accountability.

That is the shift I mean when I say governance is becoming agentic, too. And we’re only beginning to explore what that operating model can look like at enterprise scale.

If you’re working through these questions in your own organization, we’ll be digging into them throughout PPCC. Here are a few sessions and workshops I recommend:

Sessions

Workshops

Managing apps built in Copilot Studio

jtung — Tue, 15 Sep 2026 20:09:00 GMT

Last week we announced app building in Copilot Studio and Copilot Cowork. Makers can now describe business outcomes and produce full-stack apps with built-in source control, deployment stages, and version isolation—all on Microsoft-hosted infrastructure that requires no infrastructure provisioning, hosting configuration, or deployment pipeline.

With those capabilities built in, your administrative scope is narrower and more familiar. Apps are created in the maker's personal developer environment following the environment routing policies you already have. That means things like connector permissions and data policies apply to an app both while it is being built and after it is published. Apps also access connected data on behalf of the signed-in user, which means publishing or sharing an app never grants anyone access to data they could not already reach.

With these new capabilities, there are three things that every admin should be thinking about:

Review your app estate
Control cost with credit caps
Choose where makers can build apps

Review your app estate

Published apps are inventoried in the Microsoft 365 admin center. Each app shows:

Who built it
Its lifecycle state
Which data sources and connectors it uses
Which policies apply to it
Usage and operational metrics

From the same experience, you can also block or disable a published app, remove a connector, bring an app back within policy, control whether it can be shared, and retire apps that are no longer used.

Control cost with credit caps

Building and running apps are both charged through Copilot Credits usage-based billing, and are metered as two separate services. This distinction lets you manage maker cost and app runtime cost independently. Build consumption varies with the language model used, the complexity of the app, and how much iteration is involved. Runtime consumption, on the other hand, varies with the volume and complexity of the tasks the app processes.

At runtime, if the user holds a Power Apps Premium license, usage is included within existing request limits. Beyond those limits, or without a license, usage bills through Copilot Credits. You can learn more by reviewing the Copilot Credits licensing guide.

As an admin, you can define credit cap policies to manage your costs. For both maker and runtime usage, caps are set per user, and the controls are managed through usage-based billing. For makers, think of a cap as a per-user budget: you can set the same budget for everyone, or different budgets for groups of users, such as departments that carry separate budgets of their own.

Choose where makers can build apps

By default, app creation is available to all users in both Copilot Studio and Copilot Cowork. However, you may want to limit where people can build apps. To do so: In the Microsoft 365 admin center, navigate to Apps, then Overview, and find ‘Choose where people can make apps’.

Two paths appear:

Copilot Studio, where makers build directly, which is on by default and recommended
Copilot Cowork, where people create apps through chat, with availability managed by your organization's participation in the Frontier program

Note that turning a path off prevents new apps being created that way. However, apps that are already published through that path will continue to run.

Key takeaways for managing apps built in Copilot Studio

The Microsoft 365 admin center is the one place to review the app estate, adjust app policies, and decide which creation paths stay open.
Set credit caps as per-user budgets today, uniformly or by group, and plan for environment-level caps as project budgets when they arrive.
Decide who is accountable for overseeing published apps before makers start publishing, as you would for any other application estate.

Go to the Microsoft 365 admin center

White paper: Choosing between the GitHub Copilot and Standard harnesses in Copilot Studio

Lucia_Mosner — Thu, 03 Sep 2026 12:06:59 GMT

The Standard harness and GitHub Copilot harness are two authoring and runtime options within Microsoft Copilot Studio. A harness is the operating layer between the model and the agent’s configuration. It determines how the model receives context, uses instructions and tools, interprets results, and moves through a task toward completion. Put simply, the model provides the reasoning capability, while the harness equips and directs it.

Both harnesses are built for task-based, multi-step agents that create real business value, but they are suited to different scenarios. The Standard harness supports consistent, reliable execution of bounded business processes, while the GitHub Copilot harness extends these capabilities to longer-running, coordination-heavy, and reasoning-intensive work at a larger scale.

This paper explains the key differences, tradeoffs, and scenarios to help you choose which harness is right for your business process.

Read the full paper by clicking the PDF attachment below.

More powerful agents and workflows for autonomous business processes: Introducing a new harness for Copilot Studio

Ryan_Cunningham — Mon, 03 Aug 2026 16:18:57 GMT

Over the past two months, we’ve been previewing a new capability within Copilot Studio that lets you build agents capable of taking on more complex business processes. Today, we’re excited to share that this capability is now generally available for production use and to introduce its new name: the GitHub Copilot harness in Copilot Studio.

Meet the GitHub Copilot harness 

The GitHub Copilot harness gives Copilot Studio the coding and reasoning capabilities behind our most advanced agent experiences (like Copilot Cowork and the GitHub Copilot coding agent). This means your agents can now handle work that used to be out of reach, including processes that have many steps, many sources, and ambiguous decision points.

The new harness is built for complex, long-horizon work using the latest frontier reasoning models like Opus 5, GPT-5.6 Sol, and Fable 5. It can plan, reason through dynamic problems, run an agentic loop, use skills, integrate workflows, connect to tools and agents in other platforms, and produce rich, multi-part outputs.

In our own testing with real world business process evals, Copilot Studio shows significant performance and quality gains when using the GitHub Copilot harness. Improvements in multi-tool use, file analysis, code analysis, and knowledge quality mean these agents are more capable of taking on your most complex business processes.

To help you build these more capable agents, we’re also delivering new experiences for makers building agents with the GitHub Copilot harness. The agent designer is more intuitive for authoring, putting the most important tools right within reach to make authoring faster, while retaining full agent lifecycle management features.

A gif showing the process of adding a skill to an agent in the agent designer and starting a preview test conversation

Then, the workflow designer gives a visual canvas to understand and edit workflows, including adding agent nodes and running workflow evals. And soon, natural language authoring will let you describe your business goal and assemble the right combination of agents and workflows through a multi-turn conversation.

Agents running on the GitHub Copilot harness use usage-based billing for all work, regardless of Microsoft 365 Copilot licensing. You pay for your agent’s usage based on the models you choose, the organizational context and tools you add, and runtime used. Certain AI-driven maker experiences, like natural language authoring, evaluations, and testing, will also fall under usage-based billing if building with the GitHub Copilot harness.

You can learn more about Copilot Studio usage-based billing here.

Continued Support for Copilot Chat and Standard harnesses

Adding a new harness does not change the ones you already rely on. Different harnesses can be optimized for different outcomes, so rather than relying on a single one-size-fits-all approach, Copilot Studio now lets you choose the harness that best fits your scenario. 

