Microsoft Copilot Plugin Registry Replaces Agents: Admin Controls, MCP Security and Rollout

Users will notice the change on screen. IT admins get a new governance job.

What a "plugin" means now​

Microsoft has used the word "plugin" for several different things over the years, so the definition matters. In the new model, a plugin brings together the capabilities users need to get work done in Copilot in a package that is easy to discover, use, and manage. Microsoft says a plugin can contain:

• Skills: reusable instructions for specialised work
• Connectors: approved access for Copilot to services and data
• Agents: customised versions of Copilot for specific uses

Microsoft's admin documentation on Learn also says plugins can include Model Context Protocol (MCP) servers. Not every plugin contains every component type. What's inside depends on the package.

The visible change for users: this Plugins page replaces and expands on the existing Agents page, providing continued access to all of your Agents, as well as Skills and Connectors, in one place. Agents are not being retired. While the term "Plugins" is replacing "Agents" in the top-level UI of Copilot, Agents remain an important part of Copilot extensibility.

One source of confusion: older Microsoft developer documentation also uses "plugin" in a narrower technical sense. That documentation uses plugin for the technical MCP or API custom action used by a declarative agent, and points to a separate page for the customer-facing plugin product, package, registry, and lifecycle. If you search Microsoft Learn and find pages that seem to contradict each other, this split in terminology is usually why.

Section summary: "Plugins" is now the top-level name for packaged Copilot extensions. Agents still exist inside that name, and the Agents page is becoming the Plugins page.

What end users will see​

Microsoft's Message Center notice for the change is MC1484008. A summary of that notice says users will see a new Plugins button instead of Agents, Agents & Skills, or Customize. The same summary says no setup or migration is required, but communication and documentation updates should be scheduled during rollout completion.

That means the main cost is updating training material and expecting some help desk questions. If your onboarding guides tell people to "click Agents," they'll be out of date as the rollout reaches your tenant.

According to Microsoft, users will find plugins you've enabled through one Plugins menu in Home (Chat and Cowork), Code, Autopilot and the supported Microsoft 365 apps. The aim is to cut down on users discovering and setting up the same tools separately in each app.

Where admins manage plugins​

Central management lives in the Agent 365 experience in the Microsoft 365 admin center, under Agents > Tools. Microsoft says admins can review Microsoft, custom-built and partner plugins, turn them on or off, and block them or assign them to users or groups. Admins can also review new versions, see where a plugin is in use, and decide when to expand, limit or retire it.

Microsoft's Learn article "Manage plugins, skills, and MCP servers," updated September 29, 2026, gives the actual procedures. Here are the main ones.

Set which publishers are allowed across the organisation​

1. Sign in to the Microsoft 365 admin center.
2. Go to Agents > Settings > Agent and plugin access.
3. Under the installation settings, choose which publisher categories users can access: Microsoft, your organization, or certified external publishers.

If you leave a category unselected, its plugins are still visible to users. They show a message saying the plugin is blocked by your organization's policy. To block all third-party plugins, Microsoft's FAQ says to clear the certified external publishers category.

Scope one plugin to specific people​

1. Go to Agents > Tools > Plugins and select the plugin.
2. Open Users and choose All users, No users, or Specific users and groups.
3. Review your choice and save.

Users who are blocked can still see the plugin and select Request access. Admins review those requests under Agents > Tools > Requests.

Upload a custom plugin​

A developer first packages the plugin or skill into a manifest file. The admin then goes to Agents > Tools > Registry > Upload, uploads the manifest, checks the components it contains (such as MCP servers and skills), scopes it to users and installs it. Installing makes it ready for the chosen users without each person installing it themselves.

Uninstall, delete and block are three different actions​

Learn defines them as follows:

• Uninstall removes the plugin from the environment until you install it again.
• Delete removes a package uploaded to your tenant from the registry. You can't delete plugins that come from the Microsoft 365 Store.
• Block stops users and agents across the organisation from accessing it.

