Copilot Studio for business: when to use it, what it costs, how to govern it

Copilot Studio is Microsoft’s workshop for building agents, meaning assistants that do more than answer: they read your documents, work through steps and can act in your software.

Building an agent no longer takes technical skills: Agent Builder, built into Microsoft Copilot, creates one from a plain-language description, “without any code”, according to Microsoft.

The hard part comes next: who uses it, what it is allowed to change, and who pays for what it consumes. This guide, current as of October 14, 2026, gathers facts checked in Microsoft’s documentation and a decision method.

The essentials in six points

• An agent for you or your small team is built in Agent Builder, without Copilot Studio. To decide in three questions, go straight to the practical part.
• Copilot Studio is justified once the agent serves more than a small team or acts on software: creating a ticket, approving a request, writing to a business application.
• An agent consumes credits, a prepaid internal currency, at under one cent each. A question to an agent that searches across all your Microsoft 365 data costs 12, about 10 cents at the US pack price.
• An employee with a Microsoft Copilot license consumes no credits on internal agents used in Copilot Chat, Teams or SharePoint. An employee without one does.
• An agent sees what its user sees: an overshared SharePoint site becomes a leak as soon as an agent reads it.
• A booby-trapped document can hijack the assistant: in July 2026 a researcher showed a hidden instruction in a Word file being copied by Copilot into the documents it produced.

What Copilot Studio is in October 2026

Microsoft has renamed its products. According to its privacy documentation, updated October 8, 2026, Microsoft 365 Copilot is now called Microsoft Copilot, and Copilot Chat becomes Microsoft Copilot Chat. Copilot Studio keeps its name.

Copilot Studio is a separate web portal. Agents built there are published to Microsoft Copilot, Teams, SharePoint, a website or other channels. They link to your software through connectors, ready-made links to an application: email, CRM, ticketing tool.

Every agent consumes Copilot Credits. These are units the organization buys in advance in monthly packs or pays for as it goes, and they are deducted with each answer or action the agent takes. Their price is set out below.

Agent Builder or Copilot Studio: three questions

Microsoft offers two building tools. Agent Builder is built into the Microsoft Copilot app and works in plain language. Copilot Studio is the full workshop.

Microsoft’s documentation of September 30, 2026 recommends Agent Builder to “quickly create an agent for yourself or a small team”, and Copilot Studio for a department, the whole organization or external customers.

The decision comes down to three questions.

Question	Agent Builder is enough	Copilot Studio is needed
Who uses the agent?	You, or a small team	A department, the whole organization, customers
What does it change?	Nothing: it reads documents and answers	Software: ticket, approval, business application, a chain of several steps
Who pays for the credits?	Employees who already hold a Microsoft Copilot license	Employees without a license, an external channel, automatic starts

One answer in the right-hand column is enough to justify Copilot Studio. What it then brings is less about building than about control:

• separate environments, distinct workspaces to build (development), try out (test) and put into service (production), as with any software;
• versioning for each agent;
• a choice of allowed connectors;
• admin approval before publishing to the organization’s catalog.

Agent Builder has a clear limit: according to Microsoft, it cannot add actions that call external services. For that, the agent is copied to Copilot Studio without starting over.

What your first agent looks like

The Agent Builder documentation, updated September 30, 2026, describes the path.

1. Open Agent Builder. In the Microsoft Copilot app, choose “New agent”. The screen offers to describe the agent in conversation, configure it by hand or start from a template.
2. Describe the agent. For example: “Answer new hires’ questions from our welcome booklet and leave policy, and cite the source document.” Agent Builder fills in the name, description, instructions and suggested prompts itself.
3. Check the configuration. The “Configure” tab shows what was filled in. Add sources with the ”+” button: a specific SharePoint site or folder, files, a public website. Instructions accept up to 8,000 characters.
4. Test before sharing. The “Try it” tab gives you a version of the agent to question. Ask it the team’s real questions, check the cited sources, then create the agent and share it.

What this first agent costs

According to Microsoft’s billing documentation, an agent created in Agent Builder is not charged for generated answers as long as they do not rely on Microsoft Graph grounding.

An agent that answers from its instructions and public websites is free for every Copilot Chat user. Once it reads SharePoint for an employee without a license, consumption is billed.