This means Copilot Studio supports three harnesses today:

The Copilot Chat harness, which uses the same harness as Microsoft 365 Copilot Chat and is ideal for customizing Copilot Chat experiences.
The Standard harness, which most agents built in Copilot Studio use today and is great for conversational agents with rules-based topics.
The new GitHub Copilot harness, which uses the power of GitHub Copilot SDK to automate complex, agentic business processes.

We will continue to support the Copilot Chat and Standard harnesses in Copilot Studio for both existing agents and authoring of new agents. Microsoft 365 Copilot licensed users continue to benefit from fair use of Copilot Chat or Standard harness agents included in their Microsoft 365 Copilot license. For all other usage, the Copilot Chat and Standard harnesses will continue to be billed using the existing fixed rate card.

Get started today

The GitHub Copilot harness is generally available now, and you can start creating these agents directly from the Copilot Studio homepage. We can’t wait to see what you build. Share your thoughts using the feedback control in the top right corner of the product. Your input directly shapes what we build—and how you build—next.

Try Copilot Studio today!

Meet the new Copilot Studio: rebuilt for more complex, multi-step work

Ben Appleby — Wed, 17 Jun 2026 16:41:17 GMT

We consistently hear feedback from our customers. You want to build more capable agents and workflows that work together naturally. You need agents that can handle multi-step tasks reliably, without breaking down midway. You need more intuitive ways to build agents so you can scale your maker workforce. That feedback helped shape the exciting improvements we’re sharing today.

Starting now, customers can dive into the rebuilt, revamped Microsoft Copilot Studio. The new streamlined authoring experience and modern AI core make it easier to build agents and workflows that deliver more consistent and reliable outcomes. Teams can move faster and create solutions that hold up better in real-world use. This update is available in preview* worldwide, ready to create agents for production use.

*Note: This article originally wrote that these features are generally available. While they are available in production environments, they are currently in public preview.

Build more reliable agents

We’re making it easier to create agents that work the way you expect from the start. We've strengthened how agents follow instructions and handle complex tasks, leading to more consistent results for your business scenarios. The new building experience streamlines Copilot Studio to bring the essential configurations to the forefront, reducing configuration tabs from nine to four. Together, these improvements help make it faster to build agents that are more reliable, more capable, and more efficient.

The new experience includes:

New agentic orchestrator: Built on a new coding harness and CLI layer, the new orchestrator has stronger instruction adherence and long-horizon task execution. It supports recursive task execution, which enables the agents you create to be far better at working through complex and dynamic problems. It can also process large volumes of content and produce rich file outputs, opening up new document and data scenarios.
New agent building interface: The new interface helps make building agents faster and more streamlined, allowing you to see your instructions, skills, tools and knowledge in one place. The new modern full page testing experience features better formatting and inline chain-of-thought and tool calling.
Support for skills: Write your agent reusable instructions in markdown that can load on demand for completing specific tasks. You can also import skills you already have, including existing GitHub Copilot or Claude Code skills.

Try the new agent building designer in Copilot Studio.

Build more intelligent end-to-end workflows

Workflows are at the heart of reliable automation. With the new workflow designer, you can build intelligent, AI-driven processes in one place, combining structured workflow steps with agents.

New workflow designer: An intuitive visual designer for building agentic automations in a single, unified workspace. With node-by-node testing and robust versioning, it is now easier and faster to build, test, and publish running workflows.

Agent nodes: Call existing agents directly into a workflow. This allows you to leverage deterministic execution for reliability, while seamlessly handing off complex tasks that require greater intelligence and flexibility to agents within the workflow.

MCP servers: Connect to a broad ecosystem of model context protocol (MCP) server-enabled tools (preview). These allow workflows to execute tasks and involve users for approval, while staying within Microsoft security, permission, and compliance boundaries.

Get started today

These updates bring together the tools you need to modernize any business processes with AI onto one unified platform. You can use workflows for predictable steps, agents for more open-ended work, and combine both to automate business processes from end to end.

All makers can go to Copilot Studio and click “Try now” at the top of the homepage to start building capable agents with the streamlined building interface and modern orchestrator. The new experience and classic experience continue to coexist, so you can continue creating and managing your classic agents and workflows while you explore the new experience at your own pace.

We’re continuing to improve Copilot Studio as we learn. Share your thoughts using the feedback control in the top right corner of the product. Your input directly shapes what we build—and how you build—next.

Computer-using agents in Microsoft Copilot Studio are now generally available

MustaphaLazrek — Wed, 13 May 2026 17:28:08 GMT

The next chapter of enterprise AI isn't about chatting with assistants—it's about agents that actually do the work. Until now, automating long-tail, UI-driven business processes meant either building and maintaining brittle RPA scripts or waiting on APIs that legacy systems were never going to expose.

That gap has kept some of the most valuable workflows—the ones buried in vendor portals, internal web apps, and proprietary line-of-business systems—out of reach for modern automation. For enterprise IT teams, the challenge hasn’t just been automating these workflows. It’s been doing so in a way that remains secure, governable, and scalable across the business.

The gap is now closing. Computer use in Microsoft Copilot Studio is now generally available, and we're expanding availability to all commercial geographies in Microsoft Power Platform.

New computer use features generally available

With this release, every Copilot Studio maker can build agents that don't just reason and respond—they take action directly inside any application a person can use. For IT teams, GA represents more than a new automation capability; it’s a shift toward a more governable and enterprise-ready model for AI-driven work. Organizations can better standardize how agents operate across applications while maintaining security, observability, and administrative control through the Power Platform admin center.

With this release, computer use delivers:

Global availability across all commercial Power Platform geos, so customers in every region can deploy computer use in agents under their tenant's data residency and compliance boundaries.
Secure authentication with built in credentials and Azure Key Vault when signing in to website or desktop applications.
Enterprise governance built in, allowing lists for websites or desktop applications and native Power Platform governance capabilities such as DLP policies, environment isolation, and audit trails.
Human-in-the-loop checkpoints for low-confidence steps, exceptions, and decisions that require an operator's approval.
Run history and observability, so makers and admins can see exactly what the agent saw, what it clicked, and why. Logs are also propagated to Purview and Dataverse for audits and admin review.
Model choice for your agents, with models from OpenAI and Anthropic.

Add computer use as a tool in a Copilot Studio agent

Reach every system, including the ones without APIs

Computer use gives an agent the same tools a person has: a browser, a screen, a keyboard, and the ability to read what's on the page and take the next logical step. Instead of brittle selector-based automation, the computer use tool uses vision and reasoning to navigate live UIs—adapting when layouts shift, fields move, or workflows branch.

For organizations with deep investments in proprietary platforms or third-party portals, this changes the math on automation. Workflows that previously required either a multi-quarter integration project or an army of contractors clicking through screens can now be handed to an agent.

For enterprise IT organizations, this can also reduce pressure to modernize or rebuild every legacy workflow before automation can begin. That helps teams extend the value of existing systems while still moving toward broader AI transformation goals.

