What’s New in Microsoft 365 Copilot: The Mid-2026 Roundup for IT Pros

TL;DR

• Agent mode went GA on 22 April 2026 and is now the default experience in Word, Excel, and PowerPoint.
• Model choice is a tenant decision with regional defaults you may not have chosen: Anthropic models are on by default in most commercial regions, off in the EU, EFTA, and UK.
• Copilot Cowork is included with a Copilot license but blocked until an admin enables metered billing.
• Computer-using agents in Copilot Studio went GA on 13 May 2026 at 5 Copilot Credits per step.
• Restricted SharePoint Search is retiring; new enablement blocked since 31 July 2026.
• Two things this article got wrong in June are corrected below.

Corrections since first publication

Written 19 June 2026; two claims have since gone stale.

The model. Claude Opus 4.8 was then the Anthropic flagship in the picker. It no longer is: Microsoft made Claude Opus 5 available in Microsoft 365 Copilot in late July 2026. The durable lesson is not the version number — the picker changes roughly monthly, so never bake a model name into a policy document, training deck, or comms email.

The product name. Microsoft's documentation now states that Microsoft 365 Copilot is named Microsoft Copilot, and Microsoft 365 Copilot Chat is Microsoft Copilot Chat. The app rename reaches mobile and web from mid-August 2026, Windows and macOS from mid-September. No security or compliance commitments change — but your service catalogue, help-desk macros, and onboarding screenshots now say the wrong thing.

Agent mode in the Office apps

Agent mode is the headline shift. Earlier Copilot was a capable autocomplete; Agent mode is iterative, working in the document with you and making incremental changes rather than regenerating from scratch. It rolled out per app through late 2025 and early 2026, reached general availability on 22 April 2026, and was declared the default experience at Build 2026 in June. "Default" is the operative word: users who never opted in now have it.

The implication for IT is governance, not novelty. An agent editing files in place touches version history, co-authoring, and sensitivity labels. Confirm your retention and DLP policies behave as expected when an agent makes the edit — our piece on Microsoft Purview in 2026 covers the DLP-for-Copilot controls to enable first.

Model choice is an admin decision, not a user preference

Anthropic is now onboarded as a Microsoft subprocessor, bringing its models under the Microsoft Product Terms, the Data Protection Addendum, and the Customer Copyright Commitment, and Microsoft enables them on by default for most commercial-cloud customers.

The exceptions are significant. Anthropic models are excluded from the EU Data Boundary, so customers inside it — plus all UK and EFTA customers — have them disabled by default. They are unavailable in GCC High, DoD, and other sovereign clouds. Non-federal GCC customers gained an opt-in on 22 July 2026, which processes customer data outside Microsoft's FedRAMP-authorised government cloud.

To check where you stand you need the AI Administrator or Global Administrator role:

1. Microsoft 365 admin center → Copilot → Settings → View all
2. Select AI providers operating as Microsoft subprocessors
3. Under Available subprocessors for your organization, select Anthropic, then Save
4. Under Choose who can access Anthropic models, scope to all users or specific security groups

Step 4 is the useful one: access is assignable per user or Entra ID security group and enforced across both Copilot and Copilot Studio, so a pilot ring for a model provider is supported configuration, not a hack.

One trap deserves its own paragraph: some newer Anthropic models ship as Preview models with Data Retention. For those, Anthropic acts as an independent processor under its own commercial terms — inputs and outputs retained up to 30 days, and content flagged by trust-and-safety classifiers held up to two years. They are default-off everywhere, including where Anthropic is otherwise on. When someone asks you to "just turn on the newest model," that is the question to ask first.

Researcher and Notebooks

The Researcher agent's reports now export to PowerPoint, PDF, infographic, or an audio overview, citations preserved — the bottleneck was never the research, it was reformatting the output.

Copilot Notebooks were rebuilt around projects, reaching GA in June 2026, and August's wave extended them to Copilot Chat users without a Copilot license — which changes the pilot maths considerably. You can reference SharePoint content and OneNote notebooks, generate a Word document or deck, share a notebook with a Microsoft 365 Group, and explore content with mind maps.