What an agent costs: credits translated into examples

Licenses

According to Microsoft’s French pricing pages checked on October 14, 2026 (enterprise, plans):

• Microsoft Copilot: €26.00 excluding VAT per user per month on annual billing, €27.30 on monthly billing of an annual subscription;
• Copilot Business, for Microsoft 365 Business plans: €15.60 per month on annual billing, a promotional price valid until December 31, 2026 instead of €18.20, and €21.84 on monthly billing;
• Microsoft Copilot Chat: no extra cost with an eligible Microsoft 365 subscription.

Credit pricing

Since September 1, 2025, agents consume Copilot Credits. The US pricing page lists a pack of 25,000 credits at $200 per month, or $0.008 per credit; the French page lists €173.30 excluding VAT.

Pay-as-you-go runs through an Azure subscription at $0.01 per credit, according to the meters documentation. Pay-as-you-go therefore costs 25% more than the pack ($0.01 ÷ $0.008 = 1.25).

The rate card

According to the same billing documentation, updated October 1, 2026:

What the agent does	Credits
Answer written in advance by the maker	1
Answer generated by the model	2
Agent action: trigger, deep reasoning, switching from one topic to another	5
Microsoft Graph grounding, the search across all Microsoft 365 data	10
100 agent flow actions	13
Deep reasoning, per 1,000 tokens, the units of text the model processes	10 more

A trigger is the event that starts the agent: a question, an incoming email, a set time. An agent flow is a sequence of automatic steps the agent runs without reasoning about each one, for example logging a request and then notifying an approver.

Unused credits do not roll over to the next month. At 125% of prepaid capacity, agents are disabled until credits are added, unless pay-as-you-go takes over.

Who triggers credit consumption

The answer depends on the license of the person using the agent.

• A Microsoft Copilot license holder consumes no credits when using an internal agent in Copilot Chat, Teams or SharePoint, with the agent acting under their identity. Microsoft refers to fair usage limits without publishing a threshold, and reserves the right to change them.
• An employee with only free Copilot Chat does consume credits as soon as the agent reads shared organizational data, SharePoint or connectors, according to Microsoft’s page on Copilot Chat agents. These agents are off by default; the administrator must turn them on and attach a payment method. Only agents grounded in instructions and public websites remain free.
• Three cases are billed even with the license: computer-using agents, flows started by a trigger other than “When an agent calls the flow”, and agents started by an event with no signed-in user, which act under nobody’s identity.

Example 1: an HR front-desk agent grounded on SharePoint

The figures apply the rate card at the US pack price. The agent serves 400 employees without a license who each ask 8 questions a month, or 3,200 questions. Two settings are possible in the agent, and they change the bill.

• A targeted SharePoint source: on the agent’s “Knowledge” page, the maker adds the address of a specific site or library. Each question costs one generated answer, 2 credits: 3,200 × 2 = 6,400 credits a month, within one pack.
• Microsoft Graph grounding: the “Tenant graph grounding with semantic search” option, in the agent’s “Generative AI” settings, adds a finer search across the organization’s Microsoft 365 space, which Microsoft calls the tenant. Microsoft cites this very case: 10 grounding credits and 2 answer credits, so 12. The math: 3,200 × 12 = 38,400 credits.

At 38,400 credits, one pack is not enough: if this agent is the only consumer, the 125% threshold, 31,250 credits, shuts it down before month end. It needs two packs, $400 a month. The first cost setting is therefore how much data the agent searches.

No agent action is added to these questions: Microsoft’s billing examples count none for a plain document search, and its definition of actions covers triggers, deep reasoning and topic switches.

Example 2: the same agent in a large group

For 2,600 employees without a license, at 8 questions a month and with Graph grounding: 2,600 × 8 × 12 = 249,600 credits. That takes ten packs, $2,000 a month, or €1,733 excluding VAT in France. Without Graph grounding, 41,600 credits, two packs. In these examples, cost follows the unlicensed population, not the number of agents.

Example 3: a purchase request agent

The agent answers once and then runs three actions: 2 + 3 × 5 = 17 credits per request, or 10,200 credits for 600 requests from employees without a license.

For license holders using it in Teams, consumption drops to zero on one condition: the flow that logs the request in the purchasing tool must be started by the agent.

