A Copilot Studio agent with its own account keeps one memory for everyone who talks to it, and Microsoft's own notice says it can repeat your files and chats to users without permission. That holds whatever the sensitivity label. In this preview no user can opt out, and an admin's only way to turn shared memory off is to turn off agent accounts entirely. So the control that matters is upstream: which makers may publish these agents, and what each agent is allowed to read and join, decided before the first one goes live in your tenant.
Microsoft announced agent accounts, business-process memory and triggers for Copilot Studio on October 15, "rolling out now through the Frontier program." If your tenant is enrolled, a maker in your organization can publish one this week.
What an Agent Account Actually Is
An agent account is a Microsoft 365 identity issued to a Copilot Studio agent: per Microsoft's Learn documentation, published October 15 and updated October 16, it gets "its own Microsoft Entra ID, mailbox, and presence across Microsoft 365." It can send and receive email, sit on distribution lists, appear in the Teams directory and be @mentioned like a colleague. Copilot Studio also creates a separate Microsoft Entra Agent ID for each one, which gives you sign-in audit logs and lets Conditional Access policies target the connector permissions the agent holds.
The blog post's pitch is persistence. Agents "work in Microsoft 365 with their own credentials, similar to how any person would," and triggers mean "an external signal (like an email) or a set cadence will trigger an agent's cycle, no additional prompt required." Microsoft names one early customer, Ooredoo Qatar, running an executive business-case review agent across Outlook, Teams and Word. That example is Microsoft's account; there is no independent report of results yet.
Three identity details are fixed once you publish, according to the Learn page. The agent's email address uses the maker's own alias as a prefix. The agent reports to the maker in the directory. Neither can be changed in this preview, and the address cannot be changed after publishing. If the maker leaves, the agent's identity still carries their name.
Where the Memory Boundary Breaks
Shared memory is the feature, and Microsoft documents it plainly. The agent accounts FAQ says the agent "keeps one memory across everyone it works with," holding both facts about the work and "details about individual people, such as how someone prefers to receive updates." It uses shared memory "rather than personal memory, even in one-to-one chats."
The agent's People card carries this notice: "Any files or chats you share can be summarized and included in the agent's responses to any user, even users without permissions to the files or chats and regardless of sensitivity label." The FAQ adds that the agent "is guided not to bring up one person's details with someone else, but shared memory has no privacy boundary between users." Microsoft calls that guidance and describes no access control behind it.
The rest of the FAQ makes the pool harder to manage. Users can't opt out: "By using the agent, you consent to its use of shared memory." Admins have no switch for memory alone: "To turn off shared memory, an admin must turn off agent accounts altogether." And "everyone who interacts with the agent can view or delete its saved shared memories," so any participant can browse records about colleagues, and any participant can wipe what the team taught the agent. If no one talks to the agent for 28 days, its shared memories are deleted automatically.
This is the reverse of Copilot Studio's ordinary memory feature, where "each agent maintains a separate memory store for every user, so one person's context is never shared with another," the maker can toggle memory per agent, and makers can't see users' memories.
What Microsoft Did Fence Off
The strongest case for the design is that Microsoft did build some walls, and they are real. The Learn page says agents with an account "can't read protected documents," giving Confidential and Internal Only labels as examples. Microsoft warns against relabeling files to get around that. The FAQ also lists what shared memory will not keep: ID numbers, birth dates, card numbers, home addresses, passwords and tokens, health information, protected characteristics, performance judgments, and "anything someone asks it not to remember."
So the exposure has a definite shape. Encrypted, label-protected files are out of reach. Everything else a user pastes into a chat, attaches to an email, or shares from an unprotected file can be summarized into memory and surface for someone else. Plenty of sensitive material sits in unlabeled SharePoint folders or under a label that classifies the file without encrypting it, and the notice says labels don't matter for what reaches memory.
A team agent that remembers how the team works is useful, and a per-user memory would defeat the purpose. The problem is that the people talking to the agent decide what goes into a pool the whole audience can read, with no way for an admin to scope the pool short of killing the feature.
What It Costs to Turn On
Each published agent takes its own license on top of the maker's. The prerequisites are an environment on the early release cycle, a maker with Microsoft 365 E5 plus the Agent 365 add-on or Microsoft 365 E7, Frontier enrollment with the Agent 365 terms accepted, and a free Microsoft 365 Frontier for AI Teammates license for the agent itself. If none is free when the maker hits Publish, publishing fails.