Two questions to answer before the pilot: does a generated Word file inherit the source sensitivity label, and is that group's membership current? Group sharing inherits your existing sprawl, so pair a Notebooks rollout with Groups and Teams governance.

Copilot Studio: computer-using agents, and what they cost

Computer-using agents reached general availability on 13 May 2026 — agents that drive a UI directly, for systems with no API. The GA build ships OpenAI's CUA model and Claude Sonnet 4.5, with Azure Key Vault credential storage, Purview audit logging, and configurable human supervision.

Configure the guardrails before the first pilot:

• Credentials to use — maker-provided is the default, so anyone you share the agent with acts with the author's access. Switch to end-user credentials.
• Access control — an allow list of URLs and desktop process names. It stops the model acting on sites outside the list, not opening them.
• Enforce HTTPS — off by default, and no reason to leave it there.

Now the part that turns a pilot into a finance conversation. Computer use bills at 5 Copilot Credits per step, or 15 on a premium model such as Claude Opus 4.6. A step is one model turn — a click, a keystroke, a navigation. Microsoft's four-step time-sheet example consumes 20 credits: 20 cents at the pay-as-you-go rate of $0.01 per credit.

Multiply before you pilot. Ten thousand invoice runs a month at eight steps each is 400,000 credits — roughly $4,000 pay-as-you-go, or sixteen $200 prepaid packs. Prepaid capacity is enforced monthly with no rollover, and exceeding it can trigger service denial, per the standard harness licensing documentation. Model the burn as you would an Azure consumption meter, and read our Copilot Studio agent walkthrough first.

The licensing map: one brand, several billing models

"Do we have Copilot?" is now ambiguous. The brand spans several commercial shapes, and confusing them is how budgets get missed.

Cowork catches people out. It needs no separate license, but nobody can access it until an admin enables usage-based billing, because every model response, tool call, image generation, and browser task consumes credits. Set per-user or per-group limits before the first invoice. Our Microsoft 365 licensing comparison covers the E3-versus-E5-versus-E7 maths underneath.

Data readiness: the failure mode that sinks rollouts

Copilot does not break permissions; it surfaces the ones you already had wrong. A stale "Anyone" link on the budget site now gets summarised and served conversationally — the scenario in our piece on missing AI guardrails.

The control you may be relying on is going away. Restricted SharePoint Search — the tenant-wide allow list of up to 100 sites — is retiring, with new enablement blocked since 31 July 2026. The replacement is Restricted Content Discovery (RCD): per-site, available to any tenant licensed for Copilot with SharePoint Advanced Management, and it also strips AI entry points (the Copilot button, AI actions, Create pages with AI) from those sites.

Apply it in the SharePoint admin center under Sites → Active sites → site → Settings → Restrict content from Microsoft Copilot, or in SharePoint Online PowerShell:

# Restrict one site from org-wide search and Copilot discovery
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/finance -RestrictContentOrgWideSearch $true
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/finance | Select RestrictContentOrgWideSearch

# Delegate to site admins (a justification is then required for each change)
Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true

# Tenant-wide report of every restricted site
Start-SPORestrictedContentDiscoverabilityReport
Get-SPORestrictedContentDiscoverabilityReport

Two cautions. RCD does not change permissions — it hides content while you fix the underlying access, and Microsoft is explicit that it is temporary, not a security boundary. And propagation is slow: for sites over 500,000 items a change can take more than a week to reflect. Plan remediation on that clock, not a sprint boundary.

Find the sites worth restricting with SharePoint Advanced Management's Data Access Governance reports, which flag sites by permissioned-user count, active "Anyone" links, guest exposure, and sensitivity label. That, plus our SharePoint oversharing guide, is the real pre-flight.

