At that scale, Python dependencies have emerged as a significant source of risk for us—representing the third-largest vulnerability surface across the company.

The good news is that we have strong visibility into these vulnerabilities, with tools that continuously detect and surface risks across our codebases. The bad news is that turning those insights into action required a complex remediation process.

Updating a single code package often caused changes across multiple interdependent libraries. This required coordinated updates, validation, and testing to maintain system stability.

“When AI arrived, I saw it as a great opportunity to finally fix a very complex problem we had: The level of entanglement involved in Python code dependencies. A simple script wasn’t going to resolve it—you needed the power of AI.”

Humberto Arias, senior product manager, Microsoft Digital

Multiply this by thousands of projects throughout our enterprise, and vulnerabilities accumulated much faster than we could resolve them. To address this challenge, we turned to AI.

Microsoft Digital—the company’s IT organization—has developed an AI-powered solution called Python Dependency Remediation. Designed to work directly within the developer workflow, this solution analyzes dependency chains, applies required updates, and automatically adjusts the code. This enables our engineers to remediate vulnerabilities quickly and consistently at enterprise scale.

“I’ve worked for years in the vulnerability management space at Microsoft,” says Humberto Arias, a senior product manager in Microsoft Digital. “When AI arrived, I saw it as a great opportunity to finally fix a very complex problem we had: The level of entanglement involved in Python code dependencies. A simple script wasn’t going to resolve it—you needed the power of AI.”

The tool has shown so much promise that we have begun releasing it externally, so that millions of Python developers around the world can take advantage of it.

“I used to have this problem all the time. I upgrade one library, and then I’ve got to upgrade 17 other things, and something else breaks, and now my code is completely different.”

Rich Chiodo, principal software engineer, Python and Tools for AI

Get started

Try using the Python Dependency Remediation tool

Flexibility leads to dependencies and risk

Python is a very flexible language, which is why it’s so popular among software developers. But that same flexible nature—it can be used across a wide range of scenarios—also means it forms deeply interconnected dependency chains. When one code library is updated, it can trigger changes across many others.

“I used to have this problem all the time,” says Rich Chiodo, a principal software engineer on the team responsible for Python Tools and AI. “I upgrade one library, and then I’ve got to upgrade 17 other things, and something else breaks, and now my code is completely different.”

“Developers avoid the upgrades because the dependency web is so complex. This means the vulnerabilities accumulate over time and can become a real security risk.”

Chintan Sheth, principal engineering manager, Viva Glint

Because the code is so interdependent and remediation is time-consuming, many developers skip updating their code packages, which can lead to security vulnerabilities.

Security compliance was often seen as a burden because it slows people down.

“Developers avoid the upgrades because the dependency web is so complex,” says Chintan Sheth, a principal engineering manager on the Viva Glint product team. “This means the vulnerabilities accumulate over time and can become a real security risk.”

“After my manager mentioned it, I reviewed the idea on the hackathon page, and it looked really interesting to me. So I jumped in, and we created a prototype and a demo video with a quick solution. That’s how it started.”

Shiva Krishna Gollapelly, senior software engineer, Microsoft Digital

Hacking our way to a solution

Like some of the best internally developed tools and processes, Python Dependency Remediation came out of a Microsoft hackathon project. These grassroots events allow our engineers to tackle interesting technical challenges in a collaborative, creative way.

“After my manager mentioned it, I reviewed the idea on the hackathon page, and it looked really interesting to me,” says Shiva Krishna Gollapelly, a senior software engineer in Microsoft Digital and the lead developer on the project. “So I jumped in, and we created a prototype and a demo video with a quick solution. That’s how it started.”

The fact that this solution came from a hackathon highlights the ideas-driven culture that we promote at the company.

“This really speaks to our special culture of innovation,” says Snigdha Bora, a principal group engineering manager for Employee Experience. “After this emerged from the hackathon, our developers realized it could solve a problem at scale—that it was worth taking through the full development cycle so we can release it for all of Microsoft, and maybe beyond.”

Solving the issue with one click (and AI)

Because the challenge was not detecting vulnerabilities but fixing them, we had to rethink how we addressed Python dependencies.

“The extension automatically finds the right updates and then fixes the vulnerabilities, so developers don’t need to do the research, the manual upgrades and fixes, run test cases, debugging—all those things that used to take so much time. With our solution, it’s just one button click and it does all of that automatically.”

Shiva Krishna Gollapelly, senior software engineer, Microsoft Digital

In the past, when engineers received a vulnerability notification, they would have to step outside their development workflow and address the issue. What was needed was a solution that could be enacted within their normal workflow—integrating remediation directly into the tools they were already using.

So, we created the Python Dependency Remediation extension for Visual Studio Code, a common Python development environment. Once installed, engineers can address vulnerabilities in the flow of their work.

“The extension automatically finds the right updates and then fixes the vulnerabilities, so developers don’t need to do the research, the manual upgrades and fixes, run test cases, debugging—all those things that used to take so much time,” Gollapelly says. “With our solution, it’s just one button click and it does all of that automatically, with the help of AI.”

The extension uses the APIs built into Visual Studio Code to connect with any AI model the user has access to. (If there is no AI model available, Gollapelly explains, the extension will still make the package updates but won’t do the remediation fixes to the code.) It also produces a report of the changes for the developer to review in case there’s a snag that needs troubleshooting.

“This tool removes a significant burden from our developers,” Bora says. “We are shifting the entire remediation process left, embedding it early in the development workflow. Developers can review the changes and move forward immediately, making the whole process more efficient.”

“We’ve upgraded the library with new methods, calls, and structures. Now, let’s make sure everything works, check for errors in the code, etc. That’s the gap we’re bridging with AI.”

Angel Saldivia, software engineer, SharePoint

The result is that fixes and upgrades that used to take multiple hours of developer time now take minutes, and the code is much more reliable.

What the agent does in this solution is help close that loop, something that the engineer used to have to do.

“We’ve upgraded the library with new methods, calls, and structures,” says Angel Saldivia, a software engineer on the SharePoint product team. “Now, let’s make sure everything works, check for errors in the code, etc. That’s the gap we’re bridging with AI.”

From Customer Zero to global impact

One of the powerful things about working at Microsoft is that you get to help develop technology tools that can change the world. This is the case with Python Dependency Remediation as well.

“We realized this technology had much broader value. There are hundreds of millions of Python users worldwide, so the impact could be massive.”

Snigdha Bora, principal group engineering manager, Employee Experience

As Bora explains, while the solution was being developed it was presented to Guido van Rossum, the creator of Python (and a Microsoft employee). He immediately saw the incredible potential of the concept.

“He suggested that we could take this solution to the world, not just to Microsoft,” Bora says. “We realized this technology had much broader value. There are millions of Python users, so the impact could be massive.”

To help make this happen, Microsoft Digital approached Graham Wheeler, a principal group engineering manager on the Python and Tools for AI team. Wheeler’s team is responsible for shipping Pylance, a development extension for Visual Studio Code used by more than 180 million developers worldwide.

“One of the things we could do was provide a jumping-off point for this extension, so that when users installed Pylance they’d be prompted to also download Python Dependency Remediation. It can help raise awareness, because many users don’t actually do the dependency scanning and updating that they should.”

Graham Wheeler, principal group engineering manager, Python and Tools for AI

Wheeler and his team are in the process of incorporating the Python Dependency Remediation extension as an option during Pylance installation. This will open up a convenient vector for getting the tool in front of a huge audience, potentially revolutionizing Python development.

“One of the things we could do was provide a jumping-off point for this extension, so that when users installed Pylance they’d be prompted to also download Python Dependency Remediation,” Wheeler says. “It can help raise awareness, because so many users don’t actually do the dependency scanning and updates that they should. So, we’re helping with that challenge.”

Beyond Python, the AI-powered technology behind this extension might be applied to other dependency challenges as well. What started as a simple hackathon project could have huge ramifications for the future of software development.

“This solution can easily be adapted to other libraries, other programming languages,” Gollapelly says. “Whether you’re talking about C#, Angular, React, or another language, the concept is the same. The implications are vast.”

The post Taming our Python dependencies at Microsoft with AI appeared first on Inside Track Blog.

This article presents our approach to cybersecurity risk management, detailing the internal governance structures, lifecycle methodologies, regulatory compliance processes, and organizational practices that collectively promote transparency and accountability. This approach is built on two foundational components: a structured risk management lifecycle and a governance model that integrates cybersecurity risk into enterprise-level decision making.

Governance as the foundation

Microsoft’s cybersecurity risk management program is fundamentally structured around robust governance mechanisms. Central to this framework is the Cybersecurity Governance Council, a cross-functional body composed of the Chief Information Security Officer (CISO), Deputy CISOs (DCISOs), and representatives from legal and regulatory affairs. This council convenes twice weekly to evaluate emerging risks, validate mitigation plans, and ensure alignment with enterprise priorities.

The governance model is designed to facilitate bidirectional communication of risk intelligence. Information flows upward from engineering and operational domains to executive leadership, and downward from strategic oversight to operational execution. This exchange is essential for maintaining situational awareness and ensuring that risk mitigation efforts are both evidence-based and scalable.

At the operational level, DCISOs are accountable for reviewing, prioritizing, mitigating, and accepting risks within their domains. This domain-aligned ownership model ensures that accountability for cybersecurity risk is clearly defined and directly connected to enterprise decision making.

Once risks are identified, they are reviewed on a recurring basis and aggregated to inform enterprise-level prioritization. Risk acceptance decisions are tiered based on residual risk levels and aligned with Microsoft’s defined risk appetite. They are then governed and monitored to ensure consistency and appropriate oversight.

Foundational elements

Listening systems

• Internal and external audits
• Current and pending regulation
• Incidents and media
• Industry groups

Methodology

• Risk management framework
• Risk rating criteria
• Risk universe

Tools

• Power BI
• Risk portfolio and accountability matrix
• Risk assessments
• NIST cybersecurity assessments

Risk domains

• Cybersecurity
• Quality and availability
• Business resilience
• Corruption
• Digital safety and service misuse

• Product safety
• Sustainability
• Global trade
• Antitrust and regulation
• Talent management

• Data privacy
• Supply chain
• Financial
• Facility security and people safety

Operational risk

• Search, advertising, and news
• Artificial intelligence
• Cloud and AI
• Commercial business
• Consumer business

• Security
• Experience + Devices
• Customer and partner solutions
• Gaming
• LinkedIn

• Corporate, External, & Legal Affairs (CELA)
• Finance
• Human resources
• Business development and corporate strategy
• Marketing

Enterprise risk

• Identify, assess, and prioritize risk to strategy

• Senior leadership accountability and mitigation quality

• Enable board risk governance

Microsoft’s security standards are published on an annual basis, establishing explicit requirements for risk entry, scoring, and mitigation. Adherence to these standards is mandatory for all teams, ensuring uniformity and accountability across the organization. The standards are subject to periodic revision in response to evolving threats, regulatory developments, and historical incident analysis.

The CISO GRC team synthesizes risk intelligence into a semi-annual enterprise risk management (ERM) report. The report is disseminated to senior leadership and the audit committee, elevating cybersecurity risk management from operational domains to the highest levels of organizational oversight.

Microsoft also defines and tracks key risk management metrics to measure and evaluate the effectiveness of its cybersecurity risk management program, providing visibility into risk posture over time and enabling informed decision making as part of governance and reporting processes.

A lifecycle approach to risk management

Microsoft’s risk management lifecycle is organized into four principal stages: identification, assessment, mitigation and remediation, and prevention and monitoring. Each stage is designed to ensure that risks are logged, actively managed, tracked, and validated.

Risk identification draws on a range of inputs, including threat intelligence, penetration testing, post-incident reviews, security research reports, red team exercises, and internal assessments. Risks are also surfaced through self-identification by teams, findings from defense operations, and structured self-assessments, such as the annual NIST Cybersecurity Framework (CSF) maturity review. The process is designed to be inclusive, allowing any employee or vendor with appropriate access to submit risks into a centralized system. This multifaceted approach aims to provide a comprehensive view of the threat landscape.

Upon identification, risks are entered into a centralized risk register, which provides early visibility and facilitates prompt action. The system is designed to be inclusive, permitting any employee or vendor with corporate access to submit risks. This democratized process reflects Microsoft’s commitment to broad-based risk identification across the organization.

Risk assessment is conducted by specialized teams employing structured methodologies, including impact and likelihood scoring, root cause analysis, and contextual evaluation informed by both internal signals and external intelligence. Assessment methodologies align with enterprise risk management practices and incorporate factors such as impact, likelihood, and management action and control opportunities to determine overall risk prioritization. Curators, who are Microsoft domain experts with risk management training, triage and assign risks to the appropriate DCISO area, thereby ensuring consistency and objectivity across all domains.

Risk mitigation and remediation strategies are tailored to the specific characteristics of each risk. Mitigation efforts may be prioritized and driven at an enterprise level through initiatives such as the Secure Future Initiative (SFI), or managed within specific organizational domains depending on scope and impact. These may involve deploying new controls, process adjustments, or implementation of technological solutions. Each risk is assigned an owner who is accountable for executing the mitigation plan and validating its effectiveness. Progress is monitored through workflow systems, and validation steps are employed to confirm the sustained efficacy of mitigations. Following mitigation, outcomes may inform updates to Microsoft security standards to strengthen systemic controls and prevent recurrence.

Prevention and monitoring constitute ongoing activities. Insights derived from mitigation efforts are also used to inform improvements delivered to customers, including secure-by-default configurations, product controls, and published guidance. Microsoft utilizes regression prevention techniques, continuous monitoring tools, and assurance systems to ensure the durability of mitigations over time. Insights derived from these activities are reintegrated into the identification process, thereby establishing a continuous improvement loop that is essential for maintaining resilience in a dynamic threat environment.

The risk register: Centralized oversight

The cybersecurity risk register functions as the central repository for Microsoft’s risk management program.

The workflow for risk management within the register encompasses seven defined stages: submission, triage, response, confirmation, information sharing, mitigation, and archiving. Each stage is governed by explicit service-level agreements to ensure accountability.

Risks are required to be triaged and scored within a specific timeframe following submission, and mitigation plans must be developed within a defined period after prioritization. Risk owners are required to provide regular, ongoing updates on the process of mitigation activities.

To support this workflow, roles within the risk register are clearly delineated:

• Risk Submitter: Responsible for providing comprehensive descriptions and supporting documentation for identified risks
• Risk Curator: Charged with validating, prioritizing, and assigning risks to appropriate domains
• Risk Owner: Accountable for implementing and monitoring mitigation plans
• Risk Viewer: Individuals such as auditors and senior leaders who access risk data for oversight and compliance purposes

In addition to these roles, DCISOs provide domain-level oversight and accountability for risks, including prioritization, acceptance, and escalation to enterprise governance structures.

Risk Submitter

The Risk Submitter is an individual, FTE or vendor who enters a new or existing risk into the Risk Register. Anyone with corp access can submit a risk, including Microsoft security experts. Responsible for submitting a clear, detailed, and understandable title, description, and supporting information for a risk.

Risk Curator

Delegated to take action by their DCISO, these are engineers, architects or analysts with respective domain knowledge and context who are responsible for triaging and prioritizing submitted security risks, ensuring the right DCISO area ownership alignment, identifying ownership, and tracking remediation.

Risk owner

The Risk Owner is an FTE, typically in a DCISO’s scope, that is responsible for updating mitigation status of a prioritized risk. This accountability continues until all mitigations are complete and the risk is deprioritized or archived.

Risk Viewer

The Risk Viewer is an FTE who requires read-only access to risk data to fulfill a business or compliance obligation. Where possible, their access is limited to PBI reports instead of direct access to the Risk Register itself.

Risks are reviewed on a quarterly basis, and prioritized lists are communicated to leadership to inform strategic decision making. The centralized risk register enables prioritized risks to be surfaced and reported to the CISO function and Enterprise Risk Management (ERM), supporting enterprise-level visibility and oversight. These prioritized risks inform the Secure Future Initiative (SFI), which drives systemic change across Microsoft.

Regulatory compliance integration

Microsoft’s cybersecurity risk management program is aligned with global regulatory frameworks, including ISO 27001, NIST SP 800-53, and the NIST Cybersecurity Framework, and is continuously updated to incorporate emerging requirements such as DORA and NIS2. These regulatory baselines inform both control implementation and risk evaluation, ensuring alignment between compliance requirements and operational risk management activities.

DCISOs are responsible for regulatory implementation and compliance within their respective domains. This encompasses oversight of regulated sectors such as healthcare, legal, and government, as well as emerging domains including artificial intelligence safety and privacy. The Cybersecurity Governance Council conducts regular reviews of regulatory risks and ensures that mitigation strategies are aligned with statutory and legal obligations.

ERM reporting integrates cybersecurity risks alongside financial and operational risks, thereby ensuring that regulatory compliance is embedded across the organization’s overall broader risk posture. This integrated approach enables Microsoft to respond expeditiously to regulatory changes and maintain trust with customers, partners, and regulatory authorities.

What makes Microsoft’s approach unique

The scale and complexity of Microsoft necessitate a risk management methodology that is both rigorous and adaptable. Several practices distinguish Microsoft’s program from industry counterparts.

