Copilot Studio agents get their own Microsoft 365 accounts, and a memory that ignores file permissions

On 15 October 2026 Microsoft announced agent accounts for Copilot Studio, rolling out through its Frontier program. An agent with an account has its own Microsoft Entra identity, a mailbox and a place in the directory and in Teams. People can email it, @mention it in Teams and in Word, Excel and PowerPoint comments, and add it to distribution lists. Work is attributed to the agent, and administrators govern and audit it like any other identity. The same post announced triggers in the GitHub Copilot harness, so an agent can start work from an email or a schedule without a prompt, and said further access policies, cost management and lifecycle controls are planned over the coming months.

Running one needs several things in place. The maker needs Microsoft 365 E5 with the Microsoft Agent 365 add-on, or Microsoft 365 E7. The tenant must be enrolled in the Frontier program with the Agent 365 terms accepted, and each published agent takes a Microsoft 365 Frontier for AI Teammates licence; publishing fails if none is free. The environment must be on the early release cycle, and usage also draws Copilot Credits under usage-based billing. Agent accounts are available in the European Economic Area, where the agent appears in Teams only if the tenant licenses Teams separately.

The memory is the part that changes the risk. Copilot Studio's standard memory is kept per user, is private to that user and is switched off in group chats and Teams channels. An agent with an account uses shared memory instead, even in one-to-one chats: one store for everyone it works with, holding facts about the work and details about individual people. Microsoft's own notice on the agent warns users that files and chats they share can be summarised into the agent's answers to any user, including users without permission to the original and regardless of sensitivity label. Microsoft says the agent is guided not to raise one person's details with another, and that shared memory has no privacy boundary between users.

Microsoft's FAQ sets out the controls. Users cannot opt out in this preview; using the agent counts as consent. An administrator cannot turn shared memory off on its own, only by turning agent accounts off. Everyone who interacts with the agent can view or delete its saved memories, and the memories are deleted automatically after 28 days in which no one uses the agent. Microsoft lists what shared memory leaves out, including ID and card numbers, home addresses, credentials, health information, protected characteristics, and judgements about anyone's performance or conduct.

This opens a second route around the permission model. Most Microsoft 365 estates control who sees a document through SharePoint permissions and sensitivity labels. An agent with shared memory can carry a summary of that document from someone allowed to see it to someone who is not, and what decides the outcome is what each user chooses to share. For organisations that have spent effort on labelling, that likely makes agent accounts a security and data protection review item rather than a maker decision.

The off switch is all or nothing. Because shared memory cannot be turned off separately in the preview, the real control is who may create agents with accounts, which is set when an administrator activates the Copilot Studio template. A UK or EU organisation will also likely want its data protection lead to look at a memory that stores details about named staff and has no user opt-out before a pilot starts. This is not legal advice.

The identity side is a step forward for audit. An agent that acts under its own Entra account, with work attributed to it and a lifecycle an administrator manages, is easier to trace than an agent acting through a maker's connections. The cost is three lines rather than one: the E5 add-on or E7 licence for makers, a Frontier for AI Teammates licence per agent, and Copilot Credits for usage.