Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
[This article is prerelease documentation and is subject to change.]
Important
This feature is part of Frontier preview program. Frontier connects you directly with Microsoft’s latest AI innovations. Frontier previews are subject to the existing preview terms of your customer agreements. As these features are still in development, their availability and capabilities may change over time.
An account gives a Copilot Studio agent its own identity in Microsoft 365 so it can take a business process from start to finish on its own. With an account, your agent has its own Microsoft Entra ID, mailbox, and presence across Microsoft 365.
You can interact with your agent through supported email, Teams, and Office-comment scenarios. Use familiar replies, comments, and @mentions to contribute context or judgment to a team process. Review the current limitations before designing your process.
The account gives the agent a recognizable identity and access to supported resources. Configure its instructions, triggers, tools, and permissions for the work it needs to perform.
Note
Features in this article are used by agents or workflows powered by the GitHub Copilot harness.
Usage-based billing applies to using, building, testing, and evaluating agents. These actions might consume Copilot Credits. Learn more in Manage costs for agents powered by the GitHub Copilot harness.
Prerequisites
Your environment uses the early release cycle. In the Power Platform admin center, verify that Release cycle for your environment is Early. Learn more in Early release cycle environments.
An admin completed both steps to turn on agent accounts: activate the Copilot Studio agent template in the Microsoft 365 admin center and turn on Agent accounts for your environment in the Power Platform admin center.
You have a maker license: a Microsoft 365 E5 license with the Microsoft Agent 365 add-on, or a Microsoft 365 E7 license, which includes Agent 365. Learn more in Overview of Microsoft Agent 365.
Your tenant is enrolled in the Microsoft Frontier Program, with the Microsoft Agent 365 Terms of Service accepted, and has Microsoft 365 Frontier for AI Teammates licenses available. Your agent uses one of these licenses for its account when you publish it. A global admin enrolls the tenant from the Microsoft 365 admin center by going to Agents > Overview and selecting Try now. Learn more in Preview Microsoft Agent 365 features through the Frontier program and Get started with the Microsoft Copilot Frontier Program.
On Frontier enrollment, a tenant is provisioned with enough Microsoft 365 Frontier for AI Teammates licenses. These licenses are assigned per agent and are required before an agent's account can be created. If none are free when you publish, an admin must return a license to the pool by removing it from another agent, or acquire more.
Note
Agent accounts are available to customers in the European Economic Area (EEA). In the EEA, Microsoft Teams is licensed separately from Microsoft 365, so a tenant can have Microsoft 365 Frontier for AI Teammates licenses without Teams licenses. Your agent still gets its account, mailbox, and directory presence, but it appears in Microsoft Teams only if your tenant separately licenses Teams.
Your agent has a name, description, and instructions, and is ready to publish.
Turn on agent accounts
Before users can create agents with accounts, admins must complete both steps in the following sections, in order.
Activate the Copilot Studio agent template in Microsoft Admin Center
In the Microsoft 365 admin center, a tenant admin goes to All Agents, filters by Agent template: Yes, selects Copilot Studio, and then selects Activate.
In the activation wizard, at the Users step, select the users or groups that can create agents with accounts, and complete activation.
Important
Only the users you select at this step and members of the selected groups can create agents with accounts.
Turn on Agent accounts in the Power Platform admin center
In the Power Platform admin center, select Copilot on the side bar, and then select Settings. The Settings page appears.
Under Copilot Studio, select Agent accounts and turn on the setting for your environment. This setting lets you create user accounts and assign them to agents in the environment. If you turn it off, the Agent account button isn't available for agents in the environment.
What your agent can do with an account
After you publish it, your agent works as a member of your organization:
- It has its own mailbox, so it can send and receive email and be added to distribution lists.
- It appears in Microsoft Teams and your organization's directory, where people can find and @mention it like a colleague.
- People in the tenant can reach it through supported Microsoft 365 interactions, subject to the applicable audience and document limitations.
- Supported operations can use the agent's own scoped access rights. Tools configured for end-user authentication use the agent's identity and consent.
- The agent has its own Microsoft Entra account and identity, so admins can govern and audit it like any other identity.
Note
Microsoft Agent 365 provisions and governs agent accounts, giving admins user-grade visibility and control over agents that are configured with an account. Copilot Studio also creates a Microsoft Entra Agent ID that admins manage separately, for each agent that has an account. Learn more in Microsoft Entra Agent IDs for Copilot Studio agents.
Create an agent with an account
Open Copilot Studio Preview. Use the environment picker to switch to your early release cycle environment if it's not already in focus.
Create a new agent. Don't save it yet: you must add the account before publishing the agent for the first time.
Under the agent's name, select Agent account.
Note
If Agent account isn't available, first verify that you're using Copilot Studio Preview and that your environment uses the early release cycle. Ask your admin to turn on agent accounts, include you in the users or groups selected during template activation, and ensure a valid license exists for your account.
In the panel that appears, select Add account.
Review the information on the next page. If you already added tools, notice that Agent account becomes the default authentication mode for tools that support agents with an account. You can change the authentication mode for your tools if you want. You can also change it later.
Select Continue. The Create an agent identity page appears.
Revise the agent's name and the configurable portion of its email address, if you want. The agent's email address uses your own alias as a fixed prefix, and the agent reports to you.