Customer spotlight: Graebel automates global service order processing end to end

Graebel, a global leader in talent mobility with approximately 1,500 employees, manages thousands of cross-border employee relocations every year for multinational clients. A significant share of those relocation requests arrives the way most enterprise work arrives: as free-form emails, full of unstructured instructions, attachments, and edge cases. Each email had to be read, interpreted, and entered by hand into Graebel's proprietary Global Connect platform.

Global Connect couldn’t support a API-based integration, and earlier robotic process automation (RPA) attempts proved too rigid to keep up with the variability of human-written emails. Graebel needed automation that could use reasoning, not just click.

Working with GET AI and Microsoft, Graebel built and deployed the Graebel Service Order Agent, equipped with computer use, in Microsoft Copilot Studio. The agent now:

Monitors designated mailboxes and interprets unstructured service-order emails using Azure Content Understanding, extracting key data into structured form with confidence scoring.
Validates each request against Graebel's business rules, service logic, and compliance requirements before any action is taken.
Operates Global Connect directly through its UI—navigating screens, entering data, and completing transactions exactly as a trained human operator would, without APIs or platform redevelopment.
Escalates exceptions and low-confidence cases through human-in-the-loop workflows, preserving governance and service quality.

Architecture of Graebel’s Power Automate flow and custom Service Order agent

“By adopting Microsoft Copilot Studio and AI agents, we’ve moved beyond traditional automation to a more intelligent, scalable operating model. This initiative strengthens our ability to serve clients faster and more accurately while positioning Graebel for long-term growth.” - Matt Brownlee, Chief Revenue Officer, Graebel

The Service Order Agent is live today and processing real volume, with an architecture designed to scale across more than 30 relocation service categories. For Graebel, the results include a meaningful reduction in manual effort, faster service-order turnaround, more consistent data quality, and a repeatable blueprint for bringing intelligent automation to the rest of their operations.

Read how Graebel drives growth and automation with Power Platform and Copilot Studio.

How to get started

Ready to try computer‑using agents in Copilot Studio?

Create or open an agent in Microsoft Copilot Studio.
Go to Tools → Add tool → Add new computer use.
Describe the task you want the agent to perform in natural language.

For deeper guidance, configuration details, and best practices, see the computer use documentation.

Before you go: We’re actively investing in advanced governance, operations, and scale for CUAs—and customer feedback directly informs the roadmap. Tell us what you think of the latest CUA updates today:

Email feedback to computeruse-feedback@microsoft.com
Join the Copilot Studio community

4 ways to build a curated Agent Store and scale agent adoption

AnnaCao — Tue, 12 May 2026 17:00:00 GMT

The agent adoption gap is real

Agents are quickly becoming a core part of enterprise AI strategy. The 2026 Work Trend Index shows 58% of employees are now producing work they couldn’t do a year ago, and AI is increasingly used for analysis, reasoning, and decision-making—not just tasks. While individual capability is accelerating, many organizations are struggling to keep up. The gap isn’t access to AI—it’s how work is designed around it.

In customer conversations, we consistently hear three blockers:

Where do we start? The catalog of AI solutions is expanding faster than most organizations can evaluate.
What can we trust? Without a curated channel, every new agent introduces security, compliance, and data governance work—slowing adoption.
How do we drive adoption? Even a great agent delivers zero value if employees don’t discover it or embed it in daily workflows.

Find and use agents from the Agent Store

Agent Store is a curated hub in Microsoft 365 Copilot where users can discover, install, and use agents directly in the flow of work. It brings together agents built by Microsoft, trusted partners, and your own teams, making them accessible across Microsoft 365 surfaces including Teams, Outlook, Word, Excel, and PowerPoint. It provides:

One central place to find agents from Microsoft, trusted partners, and your own teams.
Personalized discovery experience that surfaces relevant agents based on each user’s work context.
Fully vetted third-party agents designed to help you adopt with confidence.
IT-administered control and oversight on store catalog curation and management.

Agent Store homepage, showing a variety of available agents

4 pathways to a curated store: start where you are

There isn’t a single path to populate your catalog. Most organizations use more than one approach based on their goals and business needs:

Deploy pre-built agents from Microsoft and verified partners. This is the fastest route to get started with a new agent, with no development effort required.
Build agents and distribute through Agent Store using Microsoft Copilot Studio for faster time to value, or the Microsoft 365 Agents Toolkit and Agents SDK for pro-code development and deeper control.
Bring your own agents. If you’ve already built on Microsoft Foundry, third-party AI platforms, or custom code, you can still onboard them through the Microsoft 365 Agents Toolkit and SDK so they’re discoverable in the Agent Store.
Integrate with the Microsoft Agent 365 SDK to add enterprise capabilities such as Entra-backed identity, governed Microsoft 365 data access, observability, and cross-surface notifications without a full rebuild.

New Agent Store whitepaper available

To help organizations move from AI experimentation to scaled adoption, the new Agent Store whitepaper is now available for download. If you’re responsible for agent adoption strategy, governance, and scaled deployment, the new guide walks through the “why,” the “what,” and the “how.” It includes:

The business case for a curated, governed Agent Store.
A walkthrough of the Agent Store user experience.
Step-by-step IT deployment guidance for the four pathways.
Getting-started recommendations to help you move from exploration to impact.

Get the guide

Download the Agent Store whitepaper

More resources:

Documentation: Set up Agent Store in Microsoft 365 Copilot — Microsoft Learn
Agent Store Partner Guide
Administering and Governing Agents whitepaper

NEW UPDATES: Administering and Governing Agents whitepaper v3.2

Joe_Unwin — Mon, 11 May 2026 19:50:47 GMT

As AI agents move from pilot to production across organizations of every size, the question IT administrators are asking isn't just "How do we build agents?" It's "How do we govern them, at scale, without slowing the business down?"

That's exactly what the Administering and Governing Agents whitepaper is designed to help with. Downloaded more than 65,000 times by IT practitioners worldwide, it has now been updated to Version 3.2. Today you’ll find new and updated guidance that includes security and observability of your agents with Microsoft Agent 365, as well as discoverability of agents with the Microsoft 365 Agent Store. Additionally, there is new guidance on zone-based governance strategies, agent sharing controls, and agent owner reassignment.

As you continue to investigate, evaluate, or deploy agentic AI for your organization, keep this updated whitepaper on hand.

Why governance matters more than ever

Agents are being built by IT professionals, developers, and makers alike, using Microsoft Copilot Studio, Agent Builder in Microsoft 365 Copilot, and Microsoft Foundry. With that growth comes real accountability. Organizations carry responsibility for the agents they deploy—including how the agents access data, how they behave, and whether they comply with organizational and regulatory standards.