Measuring adoption honestly

Be sceptical of adoption percentages, vendor decks included: if a number is not attributable to a named primary source with a date, keep it out of your steering-committee slide. Here is one that qualifies. On 29 July 2026, in Microsoft's FY26 Q4 earnings release, CFO Amy Hood stated that "Microsoft 365 Copilot reached over 30 million paid seats." That is a seat count, not an engagement rate — and the distinction is the point of this section.

The usage report lives at Microsoft 365 admin center → Reports → Usage → Microsoft Copilot → Copilot, filterable over 7, 28, 90, or 180 days. Four things about it are not obvious:

• "Active" has a strict definition. Opening the Copilot pane in Word does not count; submitting a prompt does. Harder to inflate than most metrics.
• Data lags roughly 48 hours after the end of a day (UTC). Do not chase a same-day dip.
• The user-level table includes anyone licensed at any point in the past 180 days, reclaimed seats included. Your denominator stays inflated for six months.
• Audit logs are not a usage source. Microsoft states plainly that metrics built on audit data will not reconcile with the official reports.

To pull per-user detail on a schedule, the Graph cmdlet lives in the beta module:

Connect-MgGraph -Scopes "Reports.Read.All"
Import-Module Microsoft.Graph.Beta.Reports

Get-MgBetaReportMicrosoft365CopilotUsageUserDetail `
    -Period "D30" `
    -OutFile "C:\reports\copilot-usage-D30.csv"

Design around one limitation: that API covers licensed users only. Unlicensed Copilot Chat usage is not exposed through the Graph reports APIs at all, so if your strategy is "Chat for everyone, licenses for teams that prove value," you are measuring half the funnel. Our guide to Microsoft 365 reporting in 2026 covers stitching the sources together with the Graph SDK patterns.

flowchart LR
    A[User prompt] --> B{Copilot routes}
    B -->|Document edit| C[Agent mode in Word/Excel/PPT]
    B -->|Automation or delegated task| E[Copilot Studio / Cowork - metered]
    C --> F[Purview labels + DLP]
    E --> F
    F --> H[Retrieval scoped by SharePoint permissions + RCD]

What to do this quarter, in order

1. Audit the data estate first. Run Data Access Governance reports, apply Restricted Content Discovery to the worst offenders, start permission remediation. If you are still on Restricted SharePoint Search, that is now a migration with a deadline.
2. Confirm your model posture. Whether Anthropic models are on depends on your region, and you may not have chosen it. Verify preview models with data retention are still off.
3. Model the credit burn before enabling Cowork or a computer-using agent, and set per-user or per-group limits as you enable usage-based billing.
4. Re-baseline adoption reporting. Correct for the 180-day licensed-user tail, drop audit logs as a source, and publish your definition of "active" next to the number.
5. Fix the naming across the service catalogue, macros, and training material before the desktop rename lands in September.
6. Pressure-test Agent mode against DLP and labels. It is the default now — verify rather than assume.

Steps 3 to 6 assume step 1 is genuinely done. If yours skips it, our Copilot rollout guide covers readiness in depth.

The bottom line

Mid-2026 Copilot is less "magic answer box" than "a set of governed, separately metered agents inside the tools you already use." The feature list is its least durable part: models change monthly, the product name changed in August, and the control you relied on to contain retrieval is being retired out from under you.

The shape of the work does not change. Control what is enabled and for whom, know what each surface bills and on which meter, confirm your guardrails apply to agents as they do to people, and measure adoption with a definition you can defend to a CFO.

Further reading

• Anthropic models in Microsoft Online Services (Microsoft Learn)
• Restrict discovery of SharePoint sites and content (Microsoft Learn)
• Restricted SharePoint Search retirement (Microsoft Learn)
• Microsoft Copilot usage report (Microsoft Learn)
• Computer use in Copilot Studio (Microsoft Learn)
• Manage Copilot Cowork (Microsoft Learn)
• Microsoft FY26 Q4 earnings release (Investor Relations)

Image credit: Bench Accounting via Wikimedia Commons (CC0 / public domain).