Blocking has knock-on effects you should know before you click. Blocking a plugin package also blocks the agents it includes. Blocking an MCP server also blocks plugins that depend on it and any linked connectors. Microsoft's Cowork guidance also notes that Cowork plugins can appear in either Agents > All Agents or Agents > Tools, because some agents also function as Cowork plugins. If you can't find something in one list, try the other.

Section summary: Set publisher categories first, scope each plugin second, and check what depends on a plugin or server before you block it.

MCP servers and connectors need the most care​

For security teams, connectors and MCP servers matter most because they give Copilot access to real business systems. The Learn documentation adds several controls here:

• Approving an MCP server takes two steps. After you approve a registration request on the Requests (preview) tab, you also have to grant Microsoft Entra consent for the server's permissions before it becomes available. Microsoft says it can then take up to 30 minutes to appear in every Copilot Studio environment in the tenant.
• Only two roles can do it. The approver needs access to the Tools page and the right to grant tenant-wide consent. Microsoft names AI Administrator and Global Administrator as the roles that have both, and recommends least-privilege role assignment.
• You can control individual tools, on some servers. Tool-level control is still rolling out and only works with certain MCP server types registered on Agent 365. Where it's available, you can switch off risky tools, such as ones that write, delete or process payments, and keep read-only tools on. If a server doesn't support tool discovery, you can only allow or block the whole server.

My advice from general enterprise IT experience: don't approve a connector-heavy plugin just because the vendor is well known. Check what it can actually do. A plugin that lets Copilot edit records in your CRM needs more scrutiny than one that searches a research database.

For developers: Work IQ Developer Tools​

Microsoft is pointing builders to Work IQ Developer Tools (WIQD) for the full plugin process: build, preview, validate, package and publish to the registry. Microsoft 365's developer blog says if your existing plugin uses the Agent Plugins format, you can import it into WIQD, and that format packages skills and MCP server configurations. The other route is to start from the business outcome you want and create a new plugin. You can run WIQD commands directly or through a coding tool such as GitHub Copilot CLI.

The developer blog sums up the idea as "Build once. Validate for each surface." Microsoft says developers publish and update one package for admin review, instead of maintaining separate deployment files for each Copilot experience. Organisations still decide what gets approved and who gets it.

The registry is where plugins get published and governed. It doesn't test them for you. Microsoft's plugin documentation still describes a full lifecycle of preparing, building, testing, publishing, governing, updating and retiring a plugin.

The catalogue at launch​

Microsoft says more than 100 plugins are already available, covering finance, sales, project management, creative work, IT service management, market research and software development. Named examples include:

Microsoft's own Cowork documentation also lists plugins for Microsoft applications, including Dynamics 365 Customer Service, Dynamics 365 ERP, Dynamics 365 Sales, and Fabric IQ.

Microsoft adds that some connectors are still rolling out, so don't assume every listed integration is live in your tenant yet.

Licensing and open questions​

Microsoft says basic registry and management features for Copilot experiences come with "qualifying Microsoft cloud subscriptions." It doesn't list which plans qualify, and "basic" suggests more advanced features may be sold separately later. Microsoft has also not given a date for when each tenant gets the rollout.

The announcement is a vendor blog post, so it focuses on the benefits. The advantages are real: one catalogue, one place to assign plugins, one packaging route for developers. Bundling also has a downside. Packaging agents, skills, connectors and MCP servers together makes plugins easier to install, but it also makes it less obvious what you're approving. Microsoft's own blocking rules show this: blocking one MCP server can take several plugins down with it. Admins should look at what a plugin depends on before they approve it.

What to do this week​

1. Check Message Center for MC1484008 and see where your tenant is in the rollout.
2. Update user guides that mention Agents, Agents & Skills, or Customize.
3. Set publisher categories under Agents > Settings > Agent and plugin access before users start requesting plugins.
4. Decide who handles requests under Agents > Tools > Requests, so they don't go unanswered.
5. Review MCP approvers. Keep AI Administrator and Global Administrator assignments to as few people as possible.
6. Check what connectors can do, and use tool-level blocking where your server types support it.

Bottom line: The plugin registry gives Copilot extensions one catalogue and one set of admin controls. It works for organisations that set up publisher policies, scoping and MCP review early, and it means more cleanup work later for organisations that don't.