{"id":18191,"date":"2025-10-02T09:00:00","date_gmt":"2025-10-02T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=18191"},"modified":"2026-06-17T09:19:04","modified_gmt":"2026-06-17T16:19:04","slug":"unlocking-enterprise-ai-extensibility-at-microsoft-with-microsoft-copilot-studio","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/unlocking-enterprise-ai-extensibility-at-microsoft-with-microsoft-copilot-studio\/","title":{"rendered":"Unlocking enterprise AI extensibility at Microsoft with Microsoft Copilot Studio"},"content":{"rendered":"\n
Microsoft 365 Copilot extensibility is a revolutionary new framework for advancing enterprise AI. By creating their own agents, individuals and teams can customize Copilot\u2019s behavior with additional instructions, grounding, and actions, all while providing a clear and discoverable entry point in the tool\u2019s user interface.<\/p>\n\n\n\n
These agents help employees reach beyond Microsoft Graph and Microsoft 365 applications to do their work more thoroughly and efficiently. By empowering users to experiment with AI-driven assistance and capabilities internally at Microsoft, we\u2019re unlocking efficiency, process automation, and data-driven insights tailored to specific individuals\u2019 or teams\u2019 needs.<\/p>\n\n\n\n
One tool is making Copilot extensions accessible to more employees than ever before: Microsoft Copilot Studio.<\/p>\n\n\n\n
This low-code solution makes it possible for both technical and non-technical users to create their own agents and tailor Copilot\u2019s capabilities to their work. At Microsoft Digital, the company\u2019s IT organization, we\u2019re the first to implement Copilot Studio and develop a methodology for empowering our employees to create while establishing guardrails to keep our organization\u2019s data safe.<\/p>\n\n\n\n
As a result, we\u2019ve built best practices that help us protect employees while enabling helpful agents\u2014from individualized tools to organization-wide utilities. We\u2019ve also learned lessons that can help customers navigate their own Copilot Studio journey.<\/p>\n\n\n\n
Microsoft Copilot Studio<\/a>, a part of Microsoft Power Platform, empowers employees to build their own agents or use them to extend Microsoft 365 Copilot\u2019s value. It uses the same low-code connector model as Power Platform to power actions through first-party and third-party services.<\/p>\n\n\n\n \u201cCopilot Studio is a way for a non-technical person to spin up an agent quickly.\u201d<\/p>\nAmy Rosenkranz, principal product manager, Copilot Extensibility, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n As a result, users can create their own agents tailored to specific professional needs and business functions. These agents can narrow the focus of knowledge within the Microsoft 365 Graph, reach outside of it, and even take actions.<\/p>\n\n\n\n There are several ways to create agents. They range from simple natural language queries in Copilot Studio agent builder through Copilot Chat in Microsoft Teams and SharePoint to the full-featured Copilot Studio graphical authoring environment to a combination of Copilot Studio and Azure AI.<\/p>\n\n\n\n \u201cCopilot Studio is a way for a non-technical person to spin up an agent quickly,\u201d says Amy Rosenkranz, principal product manager responsible for Copilot extensibility at Microsoft Digital. \u201cYou can pull from a SharePoint site, from a graph connector, or from the web, and so employees are using it to tailor their experience to their business process.\u201d<\/p>\n\n\n\n \u201cThere\u2019s an important role for Copilot Studio in helping customize the solutions our employees create, whether they want to use existing functionality, extend their knowledge, or expand their skill compatibility.\u201d<\/p>\nEileen Zhou, senior program manager, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n Ultimately, the goal is to help employees work more efficiently by putting them in the driver\u2019s seat through the power of self-directed agent creation. It also helps alleviate strain on business functions by getting people to the answers they need faster, without the need for human intervention.<\/p>\n\n\n\n \u201cThere\u2019s an important role for Copilot Studio in helping customize the solutions our employees create, whether they want to use existing functionality, extend their knowledge, or expand their skill compatibility,\u201d says Eileen Zhou, senior program manager in Microsoft Digital. \u201cAnd it provides opportunities for both non-technical creators who want to create individualized solutions and people with advanced knowledge who are building more enterprise-focused agents.\u201d<\/p>\n\n\n\n To empower our employees for this kind of creativity, we needed to put guardrails in place that ensure they can build agents confidently without putting themselves or the company at risk.