Who Can Add an Agent to Your Copilot? Decide Before October 25.
Microsoft added a switch for agents that can take actions. If nobody touches it, everyone keeps the door open. Five minutes settles it.
By John Martines · October 14, 2026 · 6 min
Microsoft 365 now lets you choose who may upload "advanced" Copilot agents, the kind that can act or connect to outside systems. On October 25 the default leaves it open to everyone. Here is what the setting means and how a small business should set it.
A helpful person at a landscaping company finds a video on building a Copilot agent. By lunch she has one that reads the morning's emails and drafts replies to customers. By the afternoon she has added a connection so it can look up jobs in the scheduling software too. It works. She shares it with two coworkers.
Nobody decided she could do that. Nobody said no, either. Microsoft simply allowed it, the way it allows a lot of things until someone changes a setting.
Microsoft has now added a setting for exactly this, and it has a date on it. If your business uses Microsoft 365, someone should look at it before October 25, 2026.
An agent, in Microsoft's terms, is a version of Copilot set up for one job: answer questions about your price list, draft a weekly report, help with onboarding. Staff can build them and add them to Copilot by uploading a "package," which is just the file that describes the agent.
Microsoft now splits those packages into two kinds.
Basic agents only have instructions. They answer and draft, using what Copilot can already see. These stay allowed, and the new setting doesn't touch them.
Advanced agents can do more. Microsoft defines one as an agent that has "actions" (it can do things in another system, like create a record or send a request) or that connects to an MCP server. MCP, the Model Context Protocol, is the common standard AI assistants use to plug into other software. In short, an advanced agent can reach outside Copilot and act.
The new setting is called Advanced package uploads. It lets you choose who in your company may upload advanced agents: all users, no users, or specific people or groups. It applies only to agents your own staff upload. Agents built by Microsoft or by other vendors are handled elsewhere and aren't affected.
Here is the part with the date. Microsoft says that starting October 25, 2026, advanced uploads stay allowed for everyone unless an admin has picked "No users" or "Specific users or groups." Doing nothing keeps the door open.
How it got here:
- November 2024: Anthropic released MCP as an open standard for connecting AI assistants to other software.
- March 2025: Microsoft added its first MCP support to Copilot Studio, its tool for building agents.
- May 2025: At its Build conference, Microsoft joined the MCP steering committee and announced MCP support across its products, including Windows and Dynamics 365.
- September 14, 2026: Microsoft notified admins (message MC1472007, "Manage who can upload advanced agents and plugins").
- September 25, 2026: The setting began appearing in the Microsoft 365 admin center, with rollout expected to finish by the end of October.
- October 10, 2026: Microsoft's chief executive, Satya Nadella, wrote that businesses should "assume a model is compromised and contain it from the start," with a record of what it does and a way to stop it mid-task.
- October 25, 2026: The default takes effect.
In a large company, an IT team would have a policy for this already. In a 15-person business, the person most likely to build an agent is the curious one who is good with computers, and that is a good thing. The risk isn't the person. It's that an agent with actions can do things on her behalf, with her access, in systems that hold customer data, and possibly for coworkers who never saw how it was set up.
Three things to keep in mind.
An agent that acts can act wrongly. A drafting agent that gets something wrong produces a bad draft someone reads first. An agent that creates records or sends requests can make a mess before anyone looks.
Connections outlast the person. If the builder leaves, her agent and its connections may keep running, and nobody else knows how it works.
A free account opens the rest of this article and the whole library.