Governance can't be an afterthought. It needs to be built into the foundation from the beginning. As a long-time authority on security and governance, you can trust Microsoft to keep you updated with the information you need to run a secure agent ecosystem.

What the whitepaper covers

The Administering and Governing Agents whitepaper is designed specifically for IT practitioners and IT decision-makers in SMBs and large enterprises. It provides a structured, practical framework for securing and governing agents across the full Microsoft 365 ecosystem, from initial creation through deployment, monitoring, and ongoing management.

A governance framework built on three pillars

Effective governance starts with fundamentals. The whitepaper organizes core governance principles into three pillars: Policy, Process, and People.

Figure 1 Governance pyramid

No set of tools on their own can replace a clear governance strategy and disciplined processes, but the right tools make it far easier to operationalize those practices at scale.

Zones: a zonal tiered path to governance maturity

One of the most practical elements of the whitepaper is its zoned governance model, a structured framework that maps agent risk and technical complexity to three distinct governance levels, implemented as Environment Groups with the Copilot Studio admin controls. This model is designed to help IT teams adjust governance practices as agent risk evolves, enabling more intentional selection of controls over time while also still supporting early experimentation.

Zone 1: Personal productivity

The entry point. Agents assist with personal tasks, interact with Microsoft Graph data, and are confined to individual use. Security and sharing are tightly constrained by default, with connector access limited to approved Microsoft Enterprise plan and Copilot Studio core connections.

Zone 2: Team collaboration

Builds on Zone 1 with stricter connector controls, scoped Microsoft Entra security group access, and support for departmental agents. Editor access can be granted for collaborative development, but sharing remains governed and limited to internal channels.

Zone 3: Enterprise managed

The advanced tier for mission-critical or organization-wide agents. Managed by central IT or a Center of Excellence (CoE), with formal ALM pipelines, phased rollout controls, Sentinel integration, and the most rigorous security and compliance requirements.

Figure 2 Zonal Governance

Taken together, the zoned model gives organizations a practical way to govern agents as they grow. This methodology provides a clear path to go from individual experimentation to enterprise‑managed deployments without constantly redefining governance expectations. The whitepaper will show you how these zones map to real controls IT teams can apply over time.

Read the whitepaper

Governance pillars in depth

The whitepaper walks through three governance pillars applied consistently across each zone: Security controls, Management controls, and Agent Reporting.

Security controls span the Copilot Studio data policies, Microsoft 365 admin center, SharePoint Online permissions, Microsoft Purview (DLP, Insider Risk Management, Communication Compliance, eDiscovery, Audit), and Microsoft Sentinel for enterprise-grade threat detection.

Management controls cover environment provisioning, Managed Environments, Application Lifecycle Management (ALM), pipelines, connector management, and agent publishing controls.

Agent reporting is delivered through four experiences: Inventory, Monitoring, Security, and the Copilot hub, alongside Microsoft Purview for cross-tenant data security and compliance reporting.

Each of these pillars is explored in detail throughout the whitepaper, covering how to configure controls, interpret reporting signals, and apply governance continuously as your agent deployments grow in scale and complexity.

The Agent Store as a governed distribution point

The whitepaper also highlights the Microsoft 365 Copilot Agent Store as a discovery and access point for agents. It covers distribution paths for Microsoft-built, partner-built, custom Copilot Studio, Teams Toolkit, and Agent 365 SDK-enabled agents, and how IT administrators maintain control over what is available and to whom. This is an area we've heard about consistently from admins, partners, and the field. Who gets access to which agents, and how IT stays in control of that, matters.

Figure 3 Agent Discoverability via Agent Store

Summary: What's new in Version 3.2

This update brings three focused changes.

Agent Store as a governed entry point: New coverage of the Microsoft 365 Copilot Agent Store as a discovery and access point for agents, including distribution paths for all five agent categories and how IT administrators maintain control at every stage.
A365 security and observability: Guidance has been introduced, covering onboarding and critical steps for maintaining visibility and security for agent activity across the tenant.
Terminology and graphics updates to comply with name changes and enhancing visuals.

Get started

If you are just starting your agent governance journey or looking to put a more robust framework in place, the updated Administering and Governing Agents whitepaper (Version 3.2) is a practical, comprehensive resource for IT teams managing agents in Microsoft 365.

Download the whitepaper to start building governance that scales with your agents and your business.

Read-only analytics access and custom metrics now available in Microsoft Copilot Studio

Eran_Manor — Tue, 05 May 2026 20:25:38 GMT

Turning Copilot Studio analytics into clear business insight

As organizations scale their use of AI agents, IT teams face a familiar dilemma: How do you give stakeholders the insight they need—without compromising proper oversight?

Expanding access to analytics can mean granting permissions beyond what’s appropriate for a given role. Meanwhile, locking things down preserves control…but creates bottlenecks to information. This forces teams to rely on a small group of people to export and share data across multiple tools just to answer basic questions on analytics—let alone dig into data that truly demonstrates how effective your agents are.

So how can your team get the most relevant, important agent metrics to the right people with the right level of access? Microsoft Copilot Studio now offers two new analytics capabilities that address this need directly:

- Analytics Viewer role, which allows an agent owner to grant read-only access to an agent’s Analytics page.

- Custom metrics, which gives teams the flexibility to add and track specific outcome-based measures aligned to their particular goals for an agent.

The Analytics Viewer role in Copilot Studio

The Analytics Viewer role provides view-only access to an agent’s Analytics page, without permission to edit, configure, publish, or share the agent.

Now generally available, it enables analysts and stakeholders to monitor agent performance securely without affecting agent behavior.

. When you share an agent with Analytics Viewer permissions:

Users get access only to the Analytics page.
All other agent pages, actions, settings, test panels, and publishing experiences are hidden and unavailable.
Analytics Viewers currently can’t define or update custom metrics and savings.

Tip:
For deeper investigation and root-cause analysis, consider granting analysts the Dataverse Bot Transcript Viewer role. This allows Analytics Viewers to drill into the transcripts for detailed analysis.

See the new Analytics Viewer option in the agent sharing experience:

Who should use the Analytics Viewer role in Copilot Studio?

Analytics Viewer is designed for users who need visibility without authoring access. This includes analysts, product owners, business stakeholders, and operations teams that monitor agent performance, trends, and issues.

This feature supports clear separation of duties: IT pros and admins manage agents, while analysts consume insights and investigate performance.

Analytics page for Analytics Viewers:

Why the Analytics Viewer role matters

For many organizations, access to analytics has been a major blocker for adopting agents in production. It’s understandable. Teams often need production insights, but only a small set of users should be able to change production agents.

Until now, customers have typically exported analytics for offline analysis or built custom reporting outside Copilot Studio. With the Analytics Viewer sharing role, agent owners can share analytics safely—without expanding edit permissions.