<\/p>\n\n\n\n Building guardrails around agent production meant developing a system for classifying them according to their purpose, reach, and potential risk.<\/p>\n\n\n\n On one end of the spectrum, simple retrieval agents might only access content that individuals author and own. Non-technical employees typically create this kind of agent through natural language prompts in Copilot Studio agent builder.<\/p>\n\n\n\n \u201cThere\u2019s a time and place for personal agents that integrate with business workflows, but if something is a business-critical service, we need to think security-first.\u201d<\/p>\nJake Visser, principal architect manager, Copilot and AI apps<\/cite><\/blockquote>\n\n\n\n On the other end, more elaborate tools\u2014task or autonomous agents that combine knowledge, action, and orchestration\u2014need to cross data boundaries to accomplish their work. More technically advanced IT employees and professional developers build these agents for larger-scale business functions using the full-featured Copilot Studio authoring environment.<\/p>\n\n\n\n This simple taxonomy doesn\u2019t capture the whole picture though. As a result of the varying reaches and risk profiles for different agents, we tend to group them into three categories:<\/p>\n\n\n\n \u201cIf an employee is building a service, we need to manage it like a service,\u201d says Jake Visser, principal architect manager for Copilot and AI apps. \u201cThere\u2019s a time and place for personal agents that integrate with business workflows, but if something is a business-critical service, we need to think security-first.\u201d<\/p>\n\n\n\n Microsoft Digital is responsible for developing and enforcing guidelines for managing those services.<\/p>\n\n\n\n \u201cThanks to our early experiences with Copilot Studio, we\u2019ve been able to develop gates and controls based on the type of agents that creators want to build.”<\/p>\nAisha Hasan, Power Platform and Copilot Studio product manager, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n Establishing guardrails around the different agents our employees can create in Microsoft Copilot Studio involved asking a lot of questions. What Power Platform features apply to Copilot Studio workflows? What additional areas of risk do agents introduce? How can we build policies and processes around low-code AI creations? How can we help employees understand the implications of the agents they create?<\/p>\n\n\n\n \u201cThanks to our early experiences with Copilot Studio, we\u2019ve been able to develop gates and controls based on the type of agents that creators want to build,\u201d says Aisha Hasan, Power Platform and Copilot Studio product manager for Microsoft Digital. \u201cThrough predetermined groups and rules, we can allow freedom and experimentation at different scales without putting our internal tenant at risk.\u201d<\/p>\n\n\n\n Since Copilot Studio exists within Power Platform, that tool\u2019s capabilities provided a solid foundation for managing agents. We have extensive experience empowering citizen developers while maintaining good governance through Microsoft Power Platform<\/a>. So it was easy for us to apply existing administration and governance best practices<\/a> to this new framework.<\/p>\n\n\n\n At the outset of our journey, we already had robust systems in place for securing custom connectors<\/a>, and Microsoft 365\u2019s built-in governance capabilities ensure Microsoft 365 agents respect our labeling taxonomy and the policies it articulates<\/a>. Finally, we have the power to introduce sharing limits<\/a> that restrict how widely creators can distribute agents depending on their purpose and scope.<\/p>\n\n\n\n Together, these features and capabilities helped us extend existing administration and governance structures to the new world of agents. But thoughtful process and policy are equally important.<\/p>\n\n\n\n For the simpler self-service agents that individual employees create and use, we\u2019re able to define our policies at the Copilot Studio environment level. Tenant administrators and partners on the Microsoft Security team apply data loss prevention policies to configure what individual employees can and can\u2019t do. At this level, everyone in the company has the same configuration and tools available, and automation largely handles agent reviews and assessments based on pre-configured settings.<\/p>\n\n\n\n For more wide-reaching apps that operate at the line-of-business level or that we might publish enterprise-wide, we need to apply greater rigor. Thanks to our experience administrating and governing Power Platform, Microsoft Digital already had a robust process in place to review internally created enterprise apps. Discipline-specific professionals in security, privacy, and other spaces conduct these reviews to ensure internal teams meet our high standards.