The Secure Future Initiative (SFI) establishes a structured mechanism for driving systemic change, prioritizing critical risks and aligning mitigation efforts across engineering, operations, and executive leadership. While not all risks are represented within SFI, the initiative functions as a strategic accelerator, publicly articulating the prioritized risks and corresponding mitigation efforts that drive enterprise-wide improvements.

The culture of risk awareness is embedded throughout the organization. Risk identification is actively encouraged, and submissions are evaluated irrespective of origin, reflecting a commitment to democratized and proactive risk reporting. Internally, Microsoft advocates for a culture that celebrates the identification of risks and enables proactive reporting.

The governance cadence is highly disciplined; the Cybersecurity Governance Council convenes twice weekly, and DCISOs conduct reviews and confirm top risks every 90 days. These structured intervals ensure that risk management remains proactive, with clear accountability and continuous oversight.

The integration of operational and enterprise risk is seamless. The CISO GRC team synthesizes risk intelligence from across the organization and presents it in a unified ERM report, ensuring that cybersecurity risks are incorporated into strategic decision making, rather than isolated within technical silos.

Finally, Microsoft’s control ecosystem reinforces the durability of risk mitigation. Initiatives like the Secure Development Lifecycle (SDL), exception governance processes, and SFI collectively ensure that mitigations are implemented and sustained over time.

A blueprint for security leadership

Microsoft’s cybersecurity risk management program is a model of maturity, scalability, and transparency. The program integrates structured governance, rigorous processes controls, and a culture of accountability to ensure that risks are systematically identified, mitigated, and subject to continuous monitoring and improvement. For cybersecurity leaders seeking to understand risk management at scale, Microsoft offers a compelling blueprint: a proactive, integrated, and transparent framework that combines structured governance, rigorous process controls, and a culture of accountability.

Ultimately, cybersecurity risk management is not solely dependent on technical controls and frameworks; it is fundamentally about empowering individuals, building trust across teams, and connecting operational rigor with strategic clarity. If you are developing or refining your program, prioritize both structural and cultural elements, and build resilient processes around engaged teams. Security leadership presents significant challenges, but with the appropriate structure, culture, and rhythm, it can drive transformative outcomes.

The post How we approach cybersecurity risk management at Microsoft appeared first on Inside Track Blog.

To make this ideal a reality, our team in Microsoft Digital—the company’s IT organization—created an agentic AI assistant that we’re now using to connect new devices to our network. We built the agent into GetConnected, the internal portal that 18,000 of our employees, vendors, and network administrators use each month to register their new devices to our network when they turn them on for the first time.

Our new workflow is simple, fast, and intuitive—and it’s a significant step up from our previous experience.

Creating the GetConnected AI assistant is part of the role we play as the company’s Customer Zero, where we test and use our technology and platforms first and then share our lessons learned with customers. In this case, we’re sharing how we used the Microsoft Agent Framework (MAF) to enhance onsite device management for our employees. GetConnected does not apply to remote device registrations.

“We’ve been looking across our set of services and capabilities to find places where we can do some experimentation leveraging AI. We wanted to be able to test our hypothesis around those AI investments and then be able to double down if it proved correct.”

Jason Thompson, principal PM manager, Microsoft Digital

Improving a highly trafficked internal tool using AI

Our employees use GetConnected to ensure their wired and wireless devices are registered on the network, as well as to extend device expiration dates and check on the status of their devices.

Heavy employee traffic and the repetitive actions users tend to take on GetConnected led us to realize that the tool was the perfect candidate for an agentic transformation. Our goal was to turn what was a five- or six-step process into something that could be completed in just one or two actions.

“We’ve been looking across our set of services and capabilities to find places where we can do some experimentation leveraging AI,” says Jason Thompson, a principal PM manager in Microsoft Digital. “We wanted to be able to test our hypothesis around those AI investments and then be able to double down if it proved correct.”

The team decided to start small, focusing on a couple of the most popular and crucial functionalities within GetConnected.

“We’d seen previous projects that were very ambitious fail because they tried to achieve too much at one time. Based on customer feedback, we noticed that registration is the simplest, most common action that users were having trouble with. So we said, ‘Let’s do that first.’”

Aayush Dave, product manager, Microsoft Digital

It was also important to listen to our employees—our Customer Zero frontline users. They told us which actions in the experience mattered most to them.

“We’d seen previous projects that were very ambitious fail because they tried to achieve too much at one time,” says Aayush Dave, a product manager in Microsoft Digital. “Based on customer feedback, we noticed that registration is the simplest, most common action that users were having trouble with. So we said, ‘Let’s do that first.’”

Next up was deciding how the agent would appear in the portal. The Microsoft 365 Copilot model of a sidebar chat menu worked well for other workflows, so it seemed appropriate to approach the new GetConnected experience in a similar way. This enabled us to create a new experience alongside the existing workflow, so customers could still access the original process (should they need to) and compare the two experiences.

“Other teams might decide to automatically replace the UI with an agent,” says Faris Mango, a principal software engineering manager in Microsoft Digital. “But that’s hard, because now you’re forcing people to use the agent. If it’s not ready to be used at full capacity, they don’t have an alternative to accomplish what they intended. We wanted to avoid that situation.”

Testing out Microsoft Agent Framework (MAF)

To build the agent, we considered two paths.

The first was to directly call the Model Context Protocol using JavaScript, an option that would require significant amounts of coding on our part.

“Some declarative agent systems do all of the things in the background, and you don’t get to turn all the little knobs. MAF gives you the flexibility to make the experience exactly what you want.”

Darron Sullivan, principal software engineer, Microsoft Digital

The second was to use Microsoft Agent Framework (MAF), which proved to be simpler and more customizable for our needs.

“Some declarative agent systems do all of the things in the background, and you don’t get to turn all the little knobs,” says Darron Sullivan, a principal software engineer in Microsoft Digital. “MAF gives you the flexibility to make the experience exactly what you want.”

The tricky part, however, was that MAF was fairly new at the time. In fact, the week that the team started developing the GetConnected agent was the same week that MAF was released in preview internally. As we were building out our agent, the framework was going through its own updates, which threatened to hinder our progress. Even one small change to the framework could break our tool’s entire functionality.

“They were moving really fast, and we were adopting new features and finding new bugs all the time,” Sullivan says. “You had to go through that rapid iteration and development, which is a challenge, but it was also pretty awesome because we’re working on the cutting edge.”

The upside was that we were able to provide valuable feedback to the MAF engineers, which in turn could supercharge the work we were doing on our agent. As a bonus, our partnership drove other teams to pursue similar projects.

“The knowledge sharing across our org was notable and crucial,” Dave says. “Our team was one of the first to start building a solution like this, and we presented in numerous architecture forums to share the components and frameworks we were using, and the teams we were working with. This brought the tide up for all boats in our organization, encouraging other teams to start kicking off similar projects as well.”

Building a seamless, discoverable interface

The agent currently has several key functions, the most prominent of which is to register a device on your behalf.

Previously, employees would have to fill in a long, complicated form that asked for a lot of technical details that they often didn’t know offhand, like type of device or the preferred network.

Instead of just selecting options and approving, the flow is more conversational. The user can start with a suggested prompt like “Help me register a device,” and the agent will ask for the required information (with examples for each field). If the user isn’t sure about something (for example, how to find a MAC address), they can ask follow-up questions, and the agent will pull in FAQ and help content to guide them.

Once all the required details are collected, the agent can complete the registration on the user’s behalf after the user approves it.

Once it has your approval, the chatbot submits the request and replies whether or not it was successful. Users can also ask the agent to show devices that are expired or will soon expire, then prompt the agent to renew those devices if desired.

Seamlessly integrating the agent into GetConnected required upgrading the existing user interface using Fluent.

These updates were needed to support the AI interface integration. Specifically, we introduced a custom header action to launch the AI side panel. Prior to upgrading, doing this would have required using Coherence components outside of their intended patterns.

“We used Fluent AI components to build the AI interface. This helped ensure a consistent Microsoft look and feel across the experience, built-in accessibility for scenarios like screen readers and mobile usage, and components that are designed for conversational and agent-driven interactions.”

Nathan Chambers, software engineer, Microsoft Digital

To stay consistent with the existing app architecture, we upgraded core dependencies like Fluent UI and Coherence to their latest versions. As part of upgrading Coherence across several major versions, it also required us to move the feedback experience to Centro to align with the updated patterns. We then needed to update other parts of the experience like navigation, FAQ, and release notes to match those newer component patterns.

“We used Fluent AI components to build the AI interface,” says Nathan Chambers, a software engineer in Microsoft Digital. “This helped ensure a consistent Microsoft look and feel across the experience, built-in accessibility for scenarios like screen readers and mobile usage, and components that are designed for conversational and agent-driven interactions.”

While making these upgrades, we ran tests to ensure the experience was accessible—for example, for screen reader users or others who might access GetConnected on their phones.

“You can have an amazing, strong piece of software that is well built and focuses on security. But if you don’t have the traffic or people are not using it, it’s worthless.”

Faris Mango, principal software engineering manager, Microsoft Digital

Next, we wanted the agent to be as discoverable as possible. Without people actually navigating to it, there would be no way to show proof of concept. So, we built it so the agent automatically popped open via a side panel when someone loaded GetConnected.

“You can have an amazing, strong piece of software that is well built and focuses on security,” Mango says. “But if you don’t have the traffic or people are not using it, it’s worthless.”

We also wanted to gather early feedback from users. Before releasing it to the entire company, we had internal team members and frequent GetConnected users give the agent a try. Almost immediately, it was clear we had too many approval notices.

“At the beginning, we would have approvals for every single action. For example, if you wanted to see a device in different regions like Puget Sound, Latin America, or Canada, you had to do a separate approval for each region,” Dave says. “This was a very painful experience. So we removed all the approvals and pared it down to a one-click experience.”

Users also had issues with the approval language, which they said was hard to understand and looked like an error message. The next iteration took out much of the technical jargon, making the message more conversational and easier to read.

An agent experience driven by feedback

Our work as Customer Zero is never done. For GetConnected, we’re eager to keep collecting feedback. One major goal is to improve the agent’s performance, making it faster and more responsive.

Our feedback survey is tied directly to a performance dashboard, which tracks metrics like new and returning users, total unique users, conversions, and interactions. Each user submission generates a work item.

“When users leave feedback about something they don’t like, I feed that to the team, and then we sit down and figure out how we can improve that specific part of the experience,” Dave says.

With each update, we’re seeing the payoff of more users and more interactions. The traditional method of registering a device is also seeing a drop-off as more people lean on the agent for assistance.

“Before, you used to have to go into the system and change something about the experience manually. Now, our engineers are going to an AI model and telling it, ‘Hey, you’re doing this part wrong, please improve it.’”

Aayush Dave, product manager, Microsoft Digital

Looking ahead to more use cases

Building an agent has allowed the team to embrace an entirely new type of engineering.

“Before, you used to have to go into the system and change something about the experience manually,” Dave says. “Now, our engineers are going to an AI model and telling it, ‘Hey, you’re doing this part wrong, please improve it.’”

It’s also serving as a reminder to seek progress over perfection.

“AI is changing things so quickly,” Thompson says. “It’s better to do rapid prototyping and roll it out, and start getting the data in terms of how successful the experience is. Then you can let that guide you, in terms of how you iterate going forward.”

Because of the success we’ve had with the GetConnected device registration feature, we’re already exploring other capabilities, including bulk operations to accommodate our facilities managers who need to onboard many devices at once. As AI agents become mainstreamed in many workflows across our organization, we anticipate usage and functionality will continue to grow exponentially.

The post Simplifying device registration at Microsoft with an agentic AI assistant appeared first on Inside Track Blog.

At Microsoft Digital, the company’s IT organization, we’re using a set of employee councils and connected capability groups to guide and accelerate how we deploy and adopt AI across our enterprise. Our goal is to focus our energy on the AI-enabled scenarios that matter most, reducing duplication, strengthening accountability, and making sure our investments create measurable value.

“Our AI decisions and direction must be grounded in business strategy. AI councils provide guidance and enablement for our organization, ensuring that our investments in AI generate tangible benefits to our business. It’s not just developing technology and then looking for a problem to solve with it—we start with the opportunity.”

Don Campbell, principal group technical program manager, Microsoft Digital

That focus matters, because AI success doesn’t come from usage alone. It comes from connecting strategy, enablement, data readiness, responsible AI, continuous improvement, change management, and measurement into one driving force.

That’s how we’re moving from experimentation to repeatable outcomes and from AI enthusiasm to AI accountability.

“Our AI decisions and direction must be grounded in business strategy,” says Don Campbell, principal group technical program manager in Microsoft Digital. “AI councils provide guidance and enablement for our organization, ensuring our investments in AI generate tangible benefits to our business. It’s not just developing technology and then looking for a problem to solve with it—we start with the opportunity.”

Our council-based approach is helping us accelerate our Frontier Firm transformation. The councils work together to set direction for AI adoption at Microsoft Digital, ensuring that our business needs drive solution development that can keep up with the pace of AI change. This work includes building visibility into all our AI solutions, including agents and Model Context Protocol (MCP) servers, while establishing governance and proven practices; developing training and learning pathways; and connecting teams together that are working on similar solutions across the enterprise.

We’re excited for a future where our employees use intelligent agents and human judgment together to work smarter, move faster, and unlock new value for Microsoft and our customers.

Why we use councils to guide internal AI efforts

Effective AI needs both enterprise guidance and business-owned direction. That’s why we’re using councils and connected capability groups as the operating model for our AI deployment.

Each group has a distinct role, and none of them work alone. Together, they help us connect the strategy for AI to the work currently happening across Microsoft Digital.

• Our strategy council sets priorities by aligning AI work to business goals, identifying top scenarios, prioritizing investments, and keeping KPIs and value in focus.
• Our enablement council uses our AI Center of Excellence to turn strategy into action through technical guidance, proven practices, ideation, learning, knowledge sharing, culture, and governance.
• Our data council strengthens the AI foundation via data strategy, governance, access, quality, literacy, and prioritization.
• Our process council drives continuous improvement through operational excellence, problem solving, prioritization, value realization, coaching, and learning.
• Our compliance council applies Responsible AI principles to ensure compliance, inclusiveness, fairness, transparency, and reliability.
• Measurement ties it all together by tracking both business outcomes and engineering artifacts, ensuring we can clearly demonstrate real-time value realization.  

These councils help us see across the business landscape through the lens of AI. They enable us to reduce duplication, scale what works, and make better decisions about where AI can create value. That allows our teams to keep moving fast without letting activity get ahead of accountability.

Aligning AI strategy to business value

Our strategy council helps us decide which AI-enabled scenarios deserve the most attention, which investments align to our business priorities, and how we’ll know whether the work is creating value. It gives leaders a practical way to look across the portfolio and keep our AI work tied to the outcomes we’re accountable for.

“Business strategy defines the what and the why. AI defines the how, enabling execution of the strategy and delivering real value. We should use AI to advance our business strategy, not the other way around.”

Qingsu Wu, principal group product manager, Microsoft Digital

This is important, because broad experimentation is useful early on in your AI journey. It helps teams learn and build momentum. But experimentation has to mature into focus. Without that shift, organizations can end up with too many different agents, agent skills, MCP servers, and other artifacts, without a clear view of what’s actually impacting the business.

We’re using the strategy council to keep that from happening.

“Business strategy needs to lead the AI strategy,” says Qingsu Wu, a principal group product manager in Microsoft Digital and an influential member of the strategy council. “Business strategy defines the what and the why. AI defines the how, enabling execution of the strategy and delivering real value. We need to use AI to advance our business strategy, not the other way around.”

That principle shapes how we work. We use the strategy council to identify our top AI-enabled scenarios, clarify the value we expect to create with each one, and connect that work to a monthly operating rhythm. Product owners still manage delivery and the council keeps the portfolio focused, visible, and aligned.

Tuning strategy into repeatable execution

Our AI Center of Excellence (CoE) is at the heart of our approach to enablement. It helps us translate enterprise AI priorities into practical guidance and execution support for teams building AI-enabled solutions.

“We can see patterns that a single team can’t. We’re translating AI CoE strategy and enterprise priorities into clear execution plans that work in each organization’s context. That allows us to align priorities and make sure our biggest bets are actually landing.”

Ria Khetan, senior program manager, Microsoft Digital

The AI CoE extends the reach of the strategy council. It gives teams what they need to build, govern, reuse, and scale what matters, while the strategy council assists us in deciding where to focus.

That connective role is central to the broader council model. The strategy council identifies the top AI-enabled scenarios. The AI Center of Excellence connects strategy to execution across the organization, operating as a cross-functional coordination layer that sets direction and creates shared accountability.

“We can see patterns that a single team can’t,” says Ria Khetan, a senior program manager in Microsoft Digital, who is a member of the council. “We’re translating AI CoE strategy and enterprise priorities into clear execution plans that work in each organization’s context. That allows us to align priorities and make sure our biggest bets are actually landing.”

The COE helps teams move those scenarios forward with answers to important questions:

• What initiatives are in flight?
• What initiatives bring the most return on investment?
• Where is there potential duplication?
• Where do we need clearer guidance?
• Where do we need stronger governance?

It also helps reduce fragmentation. When teams build in isolation, they can solve the same problem in different ways. They can choose different patterns, interpret standards differently, or create solutions that don’t scale beyond a single context. Enablement gives us a shared way to look across that activity and ask better questions.

