Copilot Studio agents get their own Microsoft 365 accounts and a shared team memory

What Microsoft announced

Microsoft announced three features for Copilot Studio on 15 October 2026 that let companies treat an AI agent more like a staff member than a chat window. In a Copilot blog post, Copilot Studio vice president of product Jason Moore introduced agent accounts, business process memory and triggers in the GitHub Copilot harness, the agent runtime that now sits under Copilot Studio.

Agent accounts give an agent its own Microsoft 365 identity, so people can @mention it in Teams, email it in Outlook or tag it in comments in Word, Excel and PowerPoint. Business process memory lets the agent carry context from one cycle of a recurring process into the next. Triggers let an agent start work on its own when an email arrives or a schedule comes round, without anyone typing a prompt.

The features are rolling out through Microsoft's Frontier program, its early-access channel, and the documentation marks them as preview. Microsoft's pitch is that these agents belong to the organization and persist beyond any one person's role or tenure, unlike the personal Copilot assistant it updated in September.

What an agent account includes

The setup guide for agent accounts is specific about what the agent gets when it is published: its own Microsoft Entra ID account, a mailbox that can send and receive email and join distribution lists, a presence in Teams and the company directory, and the ability to be found and @mentioned like a colleague. Copilot Studio also creates a separate Entra Agent ID for each agent with an account, which administrators manage on their own.

The account matters for permissions and audit. Tools set up for end-user authentication run under the agent's own identity and consent rather than borrowing the maker's credentials, and actions can be attributed to the agent in logs. Microsoft says that makes it easier for process owners to see which steps were taken by agents and which by people.

Some details are fixed during the preview. The agent's email address uses the maker's own alias as a prefix, the agent reports to the maker in the directory, and neither the prefix nor the reporting line can be changed. The address cannot be changed after publishing either, so Microsoft tells makers to plan the identity first.

Who can turn it on, and what it costs

This is not a feature a single team can switch on. The environment has to be on Power Platform's early release cycle, and an administrator has to activate the Copilot Studio agent template in the Microsoft 365 admin center, choose which users or groups may create agents with accounts, and turn on agent accounts for the environment in the Power Platform admin center.

Makers need a Microsoft 365 E5 licence with the Microsoft Agent 365 add-on, or an E7 licence, which includes Agent 365. The tenant must be enrolled in Frontier and have accepted the Agent 365 terms of service. Each published agent then consumes one Microsoft 365 Frontier for AI Teammates licence, and publishing fails if none is free in the pool.

Running the agent costs extra on top of that. Usage-based billing in Copilot Credits applies to using, building, testing and evaluating agents on the GitHub Copilot harness. Microsoft did not publish a price for the Frontier for AI Teammates licence in these pages.

Business process memory is shared by design

Memory is where the documentation gets most careful. For ordinary Copilot Studio agents, the memory guide describes a private store per user: the maker and other users cannot see it, it is switched off in group chats and Teams channels, and a user's memories are deleted after 28 days without interaction.

Agents with their own account work the other way. They keep one shared memory across everyone they work with, even in one-to-one chats. That memory holds facts about the work, such as team processes and terminology, and details about individual people, such as how someone likes to get updates. Microsoft calls this a feature: what one person explains to the agent becomes a shared resource for the team.

The setup guide spells out the trade-off. The agent's People card warns that any files or chats a user shares can be summarized and included in the agent's answers to any user, even users without permission to those files and regardless of sensitivity label. The guide says the agent is guided not to bring up one person's details with someone else, but that shared memory has no privacy boundary between users. There is no opt-out in the preview; using the agent counts as consent.

Triggers and the always-on agent

Triggers in the GitHub Copilot harness let an agent stay always on. When configured, an external signal such as an email, or a fixed cadence, starts the agent's cycle with no prompt. Microsoft's worked example is a budget agent that every Tuesday gathers planning records with its own credentials, compares forecasts with explanations, chases budget owners about unexplained changes and hands finance a summary and a list of decisions.

Microsoft named one early customer, Ooredoo Qatar, which runs an executive business-case review agent across Outlook, Teams and Word that reviews incoming proposals against company policy and precedent and prepares briefs for executives. The blog also previewed agent refinements that will suggest improvements to makers based on an agent's activity, and an upcoming option for agents to use their own browser-enabled cloud computer.

Why this matters for enterprise agents

Giving agents real accounts settles a question many companies have been working around: whose identity an agent acts under. Borrowing a maker's credentials makes audit trails murky and breaks when that person leaves. A separate account with scoped permissions is easier to govern, and it echoes Microsoft chief executive Satya Nadella's essay arguing that frontier models should be treated like insider risks, with a model's intelligence kept separate from authority over its actions.

It also fits a run of Microsoft releases this month aimed at long-running agents, from Execution Containers for isolating agent code to SharePoint knowledge bases that turn team content into Markdown agents can read. Accounts, memory and triggers are the pieces that let such an agent sit inside a team's existing email and chat rather than in a separate app.

The shared-memory design is the part security teams will want to examine first. An agent that remembers across a whole team is useful for processes, but it can also move information from a person who can see a document to one who cannot. Our explainer on what agents should remember and forget covers why that boundary is hard to get right.

Limits in the preview

The documentation lists several limits. Agents with accounts cannot read documents protected with sensitivity labels such as Confidential or Internal Only, and Microsoft warns makers not to strip labels to test them. They do not respond to anyone outside the tenant. They can generate new documents but cannot co-author or make targeted edits to existing ones, and @mentions in Office comments support only limited scenarios.

In email, the agent replies only in conversations with up to 250 people, and access checks can fail below that. Not all Microsoft Graph operations and permission scopes are supported. In the European Economic Area, where Teams is licensed separately, an agent still gets its account and mailbox but shows up in Teams only if the tenant also licenses Teams.

Microsoft says more access policies, quality and cost management and lifecycle controls for these agents are planned in the coming months. Until then, the safest early uses are the ones Microsoft's own example suggests: a small internal group, approved non-sensitive sources and people who keep the final decision.