Not only does this expand access to insight while maintain proper oversight, it removes a key point of friction, helping teams keep tools streamlined and reduce time to information:

Stakeholders can access analytics directly, on demand, without relying on exports or intermediaries.
Teams can grant visibility more broadly, with permissions scoped appropriately to each role.
Business and product stakeholders can monitor performance that updates after every use, helping them make quicker decisions.

This shift allows analytics to function as a shared, operational capability across teams, while allowing IT and admins to maintain confidence that governance standards are upheld.

“The Analytics Viewer role allows us to provide meaningful performance insights to business and operational stakeholders while maintaining strict production governance. It cleanly separates operational visibility from agent configuration and publishing rights.”

Mohamed Arhab

Solution Architect, City of Montreal

Learn more about the Analytics Viewer role here.

Custom metrics: measure the outcomes your business cares about

As agents become part of business workflows, analytics must move from usage to impact. Standard metrics show activity but don’t answer the key question: did the agent achieve the desired business outcome?

Custom metrics in Copilot Studio shift analytics from activity to business outcomes - helping you understand not just usage, but the results agents deliver. They enable evaluation in business terms, supporting ROI, decision making, and stakeholder alignment.

Define success in your own terms

With custom metrics, now available in public preview, you define success in terms your business understands. Custom metrics are calculated by analyzing agent conversations.

You describe:

The outcome you want to measure.
The set of allowed result categories that represent that outcome.

These results are classification-based. For example, outcomes might be:

Ticket deflected or Not deflected.
Goal completed correctly, Completed with issues, or Not completed.
Converted or Not converted.

Based on your definition, Copilot Studio automatically generates the prompt that will be used to evaluate agent conversations. This helps keep evaluations consistent, while maintaining the focus on business meaning rather than technical implementation.

Clear, actionable results provided by custom metrics

Each conversation with an agent maps to exactly one outcome category that you define for it. This classification-based approach makes results:

Easier to interpret, because outcomes are explicit.

Easier to explain to stakeholders, because they map to business language.
Easier to act on, because teams can see clear outcome distributions rather than abstract scores.

As examples of clear, actionable results, consider the sample use cases from before:

Ticket deflection: Understand how effectively (how often, by percentage) an agent resolves issues without escalating to human support.
Goal completion quality: Evaluate whether users are achieving the intended business outcome successfully (yes/no).
Sales conversion: Measure how often interactions lead to a qualified outcome or purchase (by percentage or number).

When used thoughtfully, these outcome classifications become a shared language across teams, helping organizations operate agents with greater confidence and clarity as they scale.

How custom metrics help teams operate more effectively

Custom metrics shift agent Analytics pages from being purely a reporting tool to becoming an operational decision-making tool.

Teams can align early on what “good” looks like, using a common definition of success across product and business stakeholders. When performance is evaluated based on outcome distributions—not isolated signals—it’s easier to understand what’s working and what isn’t in your agents.

Over time, this helps facilitate a more intentional approach to agent fine-tuning and iteration:

Teams can see how changes to an agent affect real outcomes.
Decisions can be tied directly to business impact.
Leaders can use measurable results to prioritize investment decisions.

As agents take on more responsibility, this outcome-first model becomes essential for scale because teams need a clear, consistent way to measure impact, align decisions, and confidently expand what agents are trusted to do.

Learn more about custom metrics, now in preview, here.

The right insights for the right people

Individually, the Analytics Viewer role and custom metrics solve different challenges. Together, they help reshape how teams work with analytics and create more value. Analytics Viewer makes it possible to share analytics safely, without expanding access beyond what’s secure and sensible. Custom metrics help ensure your business can measure what you care about.

The result is a better balance between insight and oversight—a fulcrum where visibility can scale across teams without introducing new governance risks. As agents become a core element of business workflows, this combination helps organizations measure impact, demonstrate ROI, and operate agents with greater accuracy and confidence to expand.

That’s the direction Microsoft Copilot Studio continues to move toward: helping organizations not just build and deploy agents, but analyze them with clarity, confidence, and control at scale.

Explore Analytics Viewer and custom metrics in Copilot Studio today to start bringing the right metrics to the right people—at the right level of access.

Work IQ API public preview: Build Copilot powered agents with A2A

tolgaki — Mon, 11 May 2026 19:44:43 GMT

Today, the Work IQ API is available in public preview, expanding access to the same underlying intelligence capabilities used by Microsoft 365 Copilot for developers and partners.

Work IQ gives developers programmatic access to Copilot so you can build agents and apps that use Copilot’s grounding, context, and reasoning without wiring raw data or permissions. In this public preview, that access is exposed in three formats—Agent‑to‑Agent (A2A) for agent collaboration, Model Context Protocol (MCP) for IDEs and tools, and REST for app integrations—letting you choose the right surface for your scenario while relying on the same intelligence runtime.

Work IQ continuously builds context through memory and a semantic index across organizational data, Microsoft 365, line‑of‑business systems, and external sources. The result is a unified foundation for building agents, applications, and workflows grounded in how work actually happens, with enterprise‑grade security and governance built in by default.

With the Work IQ API, developers build on permission‑aware intelligence—context, intent, signals, and skills—so applications and agents understand what’s in motion, what’s been decided, and what needs attention next.

For developers, this means:

No raw data wiring: Work with intelligence instead of directly accessing emails, files, or chats.
No orchestration overhead: A single runtime handles context assembly, grounding, skill selection, and tool invocation.
No security rework: Enterprise compliance, governance, and access controls are inherited automatically.

Where Work IQ API is available

Work IQ API meets developers where they are, supporting four protocols that share the same underlying intelligence runtime. This means that the behavior, grounding, and response quality stay consistent across every surface.

Model Context Protocol (MCP) — local server (available now): Works with GitHub Copilot through the Work IQ CLI, giving MCP-compliant agents governed access to organizational context as tools and resources directly from their IDE or CLI workflow.
Agent-to-Agent (A2A), new in this public preview: A cloud-hosted protocol that enables custom agents to interact directly with Copilot intelligence as a peer—delegating work, receiving grounded responses, and maintaining context across interactions.
REST (coming May 2026): Standard request/response access to Work IQ intelligence for applications and integrations that don't require streaming or agent-to-agent coordination.
Model Context Protocol (MCP) — remote server (coming May 2026): A hosted MCP server exposing a standard set of tools and skills for interacting with M365 data, so any MCP-aware surface can connect to Work IQ without running a local server.

What’s new: Agent-to-Agent (A2A) protocol

This public preview introduces the Agent‑to‑Agent (A2A) protocol, which allows custom‑built agents to interact directly with the intelligence layer behind Copilot. Over time, A2A will expand to support collaboration across a broader set of agents and tools that support A2A or MCP, meaning agents can work together with specialized, organization‑aware capabilities.