“We use the CoE to bring consistency to how AI work gets done,” Campbell says. “It gives us a way to step back and ask whether we’re solving the right problems and whether we’re set up to scale.”

“High-quality, well-governed data is essential to accelerate AI implementation and adoption, and to ultimately unlock its full value. Data quality, accessibility, and governance are imperatives for AI systems to be reliable, scalable, and business-critical. Recognizing this principle is propelling our data strategy.”

Miguel Uribe, principal PM manager, Microsoft Digital

Building AI on trusted data

Our AI scale depends on trusted and reliable data. That makes our data council central to our council-based approach. This council makes sure our teams work with data that’s governed, discoverable, accessible, and ready for AI.

“High-quality, well-governed data is essential to accelerate AI implementation and adoption, and to ultimately unlock its full value,” says Miguel Uribe, a principal PM manager in Microsoft Digital and member of the data council. “Data quality, accessibility, and governance are imperatives for AI systems to be reliable, scalable, and business-critical. Recognizing this principle is propelling our data strategy.”

We’re applying a data mesh mindset to balance domain ownership with enterprise consistency. Teams stay close to the data that they know best. Shared standards for governance, quality, metadata, and compliance provide a framework to make that data useful across Microsoft Digital.

Microsoft Fabric and Microsoft Purview are key to that approach. Microsoft Fabric unifies our siloed data in a shared data mesh. Microsoft Purview enables governance and best practices to ensure that we manage our data responsibly through discovery, classification, protection, and monitoring.

Our goal is AI-ready data that’s available, complete, accurate, and high quality. Our data council also works with the AI Center of Excellence to strengthen data and AI fluency through learning pathways, operational practices, and community programs.

“Our capacity to drive process improvements has been crucial to our AI transformation as a company. We’ve adopted a ‘CI before AI’ approach to ensure that we don’t end up automating inefficient processes.”

David Laves, director of business programs, Microsoft Digital

Improving the process before applying AI

AI works best when it’s applied to the right problem. That’s why continuous improvement is part of our council-based approach. Before teams automate a workflow or build an agent, we want them to understand the process, identify waste, and decide where AI can create measurable value.

“Our capacity to drive process improvements has been crucial to our AI transformation as a company,” says David Laves, director of business programs in Microsoft Digital and a member of the Continuous Improvement Center of Excellence. “We’ve adopted a ‘CI before AI’ approach to ensure that we don’t end up automating inefficient processes.”

Continuous improvement helps teams make sure the underlying work is worth scaling. That’s when a continuous improvement approach can help. It encourages practices like Gemba walks, Kaizen events, bowler cards, and monthly business reviews that allow our teams to understand where work gets stuck and where AI can help.

Continuous improvement keeps the council model grounded in real work. We’re applying it where the process is understood, the value is clear, and the outcome can be measured.

Scaling AI responsibly

Our compliance council encourages the application of Responsible AI, so our teams can move faster with confidence. As our AI work scales across Microsoft Digital, responsible AI has to connect directly to the same council ecosystem that guides strategy, enablement, data, process, and measurement. That connection helps teams understand what they’re accountable for before they build too far, too fast.

Our responsible AI work focuses on compliance, inclusiveness, fairness, transparency, reliability, privacy, security, and accountability. It’s grounded in the Microsoft Responsible AI Standard and supported by responsible AI champions who help teams apply those expectations in real development workflows.

This approach gives teams structure. It allows them to assess impact, identify risks, document decisions, and bring in the right reviewers. It also creates consistency, as more AI agents and solutions move from experimentation into enterprise use.

The goal is to enable AI project teams to move in the right direction with the right safeguards. Responsible AI gives the strategy council, the AI Center of Excellence, the data council, and product teams a shared standard for trust—to turn ambition into accountable execution. It also makes sure the AI systems we scale are worthy of the trust that employees, customers, and the company place in them.

Measuring our AI outcomes

Our councils choose the right AI work, support teams as they build, strengthen the data foundation, apply responsible AI, and improve processes before we scale. But we still need to answer the most important question: What changed because of the AI investment?

That’s why we have built a common value measurement framework across Microsoft Digital. Our teams use the framework to define expected value before they build. With it, they can establish a baseline, track results, and review what they learn with the right business and AI owners.

We organize AI value across six areas: Revenue impact, productivity and efficiency, security and risk management, employee and customer experience, quality improvement, and cost savings. Not every initiative needs to deliver value in every category. The point is to create a shared language that leaders and teams can use to compare investments, make tradeoffs, and understand progress.

Measurement also pushes us past simple savings claims.

If AI saves time, reduces cost, improves quality, or increases coverage, we want to know what happens next. Did teams reinvest that capacity? Did service improve? Did risk go down? Did quality increase?

AI accountability depends on that full loop. We define value, measure results, review progress, and adjust. Then we use what we learn to guide the next round of decisions.

Operating as one connected AI system

Our AI councils make a difference because each group has a different focus.

“What got us here won’t get us to where we need to go next. We started with broad experimentation—getting teams excited and building—but now we’re evolving as an organization to think about scale, alignment to business goals, and making sure our investments are driving the right outcomes.”

Myron Wan, principal group product manager, Microsoft Digital

Strategy assists us in choosing the right priorities. Enablement helps our teams to build with shared patterns. Data readiness gives AI systems a trusted foundation. Responsible AI allows us to move faster with confidence. Continuous improvement makes sure we’re improving the work before we automate it. Measurement tells us whether the investment changed anything meaningful.

Together, this system means we can operate AI as a business-driven enablement system.

“What got us here won’t get us to where we need to go next,” says Myron Wan, a principal group product manager in Microsoft Digital. “We started with broad experimentation—getting teams excited and building—but now we’re evolving as an organization to think about scale, alignment to business goals, and making sure our investments are driving the right outcomes.”

There’s more work ahead. We need to keep scaling enablement, improving data readiness, increasing high-value use cases, showcasing measurable impact, and tightening alignment across teams.

We also need to keep asking the hard questions: Where should we invest? Where are we reducing risk? Are we reinvesting the value that AI creates?

Our council-based model allows us to answer those questions with discipline. It helps us connect AI ambition to business outcomes and move from experimentation to repeatable enterprise value. And it provides a practical model that other IT organizations can adapt as they guide their own AI deployment.

The post Guiding our AI deployment with a set of employee councils appeared first on Inside Track Blog.

Today, the company has grown into a global organization with more than 200,000 employees. They all rely on Microsoft Digital—the company’s IT organization—to provide the tools, technologies, and solutions that empower them to accomplish more every day.

The need for digital transformation

The history of information technology is one of constant evolution, and the pace of change has never felt greater than it does right now. The AI capabilities and other groundbreaking innovations unveiled in the last few years show the potential to radically transform our world and change the way we think about and operate all IT services.

When the world pivoted to remote online work and collaboration because of the COVID-19 pandemic, it was just one example of how digital transformation doesn’t always happen in a straight line or on a predictable schedule. Our company’s history of shaping and adapting its IT organization to the latest challenges faced by employees and partners is no different; marked by big bets and strategic shifts that reflect our ever-changing world.

Mapping our IT journey

Today, Microsoft Digital is the team that powers, protects, and transforms the digital employee experience across all devices, applications, and hybrid infrastructure at the company. Using our deep knowledge and experience in enterprise IT, we’re pivoting to help lead the company’s AI transformation while also sharing our journey with customers so they can take advantage of this generational opportunity to reshape their businesses and IT operations.

To understand where we’re going, it helps to take a look at where we’ve been. This article explores the details of the major eras of our IT history and then shifts to examine the trendlines and technological innovations that are shaping Microsoft now.

On-Premises IT (founding to 2009)

It’s useful to break the history of our IT operations into different eras. For the first three decades or so from its founding in 1975, Microsoft operated with on-premises IT systems. This era was characterized by the setup, operation, and maintenance of onsite physical technology—servers, datacenters, and other hardware infrastructure.

During this time, IT roles were narrowly defined. IT team members functioned primarily as “order-takers,” with limited influence over strategic decisions.

Because funding was inconsistent, our IT organization had limited growth opportunities and relied on vendors for development work. Gaps were filled in with “shadow IT,” where internal teams would sometimes procure their own hardware or software without formal IT approval or standards.

We established security as an early priority for the company. Cofounder Bill Gates launched the Trustworthy Computing initiative more than two decades ago, an effort emphasizing the importance of security, privacy, and reliability across Microsoft products and services both internally and externally.

Our On-Premises IT era established the foundation that would become crucial to the company’s future digital transformation.

All in on the cloud: The Cloud and Culture era (2010-2018)

Cloud computing marked the next significant shift in the history of IT at Microsoft. It began in 2010 under the leadership of CEO Steve Ballmer, signaling a major break with the previous era of physical IT infrastructure and an important step toward today’s distributed-computing world.

The launch of the cloud computing platform then known as Windows Azure heralded this new era, as we transitioned away from an IT philosophy focused on the Windows desktop client toward a more platform-agnostic view. Cloud computing offered extensive advantages for customers and for our own IT environment, in terms of cost, performance, security, and scalability.

We started our journey by moving productivity workloads (Exchange and SharePoint) to the cloud. Then, we shifted new development to Azure and optimized modern applications to run in the cloud. We also moved existing applications targeted for migration to virtual machines. Today, more than 98% of our IT workloads run on Azure.

Cultural transformation

Another important shift during this era was the profound cultural transformation at Microsoft sparked by new CEO Satya Nadella, who rose to the top job at the company in 2014. Nadella had previously run the Microsoft cloud computing and enterprise group, so he was already steeped in the idea of transformational change at the company.

“Achieving our mission requires us to evolve our culture. It all starts with a growth mindset—a passion to learn and bring our best every day to make a bigger difference in the world.”

Satya Nadella, CEO, Microsoft

Before Nadella’s ascension, Microsoft had long been known for its extremely competitive, “know-it-all” culture. Employees succeeded by showcasing their own individual achievements and how their accomplishments exceeded their peers.

Nadella changed this ethos by championing a growth mindset, encouraging employees to be “learn-it-alls” rather than “know-it-alls.” The shift included placing new importance on how employees contributed to the success of others, a value that was incorporated into individual performance reviews. Nadella made this transformation his personal mission and directed leadership to propagate the new philosophy at all levels across the organization.

“Achieving our mission requires us to evolve our culture,” Nadella says. “It all starts with a growth mindset—a passion to learn and bring our best every day to make a bigger difference in the world.”

The combination of the shift to cloud computing infrastructure and overhauling the company culture helped set the stage for the major technological innovations to come.

A new vision: The Modern Engineering era (2018-2023)

For years, IT at Microsoft had been order takers, doing what the business requested with limited ability to impact strategic priorities. That changed as we shifted to become a modern engineering organization. With support from our executive leadership, IT was elevated to become a peer engineering function at Microsoft.

Rather than simply taking orders, the team was empowered to lead with a strong vision for the future. In fact, leading with vision is the primary hallmark of our Modern Engineering era. As we moved into this era, we needed a clearly articulated view of our goals as an IT organization aligned to the needs of our business partners, as well as the resources needed to achieve them.

Role transformation

Transitioning to become a modern engineering organization required Microsoft Digital to adapt our legacy approach to IT.

Operating an engineering organization in a cloud environment meant new roles, new skills, and a new mindset. With no need to manage physical hardware, our modern IT professionals were freed to work more closely with business partners, requiring greater strategic acumen. The team was now focused on DevOps, Agile program management, and user-centric design principles.

User-centric, coherent design

Our design philosophy puts the user—an employee or guest—at the heart of every decision we make at Microsoft Digital.

The goal of this approach is to make tasks that might have previously caused friction to become simpler. Instead of dealing with disconnected systems, user-centric design introduces consistent and logical flow between services. This makes it easier for people to access services, learn how to use them, and then put them to good use.

Microsoft also embraces coherent design across all our products. A familiar look and feel, along with consistent usage patterns, accelerates employee usage and adoption. 

Embracing work-from-anywhere capability

During the pandemic, when our workforce was still fully remote, our organization was already starting to think about what the new hybrid workplace would look like when people started returning to the office. We identified three key dimensions of the employee experience:

• Physical spaces: We partner with Global Workplace Services to plan and deploy meeting spaces with amazing digital capabilities that support an inclusive approach to hybrid productivity.
• Digital capabilities: We keep employees productive and their digital environment safe and secure, no matter where they’re located or how they connect.
• Culture: A strong partnership with HR ensures that digital experiences support our company culture.

Managing shadow IT with a culture of trust

Shadow IT is the unknown and unmanaged set of applications, services, and infrastructure that are developed and managed outside standard IT policies. Shadow IT typically crops up when engineering teams are unable to support the needs of non-engineering partners, a situation that could arise from a lack of available capacity or the need for specialized domain solutions. 

While earlier eras of our IT history focused on trying to prevent shadow IT, we are now concentrating on managing it. We use Azure best practices to optimize shadow IT and Microsoft 365 governance policies to ensure that our corporate security, privacy, and accessibility standards are met. We empower our employees to create whatever they need within our tenant, including PowerApps, SharePoint sites, Teams channels, or agents, mitigating the need for “shadow” solutions while also providing visibility into how our employees are using our own technology.

Learn how optimizing our Microsoft Azure usage is helping us manage our Shadow IT.

The Era of AI (2023 to present)

The latest chapter in the history of our organization’s digital transformation is defined by the integration of AI and agents into IT operations. AI is revolutionizing how Microsoft does IT at enterprise scale, driving efficiency and innovation across the board. From the apps, workflows, and services that power our employee experience to the network, infrastructure, and devices that enable employee productivity, our AI-focused investments provide a solid foundation for the innovations that we are constantly implementing. As we look at the future of Microsoft Digital, we’re focused on four key priorities: security, service fundamentals, acting as Customer Zero, and AI-powered innovation. We’re working to excel in all four domains with the help of our industry-leading AI capabilities.  

“Our mission is to power and protect Microsoft, and that starts with an unwavering commitment to the Secure Future Initiative.”

Brian Fielder, vice president, Microsoft Digital

Securing our future

Security is our highest priority. The Microsoft Secure Future Initiative aligns every team with a shared approach, common priorities, and consistent milestones to harden our security posture across all products and services.  

“Prioritizing security above all else is critical to our company’s future,” Nadella says. “Every task we take on—from a line of code to a customer or partner process—is an opportunity to help bolster our own security and that of our entire ecosystem. If you’re faced with a tradeoff between security and another priority, your answer is clear: Do security.”

The Secure Future Initiative is built on three core principles: Secure by design, secure by default, and secure operations. As the company’s IT organization, we work relentlessly to fulfill the key pillars of the Secure Future initiative across all our systems, including:

• Safeguarding identities and secrets
• Protecting tenants and isolating production systems
• Securing networks and engineering systems
• Enhancing threat detection
• Expediting response and remediation

“Our mission is to power and protect Microsoft, and that starts with an unwavering commitment to the Secure Future Initiative,” says Brian Fielder, vice president of Microsoft Digital.

Secure Future Initiative | Microsoft

Foundations: Service fundamentals

The second pillar is to maintain the highest standards of service fundamentals. These are the essential capabilities and practices that enable us to deliver reliable, secure, and compliant services companywide. Adhering to the highest standards of service fundamentals ensures that our organization continues to play a critical role in running the company’s business and enabling innovation, agility, and resilience in a fast-changing and competitive environment.

Customer Zero

The third pillar is acting as Customer Zero for Microsoft’s most important products and services, like Copilot Studio, Microsoft Teams, and Agent 365. In Microsoft Digital, we take pride in being the first customer for a wide variety of Microsoft products and services, relentlessly focusing on our own employee experience to create products that enable every person on the planet to achieve more.

Being Customer Zero means forging a deep partnership between our IT organization and product engineering groups to envision the right experiences, co-develop innovative solutions, and then listen to and act on insights gathered from our employees. We work together to stay grounded in the way our employees use our products every day, so your employees can benefit from our insights prior to external product launches.

Read about how we’re improving our employee experience through our Customer Zero focus.

AI-powered innovation

The final pillar of this era is innovating with AI to transform the digital experience at Microsoft. By doing all the fundamental work detailed above—security, foundations, and Customer Zero—extremely well, we gain the confidence and earn the trust necessary to embed AI across our full portfolio of services. We do this over three key dimensions: core IT services, employee experiences, and corporate functions.

Core IT services: Transforming and securing our network and infrastructure

We’re focused on using AI to infuse data-driven intelligence into every part of our infrastructure and network operations. This allows us to optimize operations and increase security while simultaneously improving outcomes.

Examples include:

• Network observability and governance: Ensuring data accuracy, eliminating non-compliant hardware and software, and real-time updates
• Securing endpoints: Device management, asset management, and patching
• Zero Trust networking: Isolating device classes and limiting attacker’s movements across the network
• Network access: Azure VPN, identity management, and Secure Access Workstation (SAW) infrastructure security

Learn how we’re transforming our enterprise IT operations at Microsoft.

Core IT services: Tenant management

We manage one of the most complex tenants anywhere. Governance today is a somewhat fragmented experience, with no clear mechanism for IT to safely enable self-service asset creation for sites, Teams, groups, Power Apps, and so on. These unmanaged assets increase the risk of over-sharing sensitive data and compromise the health and security of our IT environment.

