Microsoft Copilot crossed a line this year. Across 2026 Release Wave 1 (April–September 2026), which has just wrapped, and Wave 2 now opening from October, it went from a chat assistant to a platform for building autonomous agents that act across Microsoft 365. Agent Mode landed in Word, Excel, and PowerPoint for iterative creation and analysis; operations agents can identify a signal, update the system of record, file a ticket, and notify stakeholders with context — largely on their own; role-based agents in Microsoft 365 Copilot are becoming per-role daily command centres; and child agents plus Model Context Protocol (MCP) connectors let agents call other agents and standardised tools. Much of it is low-code, so it's not only developers building these. That is a genuine step-change in capability — and a governance job that arrives at exactly the same moment.
What's actually new
The headline isn't "Copilot is smarter." It's that Copilot Studio now lets you assemble software that acts:
- Agent Mode in Office apps — drafting, building, and analysing iteratively inside Word, Excel, and PowerPoint, rather than one-shot answers.
- Autonomous operations agents — watch for predefined signals, take action in the system of record, raise and route tickets, and notify people with the context they need.
- Computer-using agents and real-time voice — agents that can drive applications and hold a spoken conversation (voice agents now ship with a consent-based recording template by default).
- Multi-agent and MCP — child agents and Model Context Protocol connectors, so an agent can delegate to other agents and reach standardised tools instead of bespoke one-off integrations.
- Role-based agents in Microsoft 365 Copilot — per-role command centres with data-grounded insights, rather than one generic assistant for everybody.
- Low-code creation — business teams can build agents, not just central IT, with real-time monitoring via Application Insights and built-in time/cost-savings tracking.
The opportunity is also the risk
That last point — anyone can build one — is the whole story. It's the same dynamic that made Power Platform spread through organisations, now applied to software that can act on your systems. Agent sprawl is app sprawl with permissions. An ungoverned agent estate is a set of non-human actors, built by people outside IT, holding access to real data and real actions, that nobody is inventorying. Left alone, that's how a productivity win becomes an incident.
Enablement and governance are now the same job
You cannot separate "roll out Copilot agents" from "govern Copilot agents" any more. Four controls make the capability safe to unleash:
- Environment strategy + DLP for Copilot Studio. Govern it the way you'd govern Power Platform: who can build, in which environment, with what connectors and data. This is the natural next step from Copilot enablement and governance.
- Treat every agent as a non-human identity. Scoped credentials, least privilege, and a named owner — the non-human identity discipline applied inside your Microsoft tenant.
- Fix data access first. Copilot honours existing permissions, so SharePoint and Teams oversharing becomes oversharing by agents. Remediate access before you scale — the prerequisite most rollouts skip, and the heart of our Copilot rollout checklist.
- Monitor and measure. Use Application Insights and ROI tracking to see what each agent does and what it's worth — then keep what lands and cut what doesn't. Value per agent, not agent count.
These are the same production-agent guardrails every agent needs — here, delivered natively inside the Microsoft stack you already own.
The bottom line
Copilot Studio has turned Microsoft 365 into an agent-building platform, and the low-code path means the agents are coming whether or not you've prepared for them. The organisations that win won't be the ones who switch everything on; they'll be the ones who enable and govern in the same breath — environment strategy, identity, data hygiene, and measurement in place before the sprawl. That balanced approach is the core of our Copilot & Power Platform work.
Want to enable Copilot agents without losing control of your tenant? Let's plan it.