With A2A, agents communicate as peers. Rather than calling a traditional API and parsing a response, an agent can delegate work to another agent running on Work IQ—an agent with access (subject to the user’s and tenant’s permissions) to organizational context across emails, meetings, files, and conversations—and receive responses that are grounded in enterprise data and governed by the same security and compliance policies.

Here’s what that looks like in practice: a single A2A message sent to a Copilot agent using standard .NET A2A SDK:

var credential = new InteractiveBrowserCredential(clientId);
        var token = await credential.GetTokenAsync(new (["api://workiq.svc.cloud.microsoft/WorkIQAgent.Ask"]));
        var httpClient = new HttpClient();
        httpClient.DefaultRequestHeaders.Authorization =
            new AuthenticationHeaderValue("Bearer", token.Token);

        // Create an A2A client that talks to the default WorkIQ agent endpoint, using the authenticated HttpClient
        var client = new A2AClient(new Uri("https://workiq.svc.cloud.microsoft/a2a/"), httpClient);

        // Compose a query
        var question = "What meetings do I have tomorrow that I need to prepare for?";

        // Send the query and WorkIQ returns an A2A task that when complete will contain
        //  a grounded, permission-trimmed answer
        var response = await client.SendMessageAsync(new SendMessageRequest
        {
            Message = new Message
            {
                MessageId = Guid.NewGuid().ToString("N"),
                Role = Role.User,
                Parts = [Part.FromText(question)]
            }
        });

Developers can rely on Work IQ to handle common retrieval and permission-enforcement tasks, reducing the need to build and maintain custom pipelines. The full working samples (C#, Rust, and Swift) are available here.

What A2A unlocks for developers

Multi-agent collaboration: Your agents delegate to Copilot agents that understand organizational context.
Embedded intelligence via agents inside SaaS products that tap into a customer’s real work context.
Enterprise assistants tailored to specific roles, powered by Copilot’s grounding and reasoning.
Autonomous workflows where agents hand off tasks, track progress, and exchange structured artifacts.

See A2A in action

The demo above shows an agent sending a natural-language request to Copilot via A2A and receiving a streamed, grounded response—backed by the user’s real organizational data, with no custom retrieval or permissions code. Try it yourself with the Work IQ samples on GitHub.

How developers can use Work IQ API

Whether you’re connecting agents via A2A, surfacing organizational context through MCP in developer surfaces like IDEs and CLIs, or embedding conversational experiences via REST, the patterns share a common foundation.

A2A is the natural fit when your agent needs to collaborate with Copilot intelligence as a peer—delegating work, receiving structured results, and maintaining context across interactions. For example, a sales enablement agent could ask to pull together a customer's recent email threads, meeting notes, and shared documents, then use that grounded summary to auto-generate a pre-call brief—without ever touching the raw data itself.

MCP is ideal when you need to expose Work IQ data as tools and resources to an existing MCP-compliant agent using standard protocols and tooling, without needing custom, one-off connections. For example, with the Work IQ CLI running as a local MCP server, a developer using GitHub Copilot can ask, "What did the team decide about the migration timeline?" and get an answer grounded in actual emails, meeting transcripts, and chat threads—right inside their IDE, without leaving their coding workflow.

The common thread across these approaches is a shift from isolated AI features to agent‑driven systems that stay aligned with how work actually unfolds.

Security and governance

Developers can rely on Work IQ for common security and compliance controls. The Work IQ API draws a clear platform boundary between data access and intelligence:

Permissions: User and tenant permissions, conditional access policies, and sensitivity labels are automatically enforced.
Responses: Permission-trimmed by design.
Compliance: All activity operates within the same audit, compliance, and data-loss-prevention boundaries as Microsoft 365.

Because the API exposes intelligence rather than raw data, applications cannot accidentally bypass tenant security or create shadow-AI risks. Agents operate within the tenant’s existing security and compliance controls from day one.

What comes next for Work IQ

Users with the appropriate license will be able to access Work IQ in customer and partner apps and agents starting today.

General availability is planned for summer 2026. The Work IQ API will also be available to unlicensed users on a consumption basis in summer 2026.

We will continue to add more to the Work IQ API in the coming weeks and months. Our investments will target three areas:

M365 Agent access, enabling more M365 agents to work with and alongside agents across the Copilot ecosystem, unlocking richer multi-agent collaboration patterns.
Remote MCP server public preview, exposing Work IQ as tools and related skills for MCP-compliant agents, so any MCP-aware surface can access governed organizational context.
Deeper connection and richer intelligence, expanding across platforms and developer tools in addition to building on top of organizational data with contextual grounding, skills, and tools.

Resources

Building with the Work IQ API and have questions? Join our developer communities for support:

Microsoft Q&A: Microsoft Copilot | Microsoft 365 Copilot | Development
GitHub: Work IQ GitHub repository: microsoft/work-iq: MCP Server and CLI for accessing Work IQ
Reddit: copilotstudio or microsoft_365_copilot subreddits
Documentation: Microsoft Work IQ API (preview) | Microsoft Learn
Samples: https://github.com/microsoft/work-iq-samples

We can’t wait to see what you build.

Automate agent evaluation with the Evaluation APIs

Efrat_Gilboa — Wed, 29 Apr 2026 18:34:14 GMT

When you build an agent in Microsoft Copilot Studio, you want confidence that it behaves exactly as intended: answering correctly, using the right tools, and following the logic you designed. Agent Evaluation (generally available) provides this foundation by allowing you to define test sets, run them against your agent, and understand how it performs.

As agents evolve from experimentation into real production scenarios, this foundation becomes part of an ongoing process. Evaluation is no longer a one-time step, but a continuous part of the development lifecycle. Teams are looking to validate changes quickly, track quality over time, and ensure consistent behavior across updates, environments, and use cases.

To support this, evaluation scales alongside your agents. Automated evaluation enables teams to expand their testing coverage, run evaluations more frequently, and establish consistent quality signals across the lifecycle. It brings evaluation closer to the way modern systems are built: iterative, data-driven, and continuously improving.

To fully realize this at scale, evaluation integrates seamlessly into your workflows and systems.

Now, these same evaluation capabilities can be used programmatically through Power Platform REST API and your connectors. Here’s how you can use these Evaluation APIs to automate agent evaluation as part of your development and release workflows.

What you can do with the Evaluation APIs

The Evaluation APIs expose the core evaluation experience as programmable endpoints. Using those endpoints, you can trigger evaluations on demand, integrate evalutaions into pipelines and approval workflows, and design processes relying on the results. Whether you prefer a code-first approach with APIs or a low-code experience using Microsoft Power Automate flows and Copilot Studio agent workflows, you can easily automate when and how evaluations run – and use the results for quality gateway.