In the world of AI, security through obscurity is no longer a viable option. This means data hygiene, permission management, and data protection are essential to providing trustworthy AI tools that don’t overexpose sensitive content, while still providing quality responses.

Read about one way we’re improving security by protecting elevated-privilege accounts at Microsoft.

Core IT services: Support

We’re using generative AI to transform the way our employees interact with our support services. IT issues will be either auto-remediated or resolved remotely and instantly through conversational, personalized, and contextualized solutions, often without a human agent’s intervention.

We’ll accomplish this with a focus on the following:

• User experience: Our employees are using the AI-powered Employee Self-Service Agent to access personalized, accurate, and cost-effective issue resolution. Future goals include implementing a seamless transition to a human agent while the user stays within the agentic Copilot experience.
• Human agent experience: Operational efficiency and automation are being integrated into the Service Operations Workspace. The service includes chat and incident summarization that recommends best next actions and drafts contextual answers to queries.

Find out how we’re transforming IT support at Microsoft with AI and the Employee Self-Service Agent.

Defragmenting the employee experience

The second dimension where we’re implementing our AI vision to make a difference is our employee experience. Our vision is to deliver a unified, connected, and personalized experience where users can access employee data, tools, and insights from one place.

“We see AI as the key to unlocking the full potential of our employees, delivering personalized experiences that empower us to work smarter, faster, and happier—unleashing the innovation and collaboration necessary for our success.”

Vijaya Alaparthi, principal group product manager, Microsoft Digital

One of the key ways we’re doing this is with Microsoft 365 Copilot, which functions as a “UI for AI” across our employee tools and services. An example is our Employee Self-Service Agent, an AI-driven tool based on Copilot that helps employees more efficiently find context-specific answers to their questions using natural language queries.

“We see AI as the key to unlocking the full potential of our employees, delivering personalized experiences that empower us to work smarter, faster, and happier—unleashing the innovation and collaboration necessary for our success,” says Vijaya Alaparthi, a principal group product manager in Microsoft Digital.

To achieve our vision, we’re building a workplace where AI defragments the employee experience by:

• Providing contextual support in the flow of work
• Reducing the number of sites and apps an employee must remember
• Using Microsoft 365 Copilot as the “UI for AI,” making it simple for employees to find information, take action, and even fully automate certain repeatable tasks

Corporate functions growth

Our third major priority in Microsoft Digital is to improve how we support the company’s corporate functions organizations, including legal and real estate and facilities.

“With AI, we have so many new ways to innovate. From optimizing building occupancy, to streamlining commute services, to automating contract and document management, we have incredible potential to make our corporate functions more efficient and impactful.”

Becky West, principal group product manager, Microsoft Digital

This is a particular challenge, as these teams are being asked to do more with less today; Microsoft can no longer afford to grow operational costs at the same rate as in the past.

AI is playing a fundamental role in transforming the business workflows of our corporate functions partners while improving operational efficiency, user productivity, regulatory and corporate compliance, and data-driven decision making. It’s revolutionizing the way they operate by automating repetitive and time-consuming operational tasks.

“With AI, we have so many new ways to innovate,” says Becky West, a principal group product manager in Microsoft Digital. “From optimizing building occupancy, to streamlining commute services, to automating contract and document management, we have incredible potential to make our corporate functions more efficient and impactful.”

Some of the corporate functions taking advantage of AI capabilities and related increased efficiencies include:

• Real estate and facilities: In supporting the technology needs for more than 500 company buildings worldwide, we are poised to use AI and related innovations to implement cost savings in the areas of workspace systems, facilities management, and space management.

Find out how we’re transforming facility operations at Microsoft with AI maps.

• Travel and expense: Our plan is to work for near-elimination of the traditional expense reporting process through AI-based and touchless experiences, driving simplification and productivity gains.

Check out how OneExpense transformed our employee expense reporting.

• Legal: Our vision for integrating AI into Corporate, External, and Legal Affairs (CELA) includes more discoverable legal findings, better corporate document management with the Docufy platform, enhanced engagement with Microsoft Philanthropies, and accelerated support for business-critical functions such as immigration, contracting, and insider trading compliance.

Read how AI is revolutionizing the way we support corporate functions at Microsoft.

Agentic AI: Becoming a Frontier Firm

This era of AI in IT has quickly morphed into a world in which agents are having major impacts across the enterprise. Microsoft Digital plays a central role in helping the company embrace this change and transform into a Frontier Firm: an organization that has deeply embedded AI and agents into its operations, products, and culture

As a Frontier Firm, we go beyond simply adopting AI as a discrete tool or additional technology. We’re actively integrating intelligent systems, rich data platforms, and human knowledge into a unified operating model, where automation, decision making, and innovation combine to spark acceleration at scale. Agentic AI is a core enterprise capability for us, powering everything from employee productivity to customer experiences and strategic decisions.

As Microsoft progresses into this agentic AI future—where autonomous or semi-autonomous AI agents understand context, take actions, and collaborate alongside humans—Microsoft Digital has played a lead role in deploying these capabilities internally. We’ve led the early adoption of tools like Microsoft 365 Copilot, Azure AI services, and custom-built agents that help us automate repetitive tasks, surface insights, and orchestrate workflows across systems while enforcing strict governance policies. Examples include AI-powered agents that assist in IT service management, network monitoring, and enterprise knowledge retrieval, which allow employees to focus on higher-value work and maximize their individual impact.

As AI agents continue to grow in power and functionality and become more deeply integrated into the daily workflows of knowledge professionals, Microsoft IT will maintain our leadership role and operate at the bleeding edge of this technological revolution. 

A catalyst for change and growth

Microsoft’s digital transformation is a story of evolutionary change, resilience, and adaptation across multiple eras of information technology. From our origins as a traditional IT organization to becoming a modern engineering organization focused on driving AI-powered innovation, we in Microsoft Digital remain a catalyst for change within the company and our industry.

With our insights born from customer and employee obsession, we’re committed to streamlining IT operations while prioritizing security, revolutionizing user services, and facilitating corporate functions growth and development. All with the overarching goal of making Microsoft employees everywhere more productive while showing our customers and partners what’s possible as we move forward together into the future of IT.

The post Digitally transforming Microsoft: Our IT journey appeared first on Inside Track Blog.

“The legacy system was highly fragmented, with more than 50 device options, localized processes, data scattered across different systems, manual touchpoints, and limited visibility into order status. This created a lot of friction across the company, as well as higher costs.”

Aniruddha Das, principal PM manager, Microsoft Digital

But as our organization scaled globally, this system became increasingly complex and inefficient.

Across more than 200,000 employees in over 100 countries and regions, our device procurement and inventory management devolved into a patchwork of systems and practices. There was no top-level management, no consistent lifecycle model, and no standardized experience for employees needing to order a new device.

“The legacy system was highly fragmented, with more than 50 device options, localized processes, data scattered across different systems, manual touchpoints, and limited visibility into order status,” says Aniruddha Das, a principal PM manager in Microsoft Digital, the company’s IT organization. “This created a lot of friction across the company, as well as higher costs.”

Working in partnership with Procurement, we built myDevice—a companywide program that centralizes primary-device procurement and lifecycle workflows within a single managed platform. myDevice brought together previously distributed data and processes, giving us reliable visibility into each employee’s primary device and enabling predictable, data-driven refresh planning at scale—along with the operational insights needed to run the end-to-end experience.

“We’ve moved from a fragmented device procurement experience with many touchpoints to one conversation with one agent. Basically, we can tell our employees that their next device is just a conversation away.”

Mukul Singhal, partner engineering manager, Microsoft Digital

Beyond solving some of these basic data challenges, we also needed to address harder, at‑scale problems in the broader procurement experience: helping employees confidently pick the right device without getting overwhelmed by options, aligning eligibility and catalog choices to an employee’s role and location, and more.

With the new Employee Device Information (EDI) agent—affectionately referred to as “Eddie”—our employees will soon be able to use an AI chat interface to quickly explore recommended device options based on their job role and work needs, compare different models, and order a new device with a single click. This streamlined approach will reduce frustration, save time, and cut our costs as we automate a formerly manual process.

“We’ve moved from a fragmented device procurement experience with many touchpoints to one conversation with one agent,” says Mukul Singhal, a partner engineering manager in Microsoft Digital. “Basically, we can tell our employees that their next device is just a conversation away.”

Creating a unified approach with myDevice

The transformation began about three years ago, when our Procurement partners brought their vision for myDevice to us in Microsoft Digital. The stated goal was to standardize employee device procurement, inventory, and lifecycle management across the company.

“Our decentralized process was an industry outlier, and we realized we needed to pivot toward a standardized global process. We wanted to give our employees a single entry point, with consistent guidance across the enterprise.”

Angela Pearson, senior procurement program manager, Microsoft Procurement

Built on top of our internal ServiceNow platform, myDevice brought together previously disconnected workflows into a single consistent experience for employees. It introduced a common catalog of devices, standardized refresh cycles, and centralized ordering and fulfillment processes.

It was evident that such a system was badly needed.

“Our decentralized process was an industry outlier, and we realized we needed to pivot toward a standardized global process,” says Angela Pearson, a senior procurement program manager in Microsoft Procurement. “We wanted to give our employees a single-entry point, with consistent guidance across the enterprise. That was the first big win.”

Purchasing devices for a global workforce the size of Microsoft is not an insignificant budget item. And our fragmented system meant higher costs for the organization.

“The decentralized procurement model allowed teams to move fast, but it also led to inefficiencies,” Das says. “Devices were often purchased at the end of the fiscal cycle, because there was budget, but they didn’t always match real requirements and would sometimes go unused.”

This list maps out the evolution of our device procurement program here at Microsoft:

Legacy state

• Distributed experience: Inconsistent, inefficient processes across countries and business groups
• Zero visibility: Lack of proper asset tracking, accounting, or device management
• High friction and high cost: Significant manual effort required across multiple touchpoints

Foundation: myDevice 1.0

• Unified global experience: One consistent process across all geographies and divisions
• Persona-based: Guided buy for productivity needs based on job role
• Streamlined workflows: Optimized automated processes reducing manual touchpoints
• Enhanced visibility: Improved data management and asset tracking entering the company

Future vision: myDevice 2.0

• Next-gen interface: AI-driven, seamless employee interaction
• Supply chain resiliency: Built to weather disruption
• AI-assisted workflows: Intelligent automation across backend systems and processes

Creating a solution at the scale required for myDevice was a challenge. Relevant data was spread across systems, refresh cycles were inconsistent, and key processes, such as determining which devices should be refreshed, were often manual and time-intensive.

“The data was distributed across multiple systems, and each group was doing their own cycle,” says Amit Raghuwanshi, a principal software engineering manager in Microsoft Digital. “Bringing all the relevant data together was a huge task and big part of the solution.”

Three scenarios for device procurement

Our employees interact with three different workflows that involve obtaining a new primary work device:

• New hire provisioning
• Device refresh (for aging machines)
• Replacement for damaged devices

Each of these core scenarios now follows a standardized process, replacing the ad hoc methods that previously varied by team and geography.

“If a new hire’s device arrives a week after they join the company, that’s not a good experience. We want them to have it on day one.”

Ashok Bagade, principal product manager, Microsoft Digital

Establishing a clear device lifecycle was a big step. For example, Microsoft employees are eligible for a new PC (called a refresh) every four years. Now, with myDevice, roughly 20,000 employees each quarter automatically get a refresh invite, presuming available budget. This takes the burden off IT, admins, and other support staff who were previously tasked with managing this process manually.

The myDevice system is also improving the process for new hire device procurement. The goal has always been for each new Microsoft employee to have a computer waiting for them on their first day, but the gaps in the previous system often made meeting this standard difficult.

“If a new hire’s device arrives a week after they join the company, that’s not a good experience,” says Ashok Bagade, a principal product manager in Microsoft Digital. “We want them to have it on day one. Today, we are only able to do that around 70% of the time. We want to take that rate up to 98%.”

To make that happen, we’re in the process of shifting from a build-to-order device model to an inventory-based model. This means that our suppliers will have a stockpile of our most frequently requested PCs on hand, based on data we have compiled. This approach is designed to reduce the device procurement time from four to six weeks down to less than two weeks, Bagade says.

By centralizing and standardizing device management, myDevice created the foundation for the next phase of transforming this process: intelligence.

Adding AI for a seamless procurement experience

The second part of reimagining our employee device procurement at Microsoft was on the front end, which is the digital interface our people experience when they need to choose their new device.

Even with a unified platform in place, the experience of selecting and ordering the device could be time consuming and disjointed. Employees could browse a list of available computers, but choosing the right one still required research and consultation with colleagues and led to cognitive overwhelm.

“The challenge we saw is that people take a long time to complete their purchase because they don’t know which device to select,” Bagade says. “They get a bunch of options, and they’re not sure which one is right for them.”

So we built EDI (or “Eddie”), an AI-powered agent created with Microsoft Copilot Studio, that makes the process much more efficient. Eddie is transforming a static workflow into a conversational experience.

With Eddie, employees get a guided, conversational buying experience instead of a form-led journey. The agent validates the employee’s eligibility, captures the required inputs, and then offers role-aligned device choices directly in the chat—complete with comparison details and a clear selection path. Once confirmed, the employee submits the request and receives a trackable ServiceNow reference, which reduces follow-ups and helps employees stay informed on the process end-to-end.

“Eddie not only gives a consistent purchasing experience—it also guides you,” Bagade says. “You can ask questions and, through that conversation, narrow down your options.”

The agent is underpinned by a multi-agent architecture where specialized components handle different aspects of the process—catalog browsing, comparison, recommendations, and ordering—coordinated by an orchestration layer.

“With Eddie, the agent validates the information and, in many cases, executes the change. It can literally happen in minutes.”

Aniruddha Das, principal product manager, Microsoft Digital

Reducing complexity and increasing visibility

EDI also addresses operational pain points that extend beyond purchasing. One early challenge focused on correcting primary device records, which is an essential but previously manual process.

“Before we developed this solution, something as simple as correcting an employee’s primary device required multiple tickets and human validation,” Das says. “It could take weeks—and in some cases months—to resolve. With Eddie, the agent validates the information and, in many cases, executes the change. It can literally happen in minutes.”

Another critical improvement is visibility. Previously, once a device request was submitted, it effectively disappeared into a system that offered limited transparency.

“After placing a request, employees had no way to check on the status—it went into a black hole,” Das says. “Now, Eddie can look at the same data that Procurement has and provide answers immediately.”

Looking ahead: From systems to conversations

With myDevice and EDI in place, we’re now focused on the next phase: transforming device management into a fully conversational, intelligent experience. The vision is to move beyond portals entirely and toward an agent-first model where employees interact with systems through natural language.

“Our view for the future is that you won’t need to visit a UI or a system to accomplish a task, you’ll just start talking to an AI agent.”

Amit Raghuwanshi, principal software engineering manager, Microsoft Digital

This includes expanding capabilities such as predictive refresh cycles, deeper personalization, and tighter integration with supply chain and inventory systems. Efforts are also underway to reduce fulfillment times through innovations like centralized inventory management and forecasting.

At the same time, the experience will continue to evolve toward greater simplicity.

“Our view for the future is that you won’t need to visit a UI or a system to accomplish a task, you’ll just start talking to an AI agent,” Raghuwanshi says.

For employees, that shift means less friction, faster decisions, and a more intuitive experience.

“We know how busy our employees are, and we don’t want them spending time on lower-priority tasks. When it’s time to acquire a new device, the experience should be seamless from start to finish, without added complexity or cognitive burden. We’re making steady progress toward that reality.”

Anna Adams, director of hardware programs and operations, Microsoft Procurement

For our organization, it represents a broader transformation—one where AI not only improves existing processes but fundamentally reshapes our workflows and the way that work gets done across all functions.

This means that our employees have one less process that they have to puzzle through and figure out, which allows them to focus on their higher-value work.

“We know how busy our employees are, and we don’t want them spending time on lower-priority tasks,” says Anna Adams, director of hardware programs and operations in Microsoft Procurement. “When it’s time to acquire a new device, the experience should be seamless from start to finish, without added complexity or cognitive burden. We’re making steady progress toward that reality.”

The post Meet ‘Eddie,’ our agent for putting new PCs in the hands of our employees appeared first on Inside Track Blog.

In this video, Tony Rice, principal security program manager in the Office of the CISO, discusses the teams and organizational systems that help define and adapt security requirements that are applied across the enterprise. You’ll hear about how teams work together to embed security into engineering workflows and scale assurance through automation, secure defaults, and data driven KPIs. We seek to continuously monitor and improve security by applying both automated controls and use of human-driven security reviews.

“This isn’t just about ticking boxes. It’s about making sure that security is embedded in every stage of development and operation,” says Rice.

Learn from our experience

Explore the Microsoft Secure Future Initiative.

The post Microsoft CISO advice: Governing security at scale with Security Development Lifecycle appeared first on Inside Track Blog.

At first glance, helping sellers improve the way they work looks like a data challenge because we tend to believe more data equals better decisions. However, when we explored how they use data to prepare for customer meetings and internal business reviews, we saw a different pattern.

The amount of data they had available to them had increased—but so had the manual effort needed to turn it into useful and actionable insights. In fact, our sellers were spending more time looking for relevant information than they were spending engaging with customers to improve their experience.

