Microsoft embeds agent identity and governance into Microsoft 365

Microsoft unveiled what it describes as its most significant Copilot overhaul, positioning the technology as an operating system for work itself. The update marks a structural shift: AI agents are no longer just responding to prompts, but operating as persistent, self-governed participants in the enterprise.

The core shift: agents as infrastructure residents#

The centerpiece is Autopilot, a background agent that takes a role and goal once, then continues executing without requiring human intervention at each step. Rather than asking developers to build the operational plumbing around agents themselves, Microsoft is embedding that infrastructure into Microsoft 365 itself. The platform now handles persistent identity, state management, execution boundaries, and organizational context—capabilities that independent vendors have previously offered as separate layers.

This move addresses a recurring headache for production teams: assembling long-running agent architectures from scratch. By folding these concerns into the enterprise OS, Microsoft reduces the friction of deployment and hands developers back time previously spent on scaffolding.

Identity as first-class infrastructure#

Each Autopilot instance receives a dedicated Entra identity and user account, complete with its own email, calendar, OneDrive storage, and position in the organization chart. This means agents operate as themselves rather than impersonating employees or running through shared service accounts—a pattern security experts have flagged as a common deployment antipattern.

Developers create an Autopilot blueprint from a Foundry-hosted agent. Once an administrator approves it, employees can instantiate agents through Teams. The blueprint defines capability; administrators retain control over which resources and data each instance can reach, extending the same access policies applied to human employees.

Generated code gets a governed home#

Code, built on GitHub Copilot's foundation, generates applications and workflows from natural language. These apps run on Microsoft Copilot Managed Runtime, a new public preview platform that hosts generated software within the customer's Microsoft 365 tenant boundary under IT governance.

Unlike code deployed externally, applications here:

• Run inside the company's existing identity and access framework