Caution
During this preview, you can't change the maker-based alias prefix or reporting relationship. You also can't change the email address for your agent after you publish the agent. Plan your agent's identity before publishing.
Optionally, enter a job title for your agent.
Select Create account.
Publish to activate the account
Your agent's account isn't active until you publish the agent. When you publish it, the agent is provisioned with its mailbox, Teams presence, directory entry, and Microsoft Entra Agent IDs. It uses a Microsoft 365 Frontier for AI Teammates license.
Select Publish. Learn more in Publish an agent.
Wait for publishing to complete. When publishing succeeds, your agent's account is active.
Important
If no Microsoft 365 Frontier for AI Teammates license is available in your tenant when you publish, publishing fails. Ask your admin to free up a license by removing it from another agent, or to acquire more licenses, and then publish again.
Configure tools and end-user authentication
For tools that use end-user authentication, select Go to Agent Management under your agent's name to set up the required connection and complete consent. Each person must complete the required authentication for tools that act under their identity.
The agent account does not automatically grant every tool permission. Check which identity a tool uses and grant only the access needed for the job.
Protected documents
Agents with an account can't read protected documents. For example, they can't access documents protected with Confidential or Internal Only sensitivity labels, or the equivalent for your organization.
Use General or Confidential / Any User (No Protection) labels, or the equivalent for your organization, only if the document's classification and your organization's policy permit it. These options change protection. Don't use them as a workaround to test your agent against sensitive content. Use approved, non-sensitive samples for testing your agent.
Memory
Memory lets an agent retain what it learns in conversations, such as preferences, context, and how work gets done, and apply it in later conversations. In an agent with its own account, that memory is shared. The agent keeps one memory across everyone it works with, so what one person explains benefits the whole team.
Shared memory holds facts about the work, such as team processes and terminology, and details about individual people, such as how someone prefers to receive updates. This shared context helps the agent apply what it learns across later conversations with the team.
How are users alerted to shared memory?
The agent's People card displays this notice: "Any files or chats you share can be summarized and included in the agent's responses to any user, even users without permissions to the files or chats and regardless of sensitivity label."
The first time someone talks to the agent, it also explains that memories might include summaries of shared files and chats and might be used in responses to other users. Someone might see information in an agent's response even if they can't access the original file or chat. Share only what you're comfortable sharing with the team.
How is memory different for these agents?
An agent with its own Microsoft Entra account works alongside a team in Teams and Outlook. It uses shared memory rather than personal memory, even in one-to-one chats.
Who can see shared memory?
Anyone who works with the agent. A record about one person can be used in later conversations with other people. The agent is guided not to bring up one person's details with someone else, but shared memory has no privacy boundary between users.
Can I opt out of shared memory?
No. You can't opt out of shared memory in this preview. By using the agent, you consent to its use of shared memory.
Licensing and usage costs
An agent account requires a Microsoft 365 Frontier for AI Teammates license and tenant Frontier enrollment, as described in Prerequisites. Account licensing and usage-based service charges are separate. For Work IQ billing and cost controls, see Usage-based billing and cost management for Copilot Credits and the Copilot Credits Guide. For Copilot Studio billing, see Overview of usage-based billing.
Current limitations
- External users: the agent doesn't respond to anyone outside its tenant. There's no workaround in this preview.
- Office comments: @mentioning an agent supports limited scenarios. It can't currently make targeted document edits or co-author changes.
- Document editing: generating new documents is supported; editing existing documents through co-authoring isn't supported yet.
- Email audience: the agent responds only in email conversations with up to 250 people. You might see: "The agent can't respond because access couldn't be verified for everyone in this conversation. Please try again, or contact your administrator with reference code MCS-4043." This error alone doesn't prove the audience exceeded 250; access verification can also fail.
- Work IQ and Microsoft Graph: not all Microsoft Graph operations and permission scopes are supported. If a request reports a missing Graph scope, include the scope name and intended operation in your feedback. Support is being prioritized for the most-needed scopes.
Example: Cadence, a team execution-review agent
Give Cadence responsibility for preparing the team's execution review. Start with an approved workstream tracker and a small internal reviewer group. Configure supported tools and a recurrence trigger; instructions alone don't create a schedule or grant access.
On a scheduled run, read the tracker and available status evidence, identify blockers and missing updates, generate a new review document, and send reviewers the link. Reviewers add context through supported replies or comments; people decide priorities and next actions.
This is a starter configuration, not a prebuilt template or proof of a completed deployment. It deliberately generates a new document rather than depending on unsupported co-authoring.
You are Cadence, our team's execution-review agent.
At each configured review cycle, read the approved workstream tracker and status sources provided by the maker.
Summarize changes, blockers, decisions needed, and open follow-ups. Cite the source for each finding.
Preserve uncertainty: missing replies do not mean work is on track. Do not invent metrics, owners, dates or completion.
Create a new review document in the approved team folder. Verify it exists before sending its link to the configured internal reviewers.
Ask reviewers for the specific context or decision needed. Use supported replies and comments; do not claim you can co-author or make targeted edits to an existing document.
People own prioritization and sign-off. Do not change permissions, expand the audience or act on sensitive findings without the required approval.
If a source, connection, permission or output tool is unavailable, explain what is missing and stop the affected action.