As part of our Customer Zero approach at Microsoft, we apply our technologies internally and use that experience to understand what works at scale so we can pass that knowledge onto our customers. In this case, our discoveries unearthed a deeper issue with how our sellers interact with data in their day-to-day work.

Too much data, not enough insight

The increased amount of data available to our sellers gave them more options but also more information to process. It also introduced fragmentation.

“I think the big feedback pain point we got was that we have way more data than our sellers were used to. You give us a gigantic well of data, but how I use that data to execute my job is fragmented.”

Michael Toomey, revenue insights lead, Finance Data and Experience

A significant portion of our sellers’ time went into finding, interpreting, reconciling, and analyzing the information before any actual decisions or customer interactions were taking place. In some cases, sellers were navigating hundreds of reports and dashboards across multiple systems. In others, they were exporting data into spreadsheets, building their own analyses, and assembling presentations manually. They told us they were overwhelmed by the amount of data they had access to.

“I think the big feedback pain point we got was that we have way more data than our sellers were used to,” says Michael Toomey, a revenue insights lead on our Finance Data and Experience team. “You give us a gigantic well of data, but how I use that data to execute my job is fragmented.”

This tedious manual user experience didn’t match the fast pace of our work. Sellers needed to move quickly, and we needed a way to empower them to find the data and insights they needed to be able to make actionable decisions immediately.

Instead of continuing to expand the amount of data available to our sales force, we concentrated on making the existing data easier to access, understand, and use.

Beginning with a trusted data foundation

The starting point was the data itself. Our sales organization draws from many systems, each of which has its own structure, definitions, and refresh cycles. Without alignment across these systems, even seemingly simple seller questions could produce different answers depending on the data source. This created more work as our sellers hunted down which answer was the correct one.

We consolidated all this data into a unified model on Microsoft Fabric, creating a shared data foundation across the organization. It included standardized definitions, consistent metrics, and common hierarchies. Data from more than 70 systems was brought together into one governed environment.

This step required coordination across teams and ongoing attention to evolving data governance. It established trust in our data that made it easier to streamline the user experience for our sales teams down the line.

Streamlining how sellers work with data

With a consistent data foundation put into place, we turned our attention to how sellers could most effectively access and use the information.

Instead of asking sellers to navigate a portal of reports, we designed role-based dashboards that reflect how people actually work. Individual dashboards are curated based on role, workflow, and responsibilities, helping our sellers quickly find what they needed without searching across systems. We transformed the work surrounding actionable insights, too: Power BI surfaces intelligent insights to our sellers’ dashboards every morning, automatically giving them their priorities for the day and providing an overview of their funnel.

Before this transformation, building PowerPoint presentations for customers and summarizing reports were routine but tedious parts of the preparation process for our sellers before they spoke to customers. These preparatory steps have been streamlined or automated wherever possible, reducing seller time spent on repetitive manual tasks.

Empowering sellers using AI

With the data organized and cleaned and the user experience transformed, we introduced AI to overhaul how our sellers interact with the information available to them.

“A lot of what we’re trying to do is get to a native Microsoft 365 Copilot experience where we meet people where they’re working every day. And then work is optimized to be able to reason over our day to pull the data in.”

Michael Toomey, revenue insights lead, Finance Data and Experience 

To find the information they’re looking for, sellers can now ask questions in natural language and receive answers directly in the tools they already use. Insights powered by Power BI Copilot, Fabric, and AI Foundry are delivered proactively, helping sellers prioritize their day, generate summaries, and assemble materials for meetings without working through each step manually.

Insights that previously required a great deal of time to uncover are surfaced directly. The relevant reports are automatically routed to sellers based on their job description and client base. Sellers can also subscribe to continuously updated reports and have them surfaced each morning to their inbox.

These capabilities are available in the tools our people already use, which means they don’t have to spend time learning new product suites. The information they’re looking for can be surfaced through tools like email or within Microsoft Teams, which means sellers can stay focused on their work without needing to switch between systems.

Processes that once took hours can now be completed in minutes.

“A lot of what we’re trying to do is get to a native Microsoft 365 Copilot experience where we meet people where they’re working every day. And then work is optimized to be able to reason over our day to pull the data in,” Toomey says.

What changed

The most visible shift we’ve observed is how sellers spend their time. Less effort goes into finding, assembling, and reconciling information, and more attention is directed toward understanding customer needs and making decisions that actively move the business forward.

After deploying this model across our sales organization, we saw meaningful improvements in both efficiency and effectiveness, including:

• 100,000 seller hours saved annually
• 30% reduction in data ingestion costs
• 10x faster insight generation
• 1,500 reports retired and consolidated

We credit our success to building a trusted data foundation; a streamlined, intuitive user experience; and embedding AI into the flow of work to help our sellers surface insights and information with a few clicks instead of spending hours sifting through irrelevant inputs.

We learned that executive sponsorship and active change management were essential to transforming the department successfully. Concentrating on consistency and departmental alignment around a set of trusted, verified, well-governed data and shepherding people through shifting how they worked with the data were just as important as adding AI into the process.

Looking ahead

At the heart of our trusted data foundation is the semantic layer, the place where our business definitions, metrics, and data quality are standardized across the organization. It’s now the engine that powers our agents. Because those definitions live in one governed place, our agents can reason over our data products with confidence, and we can trust what they surface.

That foundation is already bearing fruit. A new generation of personal and role-based agents at Microsoft is taking on the workflows that were consuming our sellers’ time, such as meeting preparation, pipeline reviews, and customer insight generation. These processes are now running on the governed data infrastructure we built. Everything draws from the same source of truth, so everything our agents work with is consistent, reliable, and ready to act on.

This return on our platform investment is bringing us closer to becoming a Frontier Firm where our people spend less time searching for the answers and more time acting on them.

The post From data sprawl to AI-driven seller insights at Microsoft appeared first on Inside Track Blog.

Research shows that 75% of consumers ignore calls from unknown numbers, and 92% assume unidentified calls are fraudulent. Meanwhile, phone-based fraud costs businesses more than $1 trillion a year globally, according to the 2024 Global State of Scams Report.

At Microsoft, we saw this issue directly affect our contact center, when our customers didn’t understand that our team was reaching out to address a ticket or follow up on a business need. In turn, some customers would complain that they never received a call back from our team.

“In the past, we were mitigating a lot of things, but now we have a fool-proof plan of how we’ll execute this solution and fix the issue once and for all.”

Annie Drago, senior software engineer, Commercial Engineering and AI

At first, we would contact our phone carriers in the region to ensure our calls were recognized, but this was difficult to implement across all the markets we operate in (more than 100 countries and regions total). So, our team in Commercial Engineering and AI (CEAI)—the engineering organization behind the company’s commercial business—set out to find a globally applicable solution.

Our Support Experience Group within CEAI recently launched a caller ID program in partnership with the Open Verifiable Calling (OVC) Alliance, run by the Global System for Mobile Communications Association (GSMA) Foundry. This framework assigns a verified identity to every call we initiate, no matter where the agent or customer is located—helping us to improve response rates and build trust with our clients.

“In the past, we were mitigating a lot of things,” says Annie Drago, a senior software engineer in CEAI. “But now we have a fool-proof plan of how we’ll execute this solution and fix the issue once and for all.”

Finding a global solution to a local problem

Not long ago, we moved our contact center in-house, using Microsoft Azure Communications Services (ACS). While this was happening, our team noticed that many of their calls to customers were getting marked as spam or blocked because of specific country regulations primarily due to the fact that ACS is a cloud-based solution and not on-premises.

For example, a country might automatically block or mark as spam any call from an international number. Cloud telephony can also make domestic numbers look foreign to carriers, further incentivizing them to mark the call as spam.

“Every country has their own telecom administration,” says Peter Nilsson, a principal engineering leader in CEAI focused on contact center solutions. “Many of them are tightening the noose around phone calls coming into their country.”

Our calling patterns have also changed, making verified calling that much more important.

“We’re doing a lot more outbound calls today than we were in the past,” Drago says. “For the sales line of businesses specifically, when a sales agent makes a call to a customer, it’s very important that a local caller ID is shown, so the chances of them accepting the call are higher.”

As a first step toward getting customers to understand it was Microsoft on the other end of the call, we partnered with telecom carriers in each region to verify the numbers we use there. The carrier could then ensure that the calls from these numbers are handed off to the customer without being flagged as spam or blocked.

“Our objective is to bring in a standard framework for verified calling that could be deployed internationally, instead of having piecemeal, country-by-country standards. It’s very hard to build a solution or technically design anything when you have to take every country into account individually.”

Elaine McNeill, senior tech solutions manager, CEAI

While effective enough for existing markets, this solution wasn’t sustainable, as it required around 40 different pipelines. On top of this, it couldn’t set us up for success long-term when we wanted to enter new markets.

It was at this stage, where we had set up verified calling with each individual carrier but still lacked a simplified, universal approach, that we came across the OVC Alliance.

“Our objective is to bring in a standard framework for verified calling that could be deployed internationally, instead of having piecemeal, country-by-country standards,” says Elaine McNeill, a senior tech solutions manager in CEAI. “It’s very hard to build a solution or technically design anything when you have to take every country into account individually. We’re at the forefront and will be one of the first users of the service.”

Standardizing verified calling across regions

Each call from our contact center now passes a set of credentials to prove the authentic origin of the call. These credentials stipulate that:

• Microsoft has the right to the telephone number that is being displayed.
• Microsoft Corporation is the actual legal entity responsible for the call, using a globally unique legal identifier.
• Microsoft has the right to use the brand that is being displayed.

These credentials were issued directly to us, granting us full control over how they’re communicated. They can also be used across multiple communications as a platform service (CPaaS) platforms, meaning you only need to vet a number once for it to work in multiple countries or for multiple carriers.

The signing service Provenant, our Verifiable Voice Protocol (VVP) partner on the project, controls this verification process.

“Provenant will say, ‘Okay, everything looks good. This is the right ID. This is with Microsoft. Microsoft owns the number,’” Drago says. “Then they send that information in the identity header back to us, and we send it back to the carrier.” From there, the terminating carrier delivers the call to the end party.

Avoiding dropped calls

To ensure that every Microsoft call reaches its desired customer, we had to collect a database of numbers to be validated and certified.

“If I don’t send them that information beforehand, any extra number will be rejected automatically,” Drago says. “With Provenant, we can manually certify our numbers through our own back-end sign-in.”

Another big challenge to standardizing verified calling is ensuring there’s a thorough, consistent, and region-specific vetting process. OVC’s governance model includes vetting agents that verify enterprises like Microsoft in specific regions and for specific communications channels. These agents are overseen by the governance authority, which sets the standards for credentials and can revoke them at any time if enterprises don’t meet those standards.

A future of increased trust

With OVC, we have a carrier-agnostic solution that boosts our reputation on a global scale.

“It’s a business need that we had to solve. And we’ve been able to demonstrate the technology to do that with our partner and our proof-of-concept MVP trial which was showcased at MWC 2026 in Barcelona. Now the hill to climb is to get this as a globally accepted standard.”

Peter Nilsson, principal engineering leader, CEAI

In the future, we hope to not just verify calls so that they aren’t blocked or marked as spam, but also brand them with the Microsoft logo and name. When customers can see right from the get-go that it’s Microsoft on the other end, this can further increase call acceptance rates.

“It’s a business need that we had to solve, and we’ve been able to demonstrate the technology to do that with Provenant and our proof-of-concept MVP,” Nilsson says. “Now the hill to climb is to get this to be a globally accepted standard.”

For other businesses, verified calling can deliver similar acceptance rate improvements, as well as stop impersonators and bad actors from reaching customers. That’s a big factor and a motivator to keep working on this issue.

“You have the opportunity in other sectors to really reduce fraud significantly,” McNeill says.

The post Advancing trusted calls with Open Verifiable Calling at Microsoft appeared first on Inside Track Blog.

• Introduction
• Chapter 1: Understanding Work IQ
• Chapter 2: Establishing trust: How we govern Work IQ
• Chapter 3: How our employees experience Work IQ day-to-day
• Chapter 4: Work IQ beyond Microsoft 365
• Chapter 5: Working with Work IQ: The Customer Zero impact
• Conclusion: Where we’re heading: Work IQ, Fabric IQ, and Foundry IQ

Improving agentic workplace results with Work IQ

Adding deeper contextual intelligence to Microsoft 365 Copilot responses

Enterprise knowledge is perhaps a company’s most valuable asset, but for AI and agents, it can be difficult to take advantage of. Years of emails, documents, chats, meeting recordings, and workflows have created enormous volumes of rich data, scattered across systems and teams in a fragmented way. This data captures how work actually happens, but harnessing it broadly—especially in ways that support better decision making—has traditionally been almost impossible.

Enter the power of agentic AI tools.

In the modern agentic workplace, employees and teams here at Microsoft and elsewhere are finally able to take advantage of all that rich, unstructured knowledge. Microsoft 365 Copilot and AI agents can now access all this data and not simply retrieve information but also reason over it—learning how work gets done and then providing rich contextual responses and guidance.

“By giving AI the ability to reason across the vast repositories of unstructured data that our enterprise possesses, Work IQ fundamentally changes what’s possible for Copilot, agents, and employees alike.”

Brian Fielder, vice president, Microsoft Digital

We’ve given this new, dynamic way of leveraging your enterprise data to boost productivity a special name: Work IQ.

Work IQ represents a big step forward.

For us, it’s enabling the concept of “intelligence on tap” across our enterprise, making our organizational knowledge and work context accessible in real time, grounded in the signals employees generate every day. This transforms unstructured data from a challenge into a strategic resource—one that can support workflows at scale.

“Work IQ represents the next phase of the agentic workplace of the future—and it’s here,” says Brian Fielder, vice president of Microsoft Digital. “By giving AI the ability to reason across the vast repositories of unstructured data that our enterprise possesses, Work IQ fundamentally changes what’s possible for Copilot, agents, and employees alike.”

“It’s not really a brand-new capability, but more an evolution of what users already know, which is access to the grounding data in their Microsoft tenant. The difference is that Work IQ adds an additional layer to provide more context, allowing for richer and more relevant results.”

Aisha Hasan, principal product manager, Microsoft Digital

Internally here at Microsoft, Work IQ is having a tangible effect on how we work every day. A few simple scenarios that illustrate the power of Work IQ—described in greater detail in Chapter 3—include:

• Helping our employees understand which emails require their immediate attention, so they can focus on what matters
• Connecting meeting transcripts to the people involved in a meeting, accelerating actions through a deeper understanding of the participants and their work patterns
• Enabling our employees to create, organize, and publish Microsoft 365 content more quickly and with higher quality

This is just the beginning. As AI continues to permeate our business workflows, nearly every day-to-day task at Microsoft will be simplified, expedited, and improved by the intelligence of Work IQ. This includes the agents that are managing routine business and operational processes, giving them critical business context that helps their reasoning abilities.

This guide explores the ways that Work IQ is impacting how work gets done at Microsoft, and how Microsoft Digital—the company’s IT organization—has played a key role as Customer Zero, validating how Work IQ behaves under real enterprise conditions. It also examines the challenges and considerations that IT organizations will face as we enter an era where AI agents have access to unstructured data to complete workflows.

Chapter 1: Understanding Work IQ

Providing deeper insights through the power of context

Before we can fully explore the implications of Work IQ, it’s important to start with a clear understanding of what it is.

Work IQ is not a new application or service that users interact with directly. Rather, it’s a shared intelligence layer that continuously interprets work happening across the tenant. Understanding this distinction is critical, because it explains why Work IQ shows up everywhere Microsoft 365 Copilot works—and why it must be treated as foundational infrastructure, not as optional, add‑on functionality.

“It’s not really a brand-new capability, but more an evolution of what users already know, which is access to the grounding data in their Microsoft tenant,” says Aisha Hasan, a principal product manager in Microsoft Digital. “The difference is that Work IQ adds an additional layer to provide more context, allowing for richer and more relevant results.”

Work IQ is built on three layers:

• Data: It unifies signals from files, emails, meetings, chats, and business systems.
• Memory: It builds persistent understanding of how people and teams work.
• Inference: It combines models, skills, and tools to reason and act.

At a high level, Work IQ consists of the systems that collect and interpret signals from everyday work. These signals come from many familiar Microsoft 365 applications—Word, Outlook, PowerPoint, Teams, SharePoint, and more—as well as structured data sources (such as those contained in Power Apps and Dynamics 365 resources).

The fact that Work IQ unifies unstructured and structured data into a shared ontology is a key differentiator from traditional search tools. This combination, referred to as semantic unification, means that it can combine the authoritative data contained in structured sources with the intent, nuance, and narrative found in unstructured data.

Work IQ draws from a broad range of work data from your Microsoft tenant. The unstructured data includes:

• SharePoint sites, files, and other content
• OneDrive activity that reflects individual work and collaboration patterns
• Teams content, including chats, channels, and meeting data
• Outlook emails and attachments

In addition, calendar signals—such as meeting participation, recency, and frequency—add time-based context that helps Work IQ understand priority and relevance of different data. This is what it means to go beyond simple information retrieval.

When all these are combined, it provides rich context that allows Work IQ to reason across all our employees’ work in a way that would be impossible if each signal were evaluated independently.