A flow that runs every night to process pending requests is billed, at 13 credits per 100 actions.

Example 4: a customer agent on your website

Microsoft’s documentation uses the example of an agent that gives, on average, four predefined answers and two generated answers per conversation: 4 × 1 + 2 × 2 = 8 credits. At 300 conversations a day over 30 days, 72,000 credits: three packs, $600 a month.

If you are building an agent for yourself or your team, you can stop here: Agent Builder and your license are enough. The rest is for IT, the CISO (head of information security), the DPO (data protection officer) and rollout leads.

Harnesses and this summer’s changes

Three harnesses

Every Copilot Studio agent runs on a harness: the software layer that decides when to call the model, what to send it and which tools to trigger. Microsoft’s harness overview, dated September 21, 2026, describes three.

Harness	What it does	Typical use
GitHub Copilot	Breaks a goal into steps, creates and edits Word, Excel, PowerPoint and PDF files, uses skills and memory	Processing invoices and matching them to purchase orders
Standard	Follows the topics, rules and paths the maker defines	An internal help desk with predictable answers
Copilot chat	Connects the organization’s knowledge to Microsoft Copilot Chat	An onboarding agent for new hires

Despite its name, the GitHub Copilot harness does not send data to the GitHub Copilot service: Microsoft states that it only shares the underlying technology.

The rate card above applies to the standard harness. The GitHub Copilot harness follows different billing: credits cover tokens, tools and the harness itself, and billing starts as soon as you start building, testing included.

For this harness, Microsoft publishes only ranges by task complexity and an estimation tool; a pilot of a few weeks gives the actual consumption.

What has changed since the summer

A feature in preview is open for trial with no stability commitment; once generally available, it is meant for production. According to the Copilot Studio release notes and Microsoft’s post of September 2, 2026:

• the GitHub Copilot harness and skills have been generally available since August; a skill is a reusable set of instructions added to several agents;
• memory, connected agents and Work IQ are in preview; Work IQ gives the agent the context of email, meetings, files and Teams chats;
• every new agent automatically gets a Microsoft Entra identity since July 2026, Entra being Microsoft’s identity directory;
• app building is arriving in preview in Copilot Studio, and the /app command in Copilot Cowork is open through the Frontier program, Microsoft’s early access program, according to the September 10 announcement.

Data: permissions, Purview, EU Data Boundary

An agent sees what its user sees

Microsoft states it plainly: Microsoft Copilot “only surfaces organizational data to which individual users have at least view permissions”. For Agent Builder, Microsoft sums up the principle as “no new privileges”.

That principle protects against intrusion, not against existing disorder. A SharePoint site carelessly shared with “everyone” becomes readable by every agent in the organization. Cleaning up sharing comes before rollout.

What Microsoft commits to

• No training: prompts, responses and data accessed through Microsoft Graph are not used to train models.
• Purview, Microsoft’s compliance suite: sensitivity labels and the encryption they apply are honored, and Copilot interactions can be searched and placed under retention policies.
• DLP per environment: in Copilot Studio, data loss prevention rules, which classify connectors and can forbid combining some of them, apply to each environment, along with permissions and auditing. The administrator chooses which connectors are allowed.

EU Data Boundary: the Anthropic exception

The EU Data Boundary is Microsoft’s commitment to process and store its European customers’ data within the European Union. Microsoft Copilot is covered.

The exception, according to Microsoft’s page on Anthropic models of September 18, 2026: Anthropic models used by Microsoft are excluded from the EU Data Boundary. They are disabled by default in the European Union, EFTA (Iceland, Liechtenstein, Norway, Switzerland) and the United Kingdom; an AI Administrator or Global Administrator can turn them on, for the whole organization or for specific groups.

Some newer Anthropic models, labeled “with Data Retention”, fall under Anthropic’s terms rather than Microsoft’s: Anthropic then keeps most inputs and outputs for up to 30 days. They require a separate opt-in. Turning these models on is a decision for the DPO as much as for IT.

Security: document injection and agent permissions

Injection through documents

A prompt injection is an instruction hidden in content, which the agent reads and may follow as if it came from the user.

On July 28, 2026, researcher Håkon Måløy published an attack on Copilot in Word, picked up by Simon Willison the next day. White-on-white instructions, invisible to the eye, are read by the model. Copilot executes them, then copies them, still hidden, into the document it produces.