<\/p>\n\n\n\n By building onto that structure, we\u2019ve updated our custom environment review process for agents created in Copilot Studio. We step through a review process that includes phases for security assessments, threat modeling, privacy assessments, and Responsible AI reviews.<\/p>\n\n\n\n Our goal is to properly scope our governance controls into what people are building. If we can easily enable things we consider low-risk like retrieval agents, we let employees build those in their personal development environment, but more powerful or far-reaching custom agents require more thorough oversight.<\/p>\n\n\n\n Configuration, review, and assessment are only parts of the puzzle. We also flighted user awareness efforts to help employees understand not just how to use Copilot Studio, but also its implications for security, privacy, and Responsible AI.<\/p>\n\n\n\n These campaigns included field readiness through Viva Learning, Copilot Champs sessions<\/a>, newsletters, marketing campaigns through Viva Amplify, office hours, internal roadshows, and elite programs. We even launched an agent-building contest that invited employees to design whatever they liked.<\/p>\n\n\n\n Providing employees with opportunities for learning and experimentation has helped jumpstart interest in creating agents. Together with product features, process, and policy, it ensures we unlock the full value of Copilot Studio safely and effectively.<\/p>\n\n\n\n With the freedom to create using Microsoft Copilot Studio and the protection of robust guardrails, individuals and teams are flexing their imaginations to create highly useful agents. We\u2019re in the early days of our own Copilot extensibility journey, but agents are already driving faster and more accurate access to information and greater productivity.<\/p>\n\n\n\n Two examples stand out:<\/p>\n\n\n\n As the capabilities of Copilot Studio continue to grow, Microsoft Digital is actively collaborating with the product team to ensure administration and governance features keep pace with its technical elements. Our experience as the first and largest adopters of this new framework mean that every lesson we learn internally helps the product accommodate businesses\u2019 needs more effectively.<\/p>\n\n\n\n \u201cEveryone wants to move fast, and people are enthusiastic to explore this new framework for enterprise AI. Our guiding principle is making the product secure by default so businesses can make it happen safely.”<\/p>\nDavid Johnson, principal program manager, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n Thanks to our experience at Microsoft, the product has incorporated several new features:<\/p>\n\n\n\n Between built-in features and emerging best practices, Copilot Studio is unlocking the freedom to create like never before while maintaining organizational safety. For our customers and Copilot users, that means multiplying AI\u2019s impact by setting employees free to create tools that will help them do their work faster, better, more creatively, and more insightfully.<\/p>\n\n\n\n \u201cEveryone wants to move fast, and people are enthusiastic to explore this new framework for enterprise AI,\u201d says David Johnson, principal program manager architect for governance at Microsoft Digital. \u201cOur guiding principle is making the product secure by default so businesses can make it happen safely.\u201d<\/p>\n\n\n\n Key takeaways<\/p>\n<\/div>\n\n\n\n Here are some tips for getting started with Copilot Studio at your company:<\/p>\n\n\n\n Try it out<\/p>\n<\/div>\n\n\n\n Related links<\/p>\n<\/div>\n\n\n\n <\/p>","protected":false},"excerpt":{"rendered":" Microsoft 365 Copilot extensibility is a revolutionary new framework for advancing enterprise AI. By creating their own agents, individuals and teams can customize Copilot\u2019s behavior with additional instructions, grounding, and actions, all while providing a clear and discoverable entry point in the tool\u2019s user interface. These agents help employees reach beyond Microsoft Graph and Microsoft […]<\/p>\n","protected":false},"author":115,"featured_media":18193,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_hide_featured_on_single":false,"_show_featured_caption_on_single":true,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[199,881,263,827,880],"coauthors":[622],"class_list":["post-18191","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-digital","tag-ai","tag-developer-tools","tag-microsoft-365","tag-microsoft-365-copilot","tag-microsoft-copilot-studio","m-blog-post"],"yoast_head":"\n\n
Building agents with Copilot Studio<\/h2>\n\n\n\n

<\/figure>\n\n\n\n\n
Managing the scale and sophistication of Copilot Studio creations<\/h2>\n\n\n\n
\n
Agent capabilities<\/h2>\n\n\n\n

\n
<\/figure>\n\n\n\n\n
Governance, processes, and policy for enabling Microsoft Copilot Studio<\/h2>\n\n\n\n
Unlocking Copilot Studio value<\/h2>\n\n\n\n
\n
<\/figure>\n\n\n\n\n
\n
<\/figure>\n\n\n\n\n
<\/figure>\n\n\n\n\n
<\/figure>\n\n\n\n\n