In practice, this means that when an employee asks a question about a current work project in Copilot, the tool’s response is not simply informed by the model’s capabilities or general source material. Responses are shaped by Work IQ’s understanding of the employee’s role, recent work, collaboration patterns (who they work with), and the larger enterprise context and conversations surrounding the question.

How our employees interact with and understand Work IQ depends on their role in the organization.

Our personas and their relationship with Work IQ

End user

Gains richer, context-aware agent conversations

IT admin

Enables and governs Work IQ access

Agent builder

Manages data connectors quickly and easily

Security professional

Knows that sensitive data stays protected with Work IQ

AI agents using Work IQ behave similarly. They use the intelligence to ground their reasoning in real organizational data, ensuring that their actions and recommendations are aligned with how work is happening inside the tenant. Although there are differences in how they are configured, all agents in a Microsoft tenant can be set up to take advantage of the power of Work IQ.

The impact of Work IQ on our company has been dramatic—we’re seeing agentic responses and actions that go deeper than surface-level answers. Our ability to reason over both our structured and unstructured data is producing richer, more nuanced contextual results that are boosting our productivity.

As your organization assesses your level of AI readiness, think of Work IQ not as an abstract concept but as critical infrastructure. It’s the key to connecting enterprise knowledge, trust, and productivity in a single, shared foundation.

Work IQ versus Microsoft Graph

Work IQ does not replace what we call the Microsoft Graph, the general term for unified, API-enabling, secure, permission-aware access to Microsoft 365 data, insights, and services. While the Microsoft Graph provides our employees with access to all their work data, Work IQ turns those signals into meaningful context that AI can reason over. In other words, Graph answers the general question “what info exists,” while Work IQ interprets what that information means and weaves it into responses to make them better.

Key takeaways

As you prepare for Work IQ, these points can help frame how to think about its role in your organization:

• Work IQ is foundational infrastructure, not a user-facing feature. It operates as a shared intelligence layer across the tenant, continuously interpreting signals from everyday work.
• Work IQ draws its power from context, not isolated data. By combining signals from email, meetings, documents, calendars, and collaboration patterns, it enables Copilot and agents to reason about work in a way that goes beyond simple search or retrieval.
• Better agentic outcomes depend on Work IQ being in place. When agents and Copilot are grounded in Work IQ, their responses and actions align more closely with real enterprise work, delivering better relevance and measurable productivity gains.

Learn more

How we did it at Microsoft

• Discover how Work IQ is supercharging our AI usage at Microsoft. This post delves into the ways that Work IQ is boosting agentic response and changing the way we work at the company.  
• See how we’re embracing this agentic moment at Microsoft. This story covers how we use the power of Copilot and AI agents to boost employee productivity.
• Explore our IT playbook for the AI era and learn how we’re becoming a Frontier Firm. This article shares our journey as an IT organization toward the AI-powered future.

Further guidance for you

• Learn more about Work IQ with this post from the Microsoft 365 Copilot Blog.
• Check out this Microsoft Learn overview of the different Work IQ agent tools.
• Read all about the Microsoft Graph on the Microsoft Learn site.

Chapter 2: Establishing trust: How we govern Work IQ

Building on an existing foundation of solid governance and security

Like all Microsoft products, Work IQ was built with security foremost in mind. As the IT team at Microsoft, it is our responsibility to work in tandem with the product groups to ensure that all data that Work IQ has access to is well governed and secure.

The fact that Work IQ does not introduce new data into Microsoft 365 makes meeting this commitment easier. Embedded directly into the Microsoft 365 intelligence stack, Work IQ inherits the same compliance, security, and access controls that already govern the tenant.

“With great power comes great responsibility, and it’s up to your IT team to think about what it means to give your users full access to all this Work IQ data. It can greatly accelerate what people can build and what they can do.”

David Johnson, principal PM architect, Microsoft Digital

For Microsoft 365 Copilot–native agents, Work IQ is enabled to provide governed, context‑aware access to Microsoft 365 work data without requiring developers to build or manage individual data connectors.

As our governance experts note, this represents an inherent trade-off. Giving an agent access only to certain isolated data types reduces risk but also limits its value. Granting access through Work IQ means an agent can reason across everything the employee can access. This simplifies enablement but also requires stronger confidence in governance foundations.

Microsoft 365 intelligence stack

As our governance experts note, this represents an inherent trade-off. Giving an agent only access to certain isolated data types limits risk, but it also limits its value. Granting access through Work IQ means an agent can reason across everything the employee can access. This simplifies enablement but also requires stronger confidence in governance foundations.

“With great power comes great responsibility, and it’s up to your IT team to think about what it means to give your users full access to all this Work IQ data,” says David Johnson, a principal PM architect in Microsoft Digital. “It can greatly accelerate what people can build and what they can do. At the same time, organizations will want to think about the downstream implications of access.”

Exposing underlying governance issues

Our overall solution was to anchor Work IQ to our governance and security policies that already existed for our data. Sensitivity labels, data protection rules, and data-loss prevention policies remain the primary guardrails, as they do for all data across our enterprise. All these controls live at the data layer.

A critical aspect of this governance model is how sensitivity labels propagate through Work IQ experiences. In Microsoft 365, the label that is applied to a source document determines the label of any derived outputs, including summaries, insights, or AI-generated responses. This ensures that users have immediate context about the information’s sensitivity and how it should be handled. The label effectively travels with the data, reinforcing both user awareness and policy enforcement.

Labels also play a key role in controlling access beyond simple permissions. Even if a user has baseline access to a location, sensitivity labels can further restrict whether content can be extracted, shared, or surfaced through AI experiences. In some cases, organizations can configure policies so that content with specific labels is not returned at all in Work IQ or Copilot responses. This gives IT teams an additional layer of control to prevent exposure of particularly sensitive information.

These labeling principles extend across collaboration scenarios as well. For example, meeting labels determine the classification of all downstream artifacts—including recordings, transcripts, and notes. Sensitive discussions remain governed consistently, even as Work IQ helps make them more discoverable and actionable.

For example, even with Work IQ enabled, a document labeled Highly Confidential cannot be exposed through Copilot to someone without access, even if it is referenced in a Teams meeting transcript or included in an AI-generated summary. Copilot may understand that the document played a role in a particular decision, but it cannot extract or reveal its contents beyond what permissions allow.

This distinction—discoverable versus extractable—proved critical in our deployment of Work IQ. The intelligence layer makes data relationships visible, but it does not override protection. In one internal scenario, a sensitive document was found to be accessible through a Copilot query. The root cause was not Work IQ, but a missing sensitivity label—the AI tool simply honored what governance allowed. We treated the incident as a governance signal and corrected labeling at the source.

Remember that Work IQ can only access data that:

• Exists inside your Microsoft 365 tenant or is explicitly connected via approved connectors
• The current user already has permission to access
• Is allowed by tenant‑level admin policy, compliance, and sensitivity controls

The security and governance considerations also extend to how new agents are released across our enterprise. For example, an agent created for use within one internal team has lighter governance controls than one that is published to our internal Microsoft agent portal, which offers companywide access. The latter requires additional review, approval, and monitoring as part of our due diligence for governance and security.

Ultimately, Work IQ adheres to all of the security and governance policies and procedures in our tenant, preserving the trust that our security-first approach creates and maintains.

Key takeaways

The following are important considerations for data governance and security when you consider adopting Work IQ for your organization:

• With Work IQ, governance and security are top-line priorities. We made sure that Work IQ would always inherit the same compliance, access controls, and data protection policies that already govern Microsoft 365 data.
• Work IQ doesn’t introduce new data access—it changes how existing access functions. By packaging tenant data into a single intelligence layer, it facilitates easier agent builder access to the data you already have in your Microsoft 365 tenant.
• The distinction between discoverable and extractable data is central to safe AI deployment. Copilot and other agents can understand how work information is connected and referenced without exposing protected content beyond existing permissions.
• IT admins and leaders should consider the ramifications to their tenant. Work IQ makes agents more powerful and context-aware by opening up access to vast quantities of Microsoft 365 data, but IT professionals should always think through downstream effects on data security and governance.
• Work IQ surfaces governance gaps instead of masking them. When issues arise—such as misapplied sensitivity labels—the solution is not to restrict intelligence, but to strengthen data governance at the source.

Learn more

How we did it at Microsoft

• See how we’re governing AI agents at scale internally. This readiness guide explains how we approach security and compliance for AI agents at Microsoft.
• Read about our experience tackling Microsoft 365 Copilot governance. This guide details our internal governance efforts for Microsoft 365 Copilot as we rolled the tool out across our organization.
• Explore how we’re powering data governance at Microsoft with Purview Unified Catalog. This story explains how Purview is helping us redefine our internal approach to data governance.

Further guidance for you

• Learn more about governance and security for AI agents and find out how to keep your AI initiatives secure.

Chapter 3: How our employees experience Work IQ day to day

Transforming the way work happens at Microsoft

To understand how Work IQ shows up and impacts the workflows of people across our organization, we spoke to several Microsoft employees. They explained how Work IQ makes a difference in the results they’re getting from Copilot and other agentic AI tools and how the intelligence is supercharging their work.

Work IQ in Outlook    

Outlook email and calendars are the space where many of our employees feel the heaviest cognitive load of their day‑to‑day work. It’s also where Work IQ is surfacing some of the most innovative ways to help employees accomplish more.

“You open your Outlook in the morning and Copilot—by drawing on Work IQ context and through features like priority scoring and summarization—can help you see which messages need your attention first.”

Matthew Marzynski, principal product manager, core experiences, Microsoft Digital

Rather than treating messages and meetings as isolated items, Work IQ allows Copilot in Outlook to reason across email signals, conversation history, meeting patterns, and calendar behavior to deliver responses that reflect how work actually unfolds.

This means Copilot goes beyond keywords or unread status indicators to determine importance. Through Work IQ, it understands the context of each conversation—which threads are more urgent and relevant to your work and which are less vital.

“You open your Outlook in the morning and Copilot—by drawing on Work IQ context and through features like priority scoring and summarization—can help you see which messages need your attention first,” says Matthew Marzynski, a principal product manager for core experiences in Microsoft Digital. “Copilot is now beginning to offer proactive nudges to help you stay on top of what matters, surfacing what’s changed and what you need to focus on.”

The deeper context also aids Outlook in generating rich summaries of lengthy threads, which can highlight owners, decisions made, and next steps. This allows employees who are added to the thread or who have been away to quickly catch up on complex conversations without manually digging through seemingly endless past messages or related documents.

Marzynski frames Work IQ as an invisible intelligence layer that quietly reshapes how Outlook behaves over time. His core thesis is simple: Users never have to think about Work IQ; they just observe that Outlook is more helpful than before, and that their work gets easier.

“There are no complex commands to learn or rules to create. The intelligence works behind the scenes as you use Outlook,” he says. “Your inbox just gradually feels more relevant. Outlook adapts to how you work, rather than the reverse, and becomes more like an assistant instead of a filing cabinet of communications.”

Work IQ in Teams + Researcher Agent

Another immediate and tangible way our employees experience Work IQ is in Microsoft Teams meetings. The value begins the moment a meeting is recorded. Transcripts, speaker contributions, shared content, and AI‑generated summaries are automatically captured and folded into the attendees’ ongoing work context—without requiring manual note‑taking or follow‑up documentation.

Ray Peer is a senior product manager in Microsoft Digital who observed the power of Work IQ in a recent project he completed with our internal legal team. According to Peer, the team was struggling to find specific content in their data lake, which contains tens of thousands of documents, articles, and other content items.

“Based just on what people shared in that meeting, and what it knows about their work and about SIPOC diagrams, Researcher was able to generate a fully formed, detailed solution for me. That’s the intelligence layer at work.”

Ray Peer, senior product manager, Microsoft Digital

So, he facilitated a Teams meeting for a free-form process‑mapping discussion with a few members of Microsoft Legal. Days later, he put the meeting transcript into the Copilot Researcher agent and asked it to generate a structured SIPOC (Suppliers, Inputs, Process, Outputs, Customers) diagram and accompanying documentation.

He was amazed by the results.

“Based just on what people shared in that meeting, and what it knows about their work and about SIPOC diagrams, Researcher was able to generate a fully formed, detailed solution for me,” Peer says. “That’s the intelligence layer at work. It reasoned over what we said—there were no visuals shared or anything—and it came up with something that I could cut and paste into the final format. I used to have to do that manually, and it took hours.”

Work IQ connected the meeting transcript to the people involved, the SharePoint sites they used, and similar work done elsewhere in the organization. Copilot was able reason across different tools and unstructured data, rather than just treating the meeting transcript as a static artifact.

Note that this works differently from third‑party meeting tools, because the data never leaves the tenant. Work IQ treats Teams meetings as part of a continuous Microsoft 365 workstream—honoring permissions and sensitivity labels throughout—so conversations can become durable inputs for future work without adding risk or effort for employees.

Work IQ in SharePoint

In SharePoint, Work IQ is helping employees create, organize, and publish content by drawing on the rich context of their Microsoft 365 data. Rather than starting from a blank page or text block, content development is sped up as Copilot draws on their relationships, collaboration history, and metadata to help produce sites and documents.

“Copilot will recommend text changes, but also layout suggestions, image and graphic options, and other helpful assistance. It makes it easy to create more compelling content, more rapidly.”

Sam Crewdson, principal product manager, Microsoft Digital

For example, when you ask Copilot to create a new section in a SharePoint site—such as a project overview, status update, or other material—Work IQ enables the tool to look deeper than the prompt itself. When generating the content, it can draw on documents you’ve recently edited, your emails and Teams conversations, and related work happening across the organization. The output you get from Copilot is highly relevant and grounded in real work.

Sam Crewdson is a principal product manager at Microsoft Digital who has been a part of the SharePoint team for more than two decades. He’s excited about what Work IQ is enabling users to accomplish in the product using Copilot, as well as other agentic tools like Knowledge Agent (a domain-specific agent that can drill down on SharePoint sites and libraries).

“Copilot in SharePoint is now able to not only help you produce better written content, it’ll also offer more contextual and visual help,” Crewdson says. “Copilot will recommend text changes, but also layout suggestions, image and graphic options, and other helpful assistance. It makes it easy to create more compelling content, more rapidly.”

Another emerging scenario Crewdson described is conversational agentic authoring in SharePoint. In these workflows, employees refine their SharePoint pages by interacting directly with an agent—asking it to add sections, adjust tone, or suggest visuals. Over time, these agents will reduce repetitive setup steps and help teams move from draft to publish faster.

Across these experiences, Work IQ is helping shift SharePoint from a manual content creation tool to an application where agents automate everyday content tasks based on your overall work context and related Microsoft 365 data.

Key takeaways

Here are some things to remember when thinking about how Work IQ can impact your employee workflows:

• Work IQ reduces cognitive load in Outlook by understanding work context. By recognizing decision‑driven threads, collaboration patterns, and urgency over time, Copilot helps employees focus on what truly needs their attention without relying on manual rules or keyword searching.
• Email and calendar intelligence improves prioritization, summaries, and follow‑through. Work IQ allows Copilot to highlight owners, decisions, and next steps in long threads and nudge users toward timely action, based on how they typically work with colleagues.
• Teams meetings become durable inputs for future work when powered by Work IQ. Copilot and the Researcher agent can reason across meeting content, people, and related SharePoint work—creating structured outputs while honoring tenant security and permissions.
• Work IQ helps Copilot speed up and enrich content creation in SharePoint. By drawing on Microsoft 365 data, Copilot can generate more relevant content for your SharePoint sites and offer helpful layout and graphics suggestions that accelerate the site development process.

Learn more

How we did it at Microsoft

• See how to pick the right Copilot for the job. This post explores different Copilot agents and modules and discusses how to choose the correct one for your task.
• Discover how we deployed Copilot internally at Microsoft. This step-by-step guide breaks down the deployment and adoption process we followed to roll out this groundbreaking technology across our entire organization.
• Find out how we’re using AI to redefine work in Outlook. This blog post explores the latest AI features that our employees are using to work smarter in Microsoft Outlook.
• Learn five ways we’re getting more out of Teams in the era of Copilot and AI. This article details different Teams features that take advantage of the latest in AI technology.
• Read about the lessons learned using SharePoint agents at Microsoft. This post covers some of the insights gleaned through our deployment of different SharePoint agents.

Further guidance for you

• Check out the Microsoft Copilot Success Kit and learn how to accelerate your Copilot implementation with templates, onboarding guides, and technical readiness resources.
• Explore the company’s essential guide to Copilot adoption for practical steps to onboard, engage, and measure impact in your organization.

Chapter 4: Work IQ beyond Microsoft 365

Integrating Work IQ across the enterprise

As organizations adopt Copilot and other AI agents at scale, the question arises: How does Work IQ show up in different contexts? Is it something that only impacts your work in Microsoft 365 applications, or does it also play a role in external applications and other areas of your IT enterprise?

Based on our experience here at Microsoft, the answer is that Work IQ shows up differently depending on where it’s consumed, and those differences matter for admins, agent developers, and other IT professionals.

For most of our employees, Work IQ operates entirely behind the scenes inside Microsoft 365. It is not something users configure, enable, or interact with directly. By reasoning over your entire Microsoft 365 data graph, Work IQ improves the results that Copilot generates in apps like Outlook, Teams, Word, SharePoint, Copilot Chat, and GitHub Copilot.