In his demonstration, a fake market analysis is used to draft a quarterly report with every figure halved. A colleague builds the next quarter’s report from it, and the attack repeats without the original document.

According to the author, Microsoft was notified on March 6, 2026 and had 144 days.

Its fixes closed the reported payloads and “meaningfully reduce exposure”, but “the vulnerability class therefore remains exploitable at the time of publication”. His advice: “treating externally sourced documents as untrusted when used with Copilot”.

Microsoft, for its part, describes classifiers against these injections, with a caveat: they “may not be available in all Microsoft Copilot scenarios”.

Agent permissions

An agent that reads exposes data; an agent that acts can also change it, send it or trigger an operation in software. Copilot Studio offers three controls to bound those rights:

• each agent’s own Entra identity, which lets you scope its connectors and apply Conditional Access and DLP rules agent by agent;
• control over rendering images and embedded links in responses, since August 2026, configurable per environment, to protect users from untrusted content;
• a monthly credit cap per agent, set in the Power Platform admin center, which also limits how many actions a hijacked agent can take.

Who builds and who approves in the organization

Microsoft splits management across two consoles. Agent Builder agents are managed in the Microsoft 365 admin center, under Copilot > Agents: inventory, blocking, removal, sharing. Copilot Studio agents are managed in the Power Platform admin center: environments, connectors, publishing, consumption.

The split Colombani.ai recommends:

Role	Responsibility
The business team	Owns the agent: defines the need, provides the sources and validates the answers
The maker	Builds in the development environment, documents sources and actions
IT	Moves the agent to test then production, chooses connectors, sets the credit cap
The CISO and the DPO	Approve any agent that acts on software, opens to outside users or changes model

Colombani.ai also recommends refusing to put into production any agent without a named owner. Without an owner, an agent outlives its maker’s departure, keeps consuming credits, and no one answers for its mistakes.

What other vendors offer: Claude, ChatGPT, Mistral

Every vendor now offers a way to build and share agents.

• Claude and Cowork, from Anthropic, hand Claude a complete task on your folders and tools, with skills shared across the organization. See our Claude Cowork guide, our guide to deploying Claude in the enterprise and our guide to Claude skills.
• ChatGPT, from OpenAI, offers agent mode, projects, and GPTs or agents shared across the workspace on the Business and Enterprise plans.
• Mistral Vibe, formerly Le Chat, groups instructions and document libraries into agents, from a European vendor, with on-premises or private-cloud deployment on the Enterprise plan.

Copilot Studio itself lets you pick Claude Sonnet 5 or GPT-5.5 Chat as the primary model, generally available since June 2026, and Mistral Medium 3.5 as an experimental option since May.

The deciding criterion is the data.

If your documents, identities and licenses live in Microsoft 365, department agents belong in Copilot Studio, because they inherit the SharePoint permissions, Purview labels and DLP rules already in place. Another vendor is justified by a specific task, for example a long deliverable built from folders of files, which Cowork handles end to end.

Where to start

Five steps, in this order:

1. Take inventory of the agents already created, under Copilot > Agents in the Microsoft 365 admin center, before allowing new ones.
2. Run each project through the three questions: who uses it, what it changes, who pays for the credits. A single answer “beyond the team” points to Copilot Studio.
3. Clean up SharePoint sharing and apply Purview labels to the sources the agent will read.
4. Pilot an agent in a development environment with a credit cap, and measure its actual consumption for a month before setting any budget.
5. Have the CISO and the DPO approve any agent that acts, opens to outside users or uses a model outside the EU Data Boundary.

Going further:

• For non-technical business teams, the Copilot training is a day of work with Microsoft Copilot in Word, Excel, Outlook and Teams, including building a simple agent.
• To go further with agents, the AI agents training for companies has each participant configure an agent on their own tasks.
• For IT, the AI agent security course covers prompt injection, permissions and logging.
• To cost a rollout on your own estate, licenses, unlicensed population, credits and governance, Colombani.ai runs a scoping engagement through AI adoption strategy.

Colombani.ai is Qualiopi-certified for training activities. Its founder, Ulysse Trin, holds the Claude Certified Architect Professional, issued by Anthropic, and nine practitioner certifications issued by OpenAI.