Copilot Studio Persistent Agent Identity: Microsoft 365 Mailboxes and Teams Presence Planned

This is a roadmap item, not a shipped feature. The entry lists it as In development, with preview targeted for September 2026 and general availability for November 2026. It covers the Web platform and the Worldwide (Standard Multi-Tenant) cloud only. September is already over and the roadmap entry alone doesn't show that the preview has launched, so treat both dates as targets. Microsoft's roadmap also says all information is subject to change and that entries can be removed if a feature is cancelled or postponed.

What the roadmap item says​

Here are the facts from the roadmap record:

• Product: Microsoft Copilot Studio
• Status: In development
• Preview target: September 2026
• GA target: November 2026
• Release rings: Preview, then General Availability
• Cloud: Worldwide (Standard Multi-Tenant) only. GCC, GCC High, DoD and sovereign clouds aren't listed.
• Capabilities named: a dedicated account per agent, with its own mailbox, Teams presence and Office access
• Governance claim: admins can manage the agent's access, policies and usage as a separate entity

The entry doesn't cover licensing, provisioning steps, mailbox type, which Office apps are included, how Teams presence behaves, retention, or which specific policy controls apply. Anyone filling in those details right now is guessing.

Summary: The roadmap promises account-holding Copilot Studio agents for commercial multi-tenant customers. It doesn't say how they'll work.

How this differs from today's Entra Agent IDs​

This is easy to confuse with something that already exists, so here's the difference.

According to Microsoft Learn's Copilot Studio documentation, every new agent already gets a Microsoft Entra Agent ID automatically. Microsoft's timeline: before May 2026, Copilot Studio created an Azure app registration for each agent. Since May 2026, new agents get an Entra Agent ID instead, and admins can no longer opt out at the environment level. Older agents still run on app registrations until Microsoft migrates them. Admins can also migrate them manually through the Power Platform admin center, PowerShell scripts or Power Platform APIs. Microsoft says governance features work on both identity types during the transition.

An Agent ID handles identification and governance. It doesn't give the agent an inbox. Microsoft's Entra documentation separates the agent identity, a software identity that doesn't use human sign-in methods, from an optional agent user account. That account is a special Entra user account paired one-to-one with the agent identity, for cases where the agent needs to appear and operate like a human user. Microsoft also notes that human user identities come with things like mailboxes, Teams and a place in the org hierarchy. Those are the same things this roadmap item promises Copilot Studio agents.

Earlier WindowsForum coverage of Microsoft's agent identity model, which draws on Microsoft's Agent 365 identity documentation, sets out the layers. An agent identity is a special Entra service principal the agent runs as, with its own object ID, sponsor and permissions. The agent's user account is an optional second Entra user account, flagged as an AI agent, and it brings email and OneDrive only with the appropriate licenses. With the right licenses, that account gives the agent a mailbox and OneDrive storage, a presence in directory metadata, and a way to be reached through Teams, Outlook, Word comments and email. The same coverage noted that agents with their own user accounts are available only to tenants participating in the Frontier preview program.

Roadmap 570430 reads like Copilot Studio getting that account layer, set up by makers instead of developers. That's an inference. Microsoft hasn't said the feature uses agent user accounts, needs Frontier, or needs an extra license.

Summary: Agent IDs exist today and are mandatory for new agents. Persistent identity adds mailbox, presence and Office access, which the Agent ID doesn't provide.

Why "persistent" matters: from on-behalf-of to the agent's own account​

How Copilot Studio agents act today explains why this matters. Microsoft's Agent 365 builder documentation says most Power Platform connectors use on-behalf-of (OBO) authentication: the agent acts with the signed-in user's permissions. The user may see a consent prompt the first time, and the audit log records the action as the user's, with agent context attached.

That works for personal assistants. It's awkward for shared processes. Say an agent handles a shared intake queue for HR, facilities and finance. Under OBO, whose mailbox sends the confirmation email? Whose permissions does it run on at 2 a.m. when nobody's signed in? What happens when the employee whose connection it relied on leaves the company?

An agent with its own mailbox and Teams presence could own the process itself. It could have a steady address people email, a name they @mention, and a single identity to audit, rather than a trail of borrowed credentials. That's the shift the roadmap describes: the agent goes from borrowing user permissions to holding its own account.

Summary: OBO ties agent actions to whichever human is signed in. A persistent account would give shared workflows a stable owner of their own.

What admins can already govern​

Some of the governance groundwork is already in place and documented:

• Connector permissions show up in Entra. When a maker publishes an agent, Copilot Studio adds API permissions to its Entra Agent ID for each Power Platform connector it uses. Entra and Microsoft 365 admins can see what the agent can call without opening the Power Platform admin center.
• Conditional Access can target those permissions. Admins can require network location, device compliance or risk conditions before tokens are issued for a given connector.
• No bypass. Microsoft says only the Power Platform connector runtime honors these scopes, and it rechecks them against advanced connector policies and data policies at runtime.
• Lifecycle cleanup. Deleting an agent in Copilot Studio also deletes its Entra Agent ID.
• Sponsorship. Microsoft's Entra documentation says the person who creates a Copilot Studio agent is recorded as its sponsor.

Check whether an existing agent has an Agent ID​

Microsoft Learn documents this procedure:

1. In Copilot Studio, open the agent's Settings page.
2. Select Advanced.
3. Expand Metadata. The identity's GUID appears under Entra Agent ID.
4. Look up that GUID in the Microsoft Entra admin center to confirm the identity exists.

All of these identities sit under a shared tenant blueprint named Microsoft Copilot Studio agent identity blueprint, blueprint ID 25664c89-cea5-4ab6-b924-a54fd8a19ae0. Copilot Studio adds it the first time an agent is created after the rollout. If that blueprint has suddenly appeared in your tenant, this is the reason.

Summary: Visibility, Conditional Access and lifecycle controls already exist for Agent IDs. It's still unknown how they'll carry over to agents with mailboxes.

Questions IT should ask before November​

This is my analysis rather than anything Microsoft has said. Once agents have mailboxes, they start to look like staff accounts with no person behind them. Before turning this on, admins should get answers to:

• Licensing: Does each agent account need a Microsoft 365 or Agent 365 license? Microsoft's Entra documentation already says extending Entra security features to agents requires Agent 365, which is included in Microsoft 365 E7 or sold as an add-on.
• Who can create one: Can any maker give an agent a mailbox, or does it need admin approval?
• Data governance: Do retention, eDiscovery, DLP and sensitivity labels apply to the agent's mailbox and files the same way they apply to people's?
• Attribution: Will audit logs clearly mark agent-account actions as AI-driven, separate from OBO actions?
• Exit plan: When an agent is retired, what happens to its mailbox, its Teams chats and the files it owns?

A skeptic would point out that Microsoft's first-class entity language is aspirational, and every new identity is something else to secure. A mailbox that receives outside email is also a new way for prompt injection to reach the agent. Supporters would answer that a dedicated, governed account is safer than the current mess of shared service accounts and borrowed user sessions. Both arguments hold up. It'll come down to the controls Microsoft actually ships.

The bottom line​

According to its roadmap, Microsoft plans to let Copilot Studio makers give agents their own Microsoft 365 accounts with a mailbox, Teams presence and Office access. Preview is targeted for September 2026 and GA for November 2026, for Worldwide commercial tenants only. Today's mandatory Entra Agent IDs give admins visibility and Conditional Access over connector permissions, but they don't give agents an inbox. Until Microsoft publishes documentation, licensing terms and admin controls for this feature, plan for it but don't build production workflows on it.