In this mode, Work IQ is:

Built directly into the Microsoft 365 intelligence stack

Governed by existing permissions, sensitivity labels, and compliance policies

Invisible to users, with no new controls or UI to manage

Continuously learning from signals across emails, meetings, and files

You don’t “implement” Work IQ—it’s already present in first-party Microsoft products by default. If you have enabled Copilot, you are getting the benefits of Work IQ across all of these applications. 

Similarly, any agents you build for Microsoft 365 apps (such as using Agent Builder in Microsoft 365 Copilot) are scoped for use specifically in these apps, rather than outside of them. These agents do not require separate connectors, such as APIs or Model Context Protocol (MCP) servers, to access Work IQ. In fact, Work IQ MCP is a great tool to make your context ubiquitous to whichever agentic experience can be imagined.

Extending Work IQ beyond Microsoft 365: explicit by design

Implementation works somewhat differently outside of native Microsoft 365 experiences. When it comes to custom agents, line‑of‑business applications, or Azure‑hosted solutions, Work IQ does not show up automatically. In these contexts, it is intentionally enabled by our builders and governed by our administrators.

In these scenarios:

• Developers access Work IQ through APIs or MCP servers
• Admins explicitly control which capabilities are enabled or disabled
• Work IQ provides rich enterprise context without duplicating data
• Permissions and governance remain enforced at the tenant level

For us, this design is deliberate and has advantages. Rather than asking our developers to configure dozens of individual connectors for mail, calendars, files, and meetings, Work IQ offers them a single-entry point for enterprise context. Builder tools like Microsoft Foundry and Copilot Studio allow our teams to take the same Work IQ intelligence that Copilot uses and apply it to workflows that live outside Microsoft 365. Examples include automating newsletters, generating insights for account teams, or powering custom agents to handle specific scenarios.

The key distinction is accountability. Inside Microsoft 365, Work IQ is ambient. Outside it, Work IQ is a conscious architectural choice, one that requires actions upfront to enable.

Work IQ does not “open up new data” when used externally. It ports intelligence, not raw access, applying the same rules no matter where it’s consumed. At the same time, it gives organizations flexibility to decide when and how far that intelligence should travel.

This continuum—from implicit use inside Microsoft 365 to explicit use beyond it—also clarifies our roles:

• Our end users benefit without needing to learn anything new
• Our IT teams retain centralized control at the tenant level
• Our builders gain a faster path to context‑aware solutions

Work IQ works best when treated as a shared intelligence foundation, not a feature toggle. It is present by default where trust is already established, and it can be incorporated deliberately where your organizational requirements or innovation needs demand more reach.

Model Context Protocol servers and Work IQ

For organizations that move beyond native Microsoft 365 experiences and begin building custom agents, Model Context Protocol (MCP) servers are the primary mechanism for connecting those agents to Work IQ. While Work IQ is always available inside Copilot, MCP servers are what make much of that same intelligence accessible to agent builders.

At a high level, MCP servers are an open-standard technology (not proprietary to Microsoft) that act as governed tool interfaces to enterprise context. Each Work IQ MCP server represents a scoped slice of Microsoft 365 signals—such as email, calendar, Teams activity, or SharePoint content—and exposes them in a form that agents can reason over. Rather than wiring individual connectors or APIs for each workload, builders can rely on MCP servers to assemble relevant context automatically, while still honoring permissions, sensitivity labels, and tenant policies.

When we’re building agents, Work IQ becomes explicit, and MCP servers are how our builders declare their intent. This includes determining which types of enterprise context the agent needs, how broadly it should reason across work signals, and where governance boundaries apply.

From an IT perspective, MCP servers also provide a critical control point. Our administrators decide which Work IQ MCP servers are enabled in the tenant and which of our builders are allowed to use them. This ensures that extending intelligence beyond Microsoft 365 remains a deliberate choice rather than an accidental one.

Using these servers to connect with your enterprise data also represents real—but manageable—risk. They make existing permissions more actionable, which can amplify the impact of overshared content or weak data hygiene. The best practice is to treat these servers as governed infrastructure: enable them selectively at the tenant level, start with the minimum set required for defined agent scenarios, restrict usage to approved builders, and pair expansion with regular permission reviews and labeling discipline.

Your readiness plan should be to ensure that governance is in place, then selectively enable MCP servers where agents require deeper context. The servers are the bridge that lets agent builders tap into Work IQ safely, allowing you to bring enterprise intelligence into custom solutions without breaking the trust model that makes Copilot effective at scale.

Key takeaways

Here are some things to remember when thinking about how Work IQ shows up across your organization—especially if you plan to extend this intelligence into custom agents and applications:

• Work IQ is foundational inside Microsoft 365 and intentional outside it. Within Copilot experiences, Work IQ operates implicitly, while custom agents introduce a conscious decision to consume that intelligence through MCP servers.
• Governance principles don’t change when extending Work IQ, but they become more visible. MCP servers enforce existing permissions, labels, and tenant policies, making it critical that governance foundations are solid before agents rely on deeper context.
• Agent builders declare intent through MCP server selection. Choosing which Work IQ MCP servers to use defines what enterprise signals an agent can reason over and how broadly it reflects real work patterns.
• Preparing to extend Work IQ beyond Microsoft 365 is about readiness. Organizations that are already ready for Copilot can selectively enable MCP servers to unlock richer agent scenarios without introducing new security or compliance risk.

Learn more

How we did it at Microsoft

• Learn how we’re shaping AI management at Microsoft with Agent 365. This post discusses how we use the Agent 365 control plane to govern Microsoft 365 Copilot and agents internally.
• Read our complete guide to deploying AI agents internally at Microsoft. This Inside Track readiness guide covers all aspects of how we’ve implemented agentic AI across our organization.
• Discover how we’re unlocking enterprise AI extensibility with Copilot Studio. This story explores how we govern more advanced agents built with Copilot Studio, including connectors, orchestration, and scaled governance.
• Check out how we’re protecting AI conversations at Microsoft with Model Context Protocol security and governance. This article delves into MCP governance through secure-by-default architecture, automation, and inventory for faster, safer agent development.

Further guidance for you

• Read this Work IQ MCP overview on the Microsoft Learn site to find out more about how agents connect using Model Context Protocol servers.
• See the Work IQ Copilot reference on the Agent 365 Microsoft Learn site for further technical detail.

Chapter 5: Working with Work IQ: The Customer Zero impact

Change management lessons from our experience with an ambient intelligence layer

Work IQ wasn’t rolled out across our organization as an abstract platform decision or deployment milestone. Its development has been one aspect of our overall transformation into an AI-first Frontier Firm.

Along the way, Work IQ has been shaped by our long‑standing Customer Zero mission at Microsoft Digital: Using our own products at enterprise scale first, learning directly from how employees experienced it, and allowing those lessons to shape how the technology is refined and extended to customers.

In our tenant, Work IQ benefits emerged gradually through incremental improvements to relevance, context, and intelligence across Microsoft 365. These gains were driven by advances in AI that made it possible to interpret everyday work signals more effectively.

There was no formal product implementation or adoption campaign when we launched Work IQ at Microsoft. As ambient infrastructure, Work IQ is an unseen part of all employee workstreams—nearly every experience benefits from it. At the same time, the power of Work IQ depends on everyone in our organization being effective stewards of their own unstructured data, preserving security, governance, and relevance.

Enablement and adoption

To fully realize the value of Work IQ, we have found that organizations must invest in the foundational behaviors that make their organizational knowledge accessible. One of the key steps in this effort is enabling and encouraging the use of meeting transcripts. Work IQ depends on the artifacts of daily work to build context, and without transcripts, a significant portion of meeting insights and decisions remain inaccessible to the intelligence layer.

Making transcription a standard part of our employees’ everyday collaboration proved essential. Transcripts create a durable, searchable record that Work IQ can connect to documents and actions, helping employees quickly understand what happened, even if they weren’t present. When paired with existing governance controls like sensitivity and meeting labels, organizations can capture this data securely while unlocking great value from this collective knowledge.

This is actually a cultural shift.

We gave our teams clear guidance and encouraged meeting transcription as part of their normal workflow. When paired with the enhancements to meeting recaps in Microsoft Teams, this becomes a powerful tool for preserving and leveraging organizational knowledge.

Of course, Copilot adoption and training efforts were also a vital part of our getting the most from Work IQ. Our employees needed demonstrations of all the things that Copilot could help them accomplish, along with encouragement to jump in and try it out for themselves. Our data shows that internal AI usage has grown significantly over time—from a few thousand users to hundreds of thousands across the company—in large part due to:

• Employee-driven champions programs
• Scenario‑based learning efforts
• Timely and consistent internal communications

Usage also grew internally as our product teams continually refined our AI tools, aided by our collection of user feedback on agentic answers to identify low-quality output and irrelevant detail.

Another major insight we captured was the importance of persistent memory to the Copilot and Work IQ experience. Through our work as Customer Zero, we collected a large volume of feedback from employees indicating that this was a priority—users should not have to repeatedly explain who they are or what they are working on.

The experience was subsequently improved, and Work IQ now helps enable Copilot to remember user history and tailor responses accordingly—delivering summaries for communicators and deeper technical detail for engineers, for example.

Our Customer Zero efforts also validated a critical governance principle for us. As intelligence improved, some teams were surprised by how much context Copilot could surface. In every case, investigation showed that the underlying data access already existed. Work IQ did not change permissions or expose new data—it made existing relationships more visible. This reinforced the importance of strong data hygiene, sensitivity labeling, and permission management as prerequisites for trusted intelligence.

Ultimately, our work as the company’s Customer Zero validated that Work IQ is best understood as shared infrastructure. Its value compounds when organizations focus on readiness—governance, learning, and trust—and allow intelligence to scale naturally across work, rather than treating it as a feature to deploy.

When these conditions are in place, Work IQ quietly raises the quality of Copilot and agent experiences without adding complexity for users or additional burden for IT.

Key takeaways

As you consider how Work IQ might take shape in your own organization, consider these observations from Microsoft Digital’s Customer Zero experiences with this new intelligence layer:

• Meeting transcription is the key. Making sure all meetings are transcribed is essential for Work IQ, so it can build context on how work happens in your organization. This is a technical and cultural change that you need to facilitate and encourage.
• Awareness and learning are keys to usage and feedback. Our internal Copilot adoption grew when employees were shown practical scenarios and encouraged to experiment, supported by champions programs and ongoing internal communication.
• Change management drives results. Use employee champions, role-based immersive learning, and timely internal communications to help your employees understand what Work IQ is and how it can help your enterprise maximize the value of AI.
• Treating Work IQ as shared infrastructure unlocks compound value. When governance, learning, and trust were in place, intelligence could reason across all our rich unstructured data —improving Copilot and agent experiences without adding additional work for users or IT.

Learn more

How we did it at Microsoft

• Read about how we serve as Customer Zero in an AI-powered world. This story describes how Microsoft Digital’s role as Customer Zero has grown and evolved as we move into the Frontier Firm era.
• How to pick the right Copilot for the job. This post explores different Copilot agents and modules and discusses how to choose the correct one for your task.
• Recapping our meetings with Microsoft Teams Premium. This Inside Track story explains how Intelligent Recaps have changed the game when it comes to getting the most out of meetings at Microsoft.

Further guidance for you

• Check out the Microsoft Copilot Success Kit and learn how to accelerate your Copilot implementation with templates, onboarding guides, and technical readiness resources.

Where we’re heading: Work IQ, Fabric IQ, and Foundry IQ

Combining different layers of intelligence to transform the workplace

While impactful on its own, Work IQ is just part of larger story of how we’re using the power of rich data and agentic AI to transform how we work at Microsoft.

“While Work IQ can access your Microsoft 365 data, Fabric IQ will connect to your organizational data, such as analytics. Foundry IQ can leverage both, plus other domain data, to help developers build powerful agentic solutions.”

Naveen Jangir, principal architect, Microsoft Digital

Work IQ is one layer. It allows our AI tools to reason over unstructured data so this powerful resource can be a part of our larger enterprise intelligence system. But it also includes two other aspects of this three-layer system—Fabric IQ and Foundry IQ. Combined, these three capabilities enable organizations to take full advantage of your knowledge estate to forge the AI-powered workplace of the future.

“While Work IQ can access your Microsoft 365 data, Fabric IQ will connect to your organizational data, such as analytics,” says Naveen Jangir, a principal architect in Microsoft Digital. “Foundry IQ can leverage both, plus other domain data, to help developers build powerful agentic solutions.”

Here’s how these capabilities work together in complementary roles to impact how work gets done at Microsoft:

• Work IQ handles unstructured data—like documents, emails, PDFs, and web content—by extracting meaning and context from human language.
• Fabric IQ operates over structured data—like tables, databases, metrics, events, and transactions—to bring consistency and analytic rigor to our work.
• Foundry IQ provides the knowledge-grounding layer, where entities, relationships, and ontologies allow reasoning to stay aligned with enterprise truth.

While each component is powerful on its own, the deeper value is what becomes possible when they are used together.

The intent is to enable agents that can reason across all enterprise knowledge, regardless of where it originated or how it was stored. An agent should be able to read a policy, connect it to operational data, understand who and what is involved, explain its conclusions, and take an action (if desired) through a shared ontology based on organizational context.

That kind of capability can’t emerge just from information retrieval. It requires shared meaning across systems, content, and data types.

This is where the role of Work IQ becomes especially important. We have found that unstructured data contains some of the most critical institutional knowledge an organization has, but it rarely arrives in a form that is ready to be reasoned over. Documents reference people, systems, processes, and timelines in ways that make sense to humans, but not to machines. They can also fall out of date or represent a draft state that was never meant to be presented as verified information.

Work IQ bridges this gap by transforming the raw text into structured understanding, without stripping away nuance.

“Work IQ is already helping us change the way that work gets done. Instead of hunting for information or stitching context together manually, our employees can focus on decisions, creativity, and outcomes—because the intelligence is already there, working with them every day. It’s an integral part of preparing our organization for our agentic AI future.”

Vijaya Alaparthi, principal group product manager, Microsoft Digital

The crucial mechanism for that transformation is entity extraction, paired with a shared ontology. When a document mentions an employee, a system, a regulation, or a product, Work IQ identifies that reference as something concrete and reusable. Over time, those entities become the connective tissue between unstructured content, structured records in Fabric IQ, and the semantic backbone that Foundry IQ relies on to ground reasoning in the agents we create.

We can already see signs of this promised future at Microsoft today. Take a tool like our Employee Self-Service Agent, which we launched late last year. What before was a collection of static HR documents becomes a living knowledge system: policies are parsed, roles and eligibility criteria are extracted, and guidance is grounded in an understanding of employee role and location. The agent can answer a question and explain why the answer applies, because it understands both the document and the organizational context behind it.

This is why Work IQ is such a strategic capability. Improving document quality, normalizing metadata, resolving entities, and establishing governance are not one-off hygiene tasks. They expand what future agents will be able to do safely and reliably. The more coherent your unstructured data becomes, the less guesswork agents must do and the more context they can absorb.

“Work IQ is already helping us change the way that work gets done,” says Vijaya Alaparthi, a principal group product manager in Microsoft Digital. “Instead of hunting for information or stitching context together manually, our employees can focus on decisions, creativity, and outcomes—because the intelligence is already there, working with them every day. It’s an integral part of preparing our organization for our agentic AI future.”

For us, the direction forward is clear. The better your data foundation, the more capable—and trustworthy—your agents become. As unstructured and structured knowledge converges, intelligence stops being a set of isolated features and becomes a system.

Organizations that invest in technology like Work IQ to harness their unstructured data as enterprise knowledge are the ones that will deploy the most capable agents going forward and will be best positioned to take advantage of the agentic future.

Key takeaways

If you want your organization to be able to use Work IQ to propel your own agentic transformation, consider what we’ve learned on our journey:

• Work IQ transforms unstructured enterprise data into actionable intelligence. By reasoning over emails, documents, meetings, and chats, it unlocks institutional knowledge that was previously fragmented and underused.
• The intelligence operates as foundational infrastructure, not a user-facing feature. Work IQ runs continuously behind the scenes across Microsoft 365, improving Copilot and agent responses wherever they appear without configuration.
• Context is what makes Copilot feel truly intelligent. By combining signals from collaboration patterns, conversations, documents, and more, Work IQ enables agents to respond based on how work actually happens, not just what information can be retrieved.
• Security and governance remain intact because Work IQ inherits existing controls. It doesn’t create new access to data; it reveals relationships while fully honoring permissions, sensitivity labels, and compliance policies.
• Employees experience Work IQ as reduced cognitive load, not added complexity. Inbox relevance, richer summaries, and clearer follow-through improve naturally over time.
• Using Work IQ beyond Microsoft 365 is a deliberate, governed choice. MCP servers allow builders to bring enterprise context into custom agents while giving IT teams clear control over scope, access, and risk.
• Work IQ is the foundation for the next generation of agentic intelligence, especially when combined with Fabric IQ and Foundry IQ. The more coherent and well-governed your unstructured data is today, the more capable, explainable, and trustworthy your future agents will become.