Here are the capabilities included in the Maker Evaluation API:

Capability	What it does
List test sets	Retrieve the test sets configured for your agent
Run a test set	Trigger a test set to execute against your agent
Poll run status	Poll a running evaluation to see when it completes
Retrieve results	Retrieve detailed results including per-test-case scores
List historical runs	List all previous evaluation runs for reporting or comparison

These APIs work with any HTTP client, Python scripts, Azure DevOps pipelines, GitHub Actions, or custom tooling. For teams working in the Power Platform ecosystem, the same actions are available through the Microsoft Copilot Studio certified connector, which integrates directly with Power Automate flows.

When to use Evaluation APIs

The Evaluation APIs exist so you can run evaluations without manually triggering them, letting evaluation happen automatically as part of your pipelines, your flows, or your own tools. By default, runs evaluate the agent’s unpublished (draft) version, which makes this especially useful for CI/CD and pre-publish validation. The Copilot Studio UI is still the right place for one-off, interactive evaluation. Reach for the APIs when you want evaluation to happen on its own.

Here are three common scenarios.

1. Add evaluation to your CI/CD pipeline

When your agent source lives in a repository, every pull request and every merge to main is an opportunity to validate quality before changes reach production. Wire the Evaluation APIs into Azure DevOps, GitHub Actions, or any CI runner: each pipeline run triggers an evaluation, waits for the result, and passes or fails the build based on the score. Quality regressions are caught at PR time, not in production.

2. Trigger evaluation from a Power Automate flow

Many events that may affect agent quality happen outside Copilot Studio: a knowledge source is updated in SharePoint, a new article is added to a file library, a Dataverse record changes agent behavior. Use Power Automate (with the Microsoft Copilot Studio certified connector) to listen for these events and kick off an evaluation test run automatically, then route the results to Teams, email, or whichever channel your team watches.

3. Embed evaluation in your own tools

Sometimes you want evaluation as part of a tool you’re already building: a Center of Excellence dashboard tracking quality across many agents, an admin script that confirms every new agent has been evaluated before publish, or a custom integration that adds evaluation to an existing approval workflow. The APIs let you call evaluation programmatically from any system, with whatever logic fits your scenario.

How an evaluation run works through the API

The evaluation flow follows a simple pattern: Trigger → Poll → Get Results.

Trigger: Send a POST request to start an evaluation run for a specific test set
Poll: Check the run status until it completes (the execution is asynchronous)
Get results: Retrieve the score and detailed per-test-case outcomes

Optionally, you can pass an MCS Connection ID when triggering a run. This allows the evaluation to run using an authenticated user context, enabling access to tools and knowledge sources that require authentication. Without it, the evaluation will run anonymously.

Working with the Evaluation APIs: the key endpoints

Below are the core Evaluation API endpoints available today, starting with how to retrieve test sets and trigger evaluation runs programmatically.

Prerequisites

API Permissions.

Go to https://portal.azure.com
Go to App Registrations
Search for your App
Click API permissions
Click Add a permission
Click APIs my organization uses
Search "Power Platform API"
Click Delegated permissions
Expand CopilotStudio
Select MakerOperations.Read, MakerOperations.ReadWrite
Click Add Permissions

Endpoint 1: Retrieve available test sets

Use this endpoint to list all evaluation test sets defined for a specific agent.

Request:

GET https://api.powerplatform.com/copilotstudio/environments/{yourEnvironment}/bots/{replaceWithYourCdsBotId}/api/makerevaluation/testsets?api-version=1

Expected result:
Returns the list of maker evaluation test sets associated with the agent.

Sample response:

Endpoint 2: Retrieve a specific test set

Once you have a test set ID, you can fetch its full definition.

Request

GET https://api.powerplatform.com/copilotstudio/environments/{yourEnvironment}/bots/{replaceWithYourCdsBotId}/api/makerevaluation/testsets/{yourTestSetId}?api-version=1

Expected result
Returns the full configuration and structure of the selected test set.

Sample response:

End point 3: Trigger an evaluation run

This endpoint allows you to programmatically start an evaluation run for a given test set.

The Body consists of a JSON object with the following attributes:

McsConnectionId - string value. If an empty string is provided, the evaluation runs anonymously, meaning tools and knowledge sources are not used. Agents that rely on authenticated connectors, actions, or auth‑gated knowledge sources will therefore produce different (likely worse) evaluation results.

RunOnPublishedBot - optional boolean value, defaults to false. Runs against the draft version (true runs against the published version).

EvaluationRunName - optional string value, useful for naming runs in dashboards.

Request

POST https://api.powerplatform.com/copilotstudio/environments/{yourEnvironment}/bots/{replaceWithYourCdsBotId}/api/makerevaluation/testsets/{yourTestSetId}/run?api-version=1

Body

{

“RunOnPublishedBot”: {boolean value},

"mcsConnectionId": "{yourMCSConnectionId}",

“evaluationRunName”: “{yourEvaluationRunName}”,{

}

Sample request:

Sample response:

Removed the note

How to obtain mcsConnectionId

Go to: https://make.powerautomate.com
Open Connections from the side menu
Select the relevant Microsoft Copilot Studio connection
Copy the connection ID from the URL

This connection ID will look something like:

https://make.powerautomate.com/environments/Default-00000000-0000-0000-0000-000000000000/connections/shared_microsoftcopilotstudio/shared-microsoftcopi-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/details

Note: One run at a time
The API returns HTTP 422 if you try to start a run while another is already in progress for the same agent.

Endpoint 4: Get evaluation run status and results

After triggering a run, use the returned run ID to retrieve status and results.

Request

GET https://api.powerplatform.com/copilotstudio/environments/{yourEnvironment}/bots/{yourCdsBotId}/api/makerevaluation/testruns/{yourTestRunId}?api-version=1

Expected result
Returns the status and once completed, the evaluation results.

Sample response:

End point 5: List previous evaluation runs

This endpoint is useful for tracking trends, building dashboards, and supporting automated decision logic.

Request

GET https://api.powerplatform.com/copilotstudio/environments/{yourEnvironment}/bots/{yourCdsBotId}/api/makerevaluation/testruns?api-version=1

Expected result
Returns an array of previous evaluation runs, each with the same schema as the run details API.

Sample response:

Start using the Evaluation APIs today

Pick a test set, call the API, and see what your agent scores. That first run gives you a baseline. From there, you can automate evaluations into your workflow, set thresholds, and build the checks that make sense for your team. The APIs are available now. Start simple, and build from there.

Sign into Copilot Studio to get started today.

Hello, World - Welcome to the Copilot Studio Blog!

David_Abu — Thu, 09 Apr 2026 18:16:55 GMT

We’re so excited you’re here.

Today marks the launch of the Copilot Studio Tech Community Blog, a space for the builders and admins shaping the agent era in the real world.