The list prices, from Microsoft's Agent 365 page as checked on October 19, 2026:
| Item | Price | Billing |
|---|---|---|
| Agent 365 add-on | $15.00 per user/month | annual commitment |
| Microsoft 365 E7 (includes Agent 365) | $99.00 per user/month | annual commitment |
| Microsoft 365 E7 (No Teams) | $90.45 per user/month | annual commitment |
| Copilot Credit capacity pack | $200.00 per month for 25,000 credits | monthly |
Usage is metered separately. The Learn page says building, testing, evaluating and using these agents "might consume Copilot Credits," and they run on the GitHub Copilot harness, whose credit costs Microsoft documents separately.
The agent license is the open question. The Agent 365 Frontier page says an enrolled tenant should see 25 active Frontier for AI Teammates licenses, assigned per agent instance. It also says that at general availability "agents don't require their own Agent 365 or Microsoft 365 E7 license," because agents owned by a licensed user are covered. Microsoft has not published what the per-agent Frontier license becomes at GA. That same page states there is "no specific Service Level Agreement" for Agent 365 Frontier, that Frontier "should not be used for product evaluations," and that Microsoft can remove feature support at any time. Budget for the credits; don't build a business case on the 25 free seats.
How This Breaks the Copilot Permission Model
Microsoft's Copilot guidance tells admins that Copilot is safe because it respects permissions. Its secure and governed data foundation blueprint describes Copilot "grounding responses in the data users already have permission to access," and the remediation work it prescribes (finding overshared sites, tightening access, enforcing labels) all assumes that boundary. If the permissions are right, Copilot shows each user only what that user could already open.
Shared memory breaks that assumption at the agent. The user asking the question no longer has to hold the permission. The user who once shared the content does. Your SharePoint cleanup still matters, but it stops being the last line. The agent's audience list becomes the effective permission on everything its members ever fed it.
The same pattern appeared in our coverage of Microsoft's Customer Zero agent rollout, where the governance rested on maker review, and in Google's Gemini agent getting its own mailbox before it got a price. Identity is arriving faster than the data controls around it. For the identity side, see Okta vs Entra Agent ID vs SailPoint.
What to Do Before a Maker Publishes One
Treat each agent account as a shared mailbox that summarizes everything it receives, and set its scope the way you would for a distribution list with external forwarding.
This Week:
- Check whether you are exposed. In the Microsoft 365 admin center, look under Agents for Frontier enrollment and under Billing > Licenses for Frontier for AI Teammates licenses. Then check the Power Platform admin center for any environment set to the Early release cycle. If all three are present, a maker can publish today.
- Leave the template inactive until you have a list. The Copilot Studio (Frontier) template's activation wizard asks which users or groups may create agents with accounts. Create a dedicated security group with a named owner and activate only for it. Do not activate for all users.
- Keep Agent accounts off in every environment except one. The Power Platform setting is per environment. Pick one early-release environment for the pilot and leave the toggle off everywhere else.
This Month:
- Approve each agent's audience before it publishes. Write down which Teams, channels and distribution lists the agent will join. Everyone in that audience can read the pool. Keep it to a group that already shares the same data access.
- Brief the pilot users on the People-card notice. Tell them in plain terms that what they share can be repeated to other users, that anyone can delete the memory, and that encrypted labels are the only content barrier.
- Put each agent's Entra Agent ID into your access reviews and Conditional Access scope, and confirm the sign-in logs appear in the Entra admin center.
- Set a Copilot Credits alert before you enable triggers, since a scheduled agent spends credits without a prompt. Our piece on Work IQ and Copilot Credits covers where that metering shows up.
Before Renewal:
- Get the GA licensing for agent accounts in writing. Ask your Microsoft account team what the Frontier for AI Teammates license becomes at GA and whether shared memory gets an admin-level control or a permission check. If the answer is no, put that in the renewal file.
The Bottom Line
Agent accounts move Copilot Studio from assistants that act for one user to colleagues that act for a team, and Microsoft has been unusually direct about the cost: a memory pool with no permission boundary, no opt-out and no separate off switch. For a team that shares the same data, that is a fair trade. For an agent that joins a cross-department channel, it is a permission leak with a mailbox. Agent memory has already shown accuracy costs in MemTrapBench's testing and retention gaps in Cohere North 2. Microsoft's version adds an audience problem on top of both, because every participant reads the same pool.
Name the security group before you click Activate.
Continue Reading
- Microsoft Hit 20,000 Agent Makers on a Risk Rubric It Didn't Publish
- Google's Gemini Agent Gets Its Own Mailbox Before It Gets a Price
- Okta vs Entra Agent ID vs SailPoint: Two Issue, One Governs
- Microsoft's MXC Agent Containers Ship Before Intune Can Manage Them
- Cohere North 2 Gives Agents Memory and Names No Retention Rule
- Asurion Took AP From 20% to 70% Touchless Without New OCR