Learn more

• Explore how Work IQ is helping supercharge AI usage at Microsoft.
• Discover our chapter-by-chapter internal deployment guide for Microsoft 365 Copilot.
• Check out how we’re embracing this agentic moment at Microsoft.
• Dive into a Microsoft Learn overview of different Work IQ agent tools.
• Read an IT playbook for the AI era and learn how we’re becoming a Frontier Firm at Microsoft.
• See how we’re using Model Context Protocol security and governance to protect AI conversations at Microsoft.
• Learn about our experience governing AI agents at scale in this readiness guide.
• Find out how we’re unlocking enterprise AI extensibility with Copilot Studio.

Try it out

Get a closer look at Work IQ.

The post Intelligence on tap: How Work IQ enables AI and agents at Microsoft appeared first on Inside Track Blog.

In an always-on business environment, even routine collaboration can be overwhelming. But in an environment of Frontier Transformation, this challenge represents an opportunity for AI.

Our employees don’t need to handle all their work alone anymore, because agents can now extend their responsiveness and reach. Here in Microsoft Digital, the company’s IT organization, one of those AI agents is acting as a digital twin for just that purpose. It’s called DigitalMe, a personal virtual proxy designed to keep work moving when our employees are busy with other tasks.

Always-on knowledge without always-on employees

Large meetings generate a constant stream of questions, side conversations, and follow-up items. They’re often more than a single presenter or moderator can manage in real time. Important insights get buried in chat threads, queries go unanswered, and valuable momentum gets lost.

For our teams at Microsoft, this challenge became especially visible during large-scale readiness sessions, where subject matter experts found themselves inundated with requests for clarification and guidance.

“In order for our transformation into a Frontier Firm to be successful, we need to step back and ask what works well for employees, what doesn’t work well, and where agents can help.”

Stephan Kerametlian, senior director, Microsoft Digital

That’s not the only place where employees can use an extra hand. When people are out of the office, that doesn’t mean work stops. Their coworkers often need access to their colleagues’ knowledge to move mission-critical work forward, even when they’re not reachable.

“In order for our transformation into a Frontier Firm to be successful, we need to step back and ask what works well for employees, what doesn’t work well, and where agents can help,” says Stephan Kerametlian, a senior director in Microsoft Digital. “We’re crossing the horizon into human-led, agent-operated patterns of work.”

One team in Microsoft Digital created DigitalMe to explore what that future could look like in practice.

Go deeper

Becoming a Frontier Firm: Our IT playbook for the AI era

DigitalMe: A personal digital twin for Microsoft employees

For the members of our Employee Experience Success team responsible for adoption efforts around Microsoft 365 Copilot and Microsoft Copilot Studio in the Greater China Region, readiness meetings were becoming unwieldy because of attendee questions.

“Our purpose was to use as little code and as much natural language as possible so people could modify their own personal DigitalMe easily. In Copilot Studio, you can manage agents as a solution. So users can just download and import a zip file, modify an agent like DigitalMe according to their business context and preferences, then use it.”

Ju Bu, business program manager, Microsoft Digital

The team wanted a way to focus on running the meeting while simultaneously providing their knowledge to participants. They decided to create an agent to help deal with the deluge of queries: DigitalMe.

At its core, DigitalMe is a personal, context-aware digital twin with versions that operate in both Microsoft Teams and Microsoft Outlook. It draws on the same knowledge bases and resources that its user can access, for example, SharePoint sites and Teams channels.

The team designed DigitalMe in Microsoft Copilot Studio and prioritized a low-code approach. At most, the creators used code to build 15–20% of the agent and accomplished the rest using natural language prompts.

“Our purpose was to use as little code and as much natural language as possible so people could modify their own personal DigitalMe easily,” says Ju Bu, a business program manager in Microsoft Digital. “In Copilot Studio, you can manage agents as a solution. So users can just download and import a zip file, modify an agent like DigitalMe according to their business context and preferences, then use it.”

Equipped with an employee’s full knowledge base, DigitalMe can respond in Outlook and Teams on its human counterpart’s behalf. To ensure transparency, a label appears at the beginning of each message indicating that it originates from the agent.

DigitalMe also reinforces context for the requester by including their original question in quotations. Finally, the agent @-mentions the recipient to notify them effectively.

The team identified two primary use cases for the agent:

• Moderating live sessions. In large meetings, DigitalMe acts as an always-on co-moderator, answering questions in real time using scoped, preloaded knowledge. By speaking for them in the meeting chat, it helps presenters stay focused while ensuring attendees receive timely, accurate responses. Surfacing information instantly enhances both the efficiency and quality of the session. DigitalMe has the added advantage of being able to pull from resources the presenter might not recall in the moment. Over time, the agent captures and reuses questions and answers, turning live engagement into a growing knowledge base.
• Extending employee availability. DigitalMe also provides a way for employees to remain responsive when they’re out of the office. It can monitor Teams chats or incoming emails, generate context-aware replies, and surface relevant knowledge for colleagues without human intervention. In practice, it’s proven especially valuable for teams distributed across widely different time zones and for handling project handoffs during onboarding or time-off scenarios.

A key advantage of DigitalMe is its ability to move beyond simple question-and-answer use cases. In some scenarios, it can also trigger workflows like creating tasks or capturing frequently asked questions.

“Our vision was that DigitalMe shouldn’t just be an assistant. It should function as our digital twin in the cyber world.”

Kai Cheng, program manager, Microsoft Digital

It was important to incorporate human-in-the-loop capabilities. When DigitalMe encounters gaps in its knowledge, it can flag those moments for follow-up, prompting users to refine and expand their knowledge sources. It represents another way that human-led, agent-operated processes continuously improve outcomes.

“Our vision was that DigitalMe shouldn’t just be an assistant,” says Kai Cheng, a program manager working in change management, digital transformation, and AI in Microsoft Digital. “It should function as our digital twin in the cyber world.”

In live sessions, DigitalMe has helped presenters stay focused while maintaining high levels of engagement, responsiveness, and support for participants. Employees are increasingly using it to bridge time zones, support knowledge transfer, and keep projects moving in their absence.

Extending the impact of DigitalMe

After seeing DigitalMe’s early success, our global readiness and adoption professionals identified the agent as an opportunity to turn individual innovation into a scalable capability. After templatizing the agent in collaboration with its original creators, we’ve now included it in our Agent Starter Kit. This resource makes it easy for employees to create their own personal versions of several useful agents.

“Employees often think building an agent might be complex and time-consuming, and that limits their willingness to try and turn their ideas into working solutions. But tools like this show them how easy it can be.”

Alexandra Jones, director of business programs, Microsoft Digital

Our Agent Starter Kit walks employees through importing a ready-made agent, connecting it to their knowledge sources, and adapting it to their specific workflows. This approach has shifted DigitalMe from a single solution into a repeatable pattern, helping employees across the company move from curiosity to hands-on adoption. We’ve also incorporated the Agent Starter Kit into our Agent Launchpad skilling program to accelerate our employees’ agentic expertise as part of a Frontier firm

There’s an added benefit as well. By getting tools like DigitalMe into people’s hands through templatized versions they can modify and configure themselves, we’re highlighting how easy it can be for even nontechnical workers to build agents themselves.

“Employees often think building an agent might be complex and time-consuming, and that limits their willingness to try and turn their ideas into working solutions,” says Alexandra Jones, director of business programs in Microsoft Digital. “But tools like this show them how easy it can be.”

For organizations that want to replicate this kind of solution, the path is increasingly straightforward. By lowering the barrier to entry with templatized agents and no-code tools, our team in Microsoft Digital has demonstrated that any employee can build tailored, high-impact assistants without deep technical expertise.

“The goal of Frontier Transformation is that AI is just there as you’re working, helping you practically do your job to enhance the experience and add value in real time.”

Kevin Wooldridge, senior director of digital transformation, Microsoft Digital

Looking ahead, we’re exploring ways to deepen these capabilities by adding memory and behavioral context so DigitalMe can better reflect individual working styles. The goal is to evolve it from a helpful assistant into a more complete digital representative.

Together, these advances point toward a future where employees routinely work alongside agents that grow, learn, and contribute more over time.

“DigitalMe is an example of the genuine, practical application of agentic use in the flow of work,” says Kevin Wooldridge, senior director of digital transformation in Microsoft Digital. “The goal of Frontier Transformation is that AI is just there as you’re working, helping you practically do your job to enhance the experience and add value in real time.”

The post Meet DigitalMe: Our AI digital twin that works on our behalf appeared first on Inside Track Blog.

“The pace of AI innovation has far outstripped how people learn. The old model of static catalogs, fragmented experiences, and a mindset of ‘consume content and move on’ doesn’t work in this new world, where roles are evolving in real time and every employee is expected to be AI proficient.”

Kavitha Radhakrishnan, general manager, Global Skilling

At Microsoft, this shift exposed a critical gap for us. While access to learning content has expanded dramatically, clarity about how to build and maintain skills has not kept pace. Our IT professionals often know they need to build AI capabilities but struggle with where to start, how to prioritize, and how to align their growth with business outcomes.

This is where our Global Skilling team identified an opportunity.

“We started with a simple observation: The pace of AI innovation has far outstripped how people learn,” says Kavitha Radhakrishnan, a general manager in Global Skilling product development. “The old model of static catalogs, fragmented experiences, and a mindset of ‘consume content and move on’ doesn’t work in this new world, where roles are evolving in real time and every employee is expected to be AI proficient.”

This situation led to the development of a cutting-edge solution: The AI Skills Navigator.

Try it at your company

Start your journey with our AI Skills Navigator

From content overload to guided capability building

At its core, AI Skills Navigator represents a shift in how learning is designed. Instead of asking learners to navigate sprawling catalogs of courses, the platform is built to guide them through a purposeful journey tied to their role, their goals, and the demands of their organization.

“Traditional learning catalogs answer the question, ‘What can I learn?’” Radhakrishnan says. “AI Skills Navigator answers the question, ‘What do I need to learn next—and why does it matter?’”

For IT professionals, that difference is significant:

• Learning paths are aligned to real-world scenarios and roles
• Content is curated and structured rather than fragmented
• Progression moves from foundational understanding to applied capability
• Skills are validated through credentials that signal actual proficiency

This approach helps IT teams move beyond passive learning and toward what Microsoft describes as “active capability building at scale.”

How AI Skills Navigator works for IT professionals

AI Skills Navigator is designed to meet IT professionals where they are, whether they are building foundational understanding, creating agents, or deploying and managing AI-powered solutions in production.

The experience is anchored in four key principles:

1. Curated skilling playlists aligned to real roles. Learners engage with curated playlists mapped to their role and responsibilities. These playlists guide progression from foundational proficiency to deep expertise and leadership with AI.
2. Applied skills, not just content consumption. The platform emphasizes hands-on, lab-based experiences where learners build and demonstrate real capabilities. Applied Skills credentials validate what learners can do, not just what they have completed.
3. Multimodal learning in the flow of work. Content is delivered in formats that fit how professionals learn day to day, including interactive modules, video, and audio-first experiences like podcasts. This makes it easier to build skills without stepping out of the workflow.
4. Skills validation with organizational visibility. Progress and credentials give individuals a way to demonstrate expertise. At the same time, organizations gain visibility into skill development and readiness at scale.

Behind the scenes, the experience is designed to deliver personalization at scale.

“The most important architectural decision we made was treating personalization as a ‘data and signals problem’ before it became a model problem,” says Iliyas Chawdhary, a principal group software engineering manager in the Global Skilling product group. “We built AI Skills Navigator on a modular foundation: a unified content catalog, separate skills and roles taxonomy, an identity and profile layer, and a recommendation surface connected through well-defined contracts. That separation enables us to make updates without rewriting the experience.”

By separating content, roles, identity, and recommendations into modular components, the platform can continuously evolve as technologies and job expectations change.

“The most consistent feedback from IT practitioners is that they need to move quickly from understanding AI to actually operating it.”

Priya Vaidyanathan, director of product management, Global Skilling

A differentiated approach to AI skilling

While many platforms provide access to AI learning content, AI Skills Navigator is differentiated by how it connects learning to real-world outcomes.

“The most consistent feedback from IT practitioners is that they need to move quickly from understanding AI to actually operating it,” says Priya Vaidyanathan, director of product management for Global Skilling. “The focus on governance, security, and how to enable their organizations without slowing innovation is a key differentiator for us.”

AI Skills Navigator is different from other learning experiences in several other ways:

• Built around roles and tasks, not course catalogs. Content is organized into curated playlists aligned to roles and real work scenarios. Learners are not choosing from a library of courses; they are guided to build the specific skills needed to perform in their role, from first exposure to applied execution.
• Orchestrated by specialized agents, not a single recommendation engine. Multiple agents work together to create playlists, guide learning sessions, and ensure content quality. This allows the experience to adapt to the learner, while maintaining grounding in trusted, curated Microsoft content. The result is guidance that is both personalized and reliable.
• Designed to build capability over time, not deliver one-time learning. The platform is designed for repeat engagement. As learners return, recommendations evolve based on progress, feedback, and emerging skills; this enables continuous skill development rather than a one-time completion model.
• Embedded into how work happens, not separate from it. Integration with Microsoft 365 Copilot brings skilling into the tools professionals already use and learning happens alongside real tasks, making it easier to apply skills immediately instead of learning in isolation.

Turning learning into team capability

For organizations, one of the most powerful features of AI Skills Navigator is the ability to align teams around shared learning goals. Skilling playlists enable leaders to define capability journeys that map directly to business priorities.

Instead of assigning generic training, leaders can create structured paths that guide teams toward specific outcomes, like becoming AI literate, managing agents in the enterprise, or building expertise in agent development. This approach transforms learning from an individual activity into a shared experience.

For IT professionals, this means learning is no longer abstract—it becomes directly connected to their role, their team, and the transformation initiatives they support.

Building momentum with an AI Skills Fest

To accelerate skills development through a moment of shared learning, we’re hosting our second global AI Skills Fest initiative in June 2026. The annual event is designed to bring focus, energy, and community to the AI Skills Navigator experience.

AI Skills Fest brings together:

• A global audience of learners across different roles and skill levels
• Curated learning experiences aligned to real-world scenarios
• Opportunities to engage, practice, and validate new skills

The initiative builds on the success of last year, when we brought together more than 126,000 participants in a single day of learning to achieve a Guinness World Record for AI skilling participation. This milestone demonstrated both the demand for AI skills and the power of creating a shared learning moment at global scale.

In 2026, the focus is shifting from the record itself to sustaining long-term engagement. Our AI Skills Fest is designed to help learners discover the right entry points into AI Skills Navigator and build momentum that continues well beyond the event.

“We want learners to think of it less as a single event and more as a catalyst for ongoing skilling at scale,” Radhakrishnan says.

Bringing AI skilling directly to Inside Track

To make these learning opportunities even easier to discover, we’re taking the next step by integrating AI Skills Navigator content directly into the Inside Track experience. This integration will provide IT professionals with:

• Direct access to curated learning journeys, aligned to Inside Track content
• Seamless pathways from insight to action
• A clearer connection between Microsoft’s own transformation story and the skills required to replicate it

For our readers, this creates a new kind of experience. Instead of simply learning how Microsoft approaches AI, you’ll be able to immediately start building the skills needed to apply those insights at your own organizations.

Look for curated deep links from Inside Track stories into AI Skills Navigator starting in the second half of 2026. Additionally, we’ll be adding links to our site navigation and Careers page to make it simpler to help you discover and build role-specific AI skills.

“From an assistant, to a coach, to a learning companion—the endpoint doesn’t feel like a learning platform at all. It just makes you better at your job.”

Iliyas Chawdhary, principal group software engineering manager, Global Skilling

A new model for learning in the era of AI

AI is reshaping how organizations operate, how teams collaborate, and how work gets done. For IT professionals, staying relevant means continuously building new capabilities.

AI Skills Navigator represents our answer to that challenge. The initiative moves beyond static content to create a guided, adaptive, and integrated learning experience. AI Skills Navigator just feels different—and better—than other learning platforms.

“From an assistant, to a coach, to a learning companion—the endpoint doesn’t feel like a learning platform at all,” Chawdhary says. “It just makes you better at your job.”

The era of AI demands a new approach to learning, and that approach is built on a foundation of role clarity, relevance, and continuous growth.

Key takeaways

If you are thinking about promoting AI skilling among your own employees, keep the following in mind:

• Start your journey now. Explore the IT Professional playlist in AI Skills Navigator to identify the skills most relevant to your role.
• Align learning to outcomes. Don’t just take courses: Define the AI capabilities your role or team needs, then use structured playlists to guide progress.
• Make learning continuous. Plan for regular, incremental skilling rather than one-time training events to keep pace with AI innovation. The AI Skills Navigator playlists are constantly being updated to help you keep up with the pace of change.
• Leverage AI-powered guidance. Use AI-driven recommendations, playlists, and coaching experiences to accelerate learning and reduce time to value.

Try it out

Visit our AI Skills Navigator site to start your learning journey.

Related links

• Learn how we’re skilling up for the future of work at Microsoft with Agent Launchpad.
• Discover how we enabled meaningful AI adoption internally with a Microsoft 365 Copilot Expo.
• See how we drove Microsoft 365 Copilot adoption with a virtual skilling event.
• Find out what it’s like to work in Microsoft Digital in the era of AI.
• Explore the new age of AI-led engineering in IT at Microsoft.

The post Building AI skills for the future: How we’re reimagining learning with AI Skills Navigator appeared first on Inside Track Blog.