Agents are moving from demos to production, so we’ll focus on practical patterns for building, shipping, and governing at scale, beyond what docs and product announcements cover. Makers will find templates and build tactics; IT and security will get governance guidance; developers will get deeper dives on extensibility and production operations.

Hit Follow at the top of the page and introduce yourself in the discussion forum, with what you’re building

What Is Microsoft Copilot Studio?

Microsoft Copilot Studio is Microsoft’s platform for building and governing AI agents across the enterprise, from prototyping to production. For the full product overview and getting-started guidance, visit the Copilot Studio website.

What’s New in Copilot Studio

We’re not starting this blog quietly. Here’s a look at three of the biggest updates that have shipped recently.

1. Agent Evaluation — Now Generally Available

Testing agents manually, one conversation at a time, doesn’t scale. Agent Evaluation gives makers a built-in, no-code way to test and monitor agent quality, safety, and reliability at scale. Create evaluation sets using AI-generated queries, past test sessions, or your own QA pairs — then run them automatically to catch regressions before they reach users.

2. Computer-using agents — more secure UI automation at scale

Computer-using agents (CUA) can now automate tasks through user interfaces—clicking, typing, and navigating apps when an API isn’t available—while delivering a more secure approach for UI automation at scale (with stronger controls for admin governance and credential handling).

3. Multi-agent orchestration, connected experiences, and faster prompt iteration

One of the biggest recent updates is improved multi-agent orchestration, alongside new connected experiences and faster prompt iteration, so you can coordinate specialized agents more effectively and refine behavior faster as you move from prototype to production.

Resources to Bookmark

Resource	What It's For
Copilot Studio Documentation	Official product docs, tutorials, and references
2026 Release Wave 1 Plan	What's shipping April–September 2026
Copilot Studio Discussion Space	Ask questions, share ideas, connect with peers

Next steps

1. Hit Follow at the top of the page and introduce yourself in the discussion forum with what you’re building

2. New to Copilot Studio? Sign up for the free trial and bookmark the resources below for docs, release plans, training, and governance guidance.

We can’t wait to see what you create.

Agent Evaluation in Microsoft Copilot Studio is now generally available

Efrat_Gilboa — Tue, 31 Mar 2026 19:13:36 GMT

As agents move into production, evaluations help take each build from experimentation to a reliable system. And they help answer the question that matters most in production: Can we trust this agent to behave correctly, consistently, and safely — every time?

Manual testing simply can't scale to answer that question. Spot-checking responses one-by-one is slow, inconsistent, and not designed for agents that handle hundreds or thousands of interactions. Agent Evaluation in Microsoft Copilot Studio helps fill that gap.

Today, we are giving every maker a better way to assess agent behavior at scale—before launch and over the agent's lifecycle. Agent Evaluation is now generally available.

Validate production readiness before launch and after every change

Agent Evaluation is built directly into Copilot Studio—there’s no separate tool to install and no integrations to configure. Within the agent, the evaluation experience provides an end-to-end workflow for creating test cases, running evals, and reviewing results, all without writing a single line of code.

Whether you're a maker validating readiness before publishing, a quality assurance (QA) team enforcing organizational standards, an agent owner preparing for rollout, or a compliance team that needs documented evidence of agent behavior, Agent Evaluation is designed to integrate into the workflows teams already use to ship and operate agents.

Designed to build trust at scale

Agent Evaluation is designed for organizations that carry real accountability for the agents they deploy. That means evals need to fit into existing workflows, help gather compliance documentation, and produce results that hold up to scrutiny.

Versioned and auditable results

Every evaluation run produces a structured record, including the test set used, the user profile that ran it, the date and duration, and the results from each grader for every test case. These records are available in the evaluation history view, where teams can track performance over time and compare results across runs. For regulated industries and compliance-driven deployments, this record is the artifact that can help demonstrate that an agent was tested against defined behavioral standards before reaching users.

Identity-based evaluation

Each evaluation run is associated with a selected user profile. The agent is evaluated under that identity, using the same knowledge sources, tools, and connectors that the maker accesses in production. This helps ensure evaluation results reflect real-world behavior, rather than a simplified test environment.

API-based evaluation

For teams that operate continuous integration and delivery pipelines, Agent Evaluation is available via API. Teams can retrieve test sets, trigger evaluation runs, and track results programmatically, integrating evals directly into existing deployment workflows to assess agent behavior proactively at scale.

Running an evaluation: from test case to results

Agent Evaluation in Copilot Studio follows a guided workflow that helps makers move from setup to results without disrupting their workflow or leaving the product.

Step 1: Create a test set

Evaluation starts with creating a test set—a collection of questions or scenarios used to assess an agent’s behavior. Makers can build test sets in multiple ways: uploading a CSV with prepared questions and expected responses, writing targeted questions manually, or generating questions from production conversations based on common topics.

To help teams save time configuring test questions, Copilot Studio even includes built-in AI generation options:

The quick question set generates 10 questions instantly based on the agent’s description, instructions, and capabilities, providing an initial signal with minimal preparation required.
The full question set generates up to 100 questions drawn from the agent’s knowledge sources or defined topics, helping teams build broader coverage grounded in the agent’s actual content.

Step 2: Configure evaluation methods

With test cases in place, makers can determine how evaluations measure agent responses by selecting one or more test methods. Built-in methods cover a range of evaluation dimensions, including:

General response quality
Semantic meaning relative to an expected answer
Keyword presence
Text similarity
Exact match
Capability usage

However, for organizations that need to go beyond these dimensions, Custom Graders (available as a Classification method) allow makers to encode your organization’s policies, quality standards, or other rules directly into the evaluation.

Keep in mind, multiple methods can be combined in a single test run, giving teams a layered view of agent performance.

Step 3: Run the evaluation and review results

Once the test set and methods are configured, makers can run the evaluation directly from Copilot Studio. Results appear in a structured table, with each row representing a test case and each column representing an evaluation method.

Pass and fail signals are visible immediately, and the Evaluation summary panel shows aggregated scores across all methods for a given run. Selecting an individual test case opens a detailed view with the agent's full response, the result and explanation from each grader, the expected answer where you've provided one, and the knowledge sources the agent used to generate its response.

Because a test set can be saved and reused, evaluation becomes a repeatable quality check across agent versions. When a prompt changes, a knowledge source is updated, or a new capability is added, the same test set then runs again—producing consistent, comparable signals that help teams validate changes before they reach end users.

What's next for Agent Evaluation?

General availability establishes the foundation. From here, there are already plans to expand evaluation coverage to support multi-turn conversation, deeper automation, and more of the deployment lifecycle, so organizations can monitor agent reliability at scale.

The goal is evaluation that travels with your agent from first build through ongoing production use. And you can start today. Open the Evaluation tab in Copilot Studio, choose a test method, and run your first evaluation in minutes. No code required.