Microsoft Work IQ MCP to Let AI Agents Read Copilot Memory: Admin Policy and Privacy Controls

The roadmap entry is brief, but the matching Message Center notice, MC1539004, adds most of the useful detail. Message Center trackers describe the path as giving authorized agents read-only access to a user's personalized memory profile, including Custom Instructions, Saved Memories, and chat history insights. The read-only part is the most important detail for admins.

What the roadmap item promises​

The official roadmap record says the memory profile will include four kinds of content at launch:

• Custom Instructions: the standing guidance a user gives Copilot about how to respond
• Saved Memories: facts or preferences the user has explicitly asked Copilot to remember
• Relevant work account data
• Memories derived from chat history

Microsoft also says the profile will continue to evolve and improve over time. In other words, the contents may grow after launch.

The two Microsoft texts don't fully match. The roadmap lists "relevant work account data" as part of the launch profile. The Message Center text as reproduced by trackers lists only Custom Instructions, Saved Memories and memories derived from chat history. Elsewhere, the notice does say the chat-history setting covers "insights from chat history and Microsoft 365 activity," which may be how the work data gets in. Until Microsoft publishes developer documentation for the path, builders shouldn't assume the exact shape of the returned profile.

Summary: Agents get one standard place to read what Copilot already knows about a user's preferences, but the full contents of that profile aren't documented yet.

How it fits Work IQ MCP​

The new path fits how Work IQ MCP was built. Microsoft's Work IQ MCP overview describes a server that exposes Microsoft 365 intelligence to AI agents through the Model Context Protocol. A small set of generic tools (fetch, create_entity, update_entity, ask, retrieve, get_schema and others) act on relative resource paths. The tool is the verb and the path is the noun. For example, fetch /me/messages reads email and create_entity /me/events creates a calendar event.

Microsoft's stated design rule is "fewer tools, more paths": new workloads add paths rather than new tools. So memory doesn't need its own tool. It becomes another address that the existing fetch tool can read. Trackers quoting the notice confirm that the path supports only the fetch tool.

The same overview says Work IQ MCP uses Microsoft Entra ID for authentication. Four broad OAuth permissions control what agents can do, with finer access control enforced per path, method and tenant policy. That model explains how a dedicated memory policy can sit alongside the existing read and write controls.

Microsoft's Copilot Studio documentation describes Work IQ as having three layers: Data, Memory and Inference. The memory layer builds persistent understanding of how people and teams work, helping Agent 365–managed agents stay aligned to priorities and remain consistent across tasks, apps, and sessions. Until now, that memory mostly served Microsoft's own Copilot experiences. This path lets other agents read it as well.

Summary: This doesn't add a new integration. It's one more readable path on a server that agents already use.

The guardrails​

The limits described in the notice keep the feature narrow:

1. Read-only. According to the reproduced notice, memory cannot be written or modified through Work IQ MCP. An agent can read the profile but can't add memories or edit the ones a user saved.
2. Self-only. Only the authenticated user's memory profile is available. A user's memory profile is not shared with other users. A user's agent can't read a colleague's memory.
3. Admin policy, on by default. The notice describes a new memory read policy in the Microsoft 365 admin center under Agents > Tools > Registry > Work IQ MCP > Policies. A new admin policy controls access to memory through Work IQ MCP in the Microsoft 365 admin center and is enabled by default.
4. User settings are respected. What goes into the profile depends on each user's Copilot personalization choices, covered below.

Some readers will be concerned about the default. The policy follows Microsoft's usual approach for read policies, which ship turned on. Any tenant that already lets agents use Work IQ MCP will therefore expose memory reads once the feature rolls out, unless an admin acts. The read-only, self-only scope limits the risk. Still, a company whose users have put sensitive context into Saved Memories or Custom Instructions should decide on this deliberately rather than by default.

Which settings decide what agents see​

The reproduced notice ties the profile's contents to settings users already have under Copilot Chat > Settings > Personalization:

The notice also says changes to Enhanced personalization and to these user settings can take up to 48 hours to take effect. Helpdesks should expect some "I turned it off, why does the agent still know?" tickets during that window.

Developers should not assume every authorized agent will get a full profile. For some users, the response may be partly or entirely empty because of their settings. An agent that depends on memory to work properly needs a fallback for those cases.

Summary: Admins control whether agents can read memory at all. Users control which parts of their memory the profile contains.

Timing and what's still unconfirmed​

Microsoft's roadmap page warns that its dates are estimates and that all information may change. Trackers quoting the notice give a narrower window: rollout starting in early December 2026 and completing by late December. Treat those dates as Microsoft's current plan, not a guarantee.

Some details remain unknown. As of this writing, Microsoft's public Work IQ MCP overview doesn't document the memory path, its response schema, or the policy blade. The admin center location and setting names come from reproductions of the Message Center notice. Several independent trackers carry consistent text, which is reassuring, but they are not official reference documentation.

Licensing for the memory path isn't covered in the material reviewed. Earlier this year, Forward Forever wrote that you must have a Microsoft 365 Copilot license to use Work IQ MCP servers. Microsoft's current Copilot Studio documentation says Work IQ there runs on the GitHub Copilot harness and uses Copilot Credits for consumption billing. Neither source says anything specific about memory reads, so check your agreement rather than assuming.

What admins and builders should do now​

For Microsoft 365 admins:

1. Find the Work IQ MCP entry under Agents > Tools > Registry in the Microsoft 365 admin center. Once the memory read policy appears there, decide whether the default (enabled) fits your governance stance.
2. Check whether Enhanced personalization is on in your tenant. It is the master switch: if it's off, no memory reaches agents through this path.
3. Update user-facing guidance. Users should know that Custom Instructions and Saved Memories may soon be readable by agents they authorize, not just Copilot Chat.
4. Review which agents in your tenant can reach Work IQ MCP. Memory reads only go to agents that already have that access.

For agent developers:

1. Expect to call fetch against /memory/me/coreMemories. Don't plan any write operations, because there are none.
2. Handle partial or empty profiles, since user settings remove parts of the profile.
3. Treat the profile as personalization context, not authoritative data. Microsoft says its contents will keep changing.
4. Wait for Microsoft to publish the schema before you build parsing logic around specific fields.

The bigger picture​

Microsoft's agent strategy has been working toward this. Copilot has been building per-user context through custom instructions, saved memories and chat-derived insights, and agents built outside Copilot Chat have had no way to read it. Without it, a custom agent starts every session knowing nothing about the user. That's poor for productivity, though at least the agent has no history to get wrong.

Microsoft's approach here is fairly cautious: read-only access, self-only scope, an admin kill switch, and respect for user settings. The open questions are the default-on policy and the unclear "work account data" category. A careful rollout would have admins make an explicit decision before December. Leaving it to the default means agents will start reading user memory without anyone having approved it.