Microsoft’s latest Copilot Studio updates move "computer‑using agents" from intriguing demos toward practical, auditable automation for broad enterprise use—delivering model choice, built‑in credential management, step‑level observability, and a managed Cloud PC runtime that together aim to fix the three things early customers complained about: scale, secure unattended authentication, and forensic visibility.
Background / Overview
When Microsoft first introduced computer‑using agents (CUAs) in Copilot Studio, the promise was straightforward: agents that can
see a screen,
understand UI elements, and
act—clicking, typing, and navigating just like a human when no API exists. Early adopters proved the concept by automating legacy apps, stitching together brittle workflows, and reducing manual touchpoints. That initial phase also exposed practical gaps: authentication interrupts unattended runs, debugging UI flakiness was laborious, and scaling desktop capacity required managing fragile VM fleets.
The February 2026 updates respond to those gaps with four practical pillars:
- Model choice (including Anthropic’s Claude Sonnet 4.5 alongside OpenAI models) for workload fit and better reasoning on dynamic UIs.
- Secure authentication via built‑in credentials with an option to use Azure Key Vault for enterprise secret management.
- Richer observability: session replay, step‑by‑step action logs, Dataverse storage with configurable verbosity and retention, and Microsoft Purview audit integration.
- Managed runtime capacity through Cloud PC pools powered by Windows 365 for Agents so organizations don’t have to babysit VMs.
These changes take CUAs beyond experimental proof‑of‑concepts into features enterprises can evaluate with governance and SLA thinking in mind.
Why multi‑model choice matters for UI automation
Model selection = better accuracy on dynamic UIs
Not all tasks are the same. Some UI automation tasks require robust stepwise orchestration across stable fields; others require deep reasoning when dashboards shift layout or text density spikes. Microsoft now lets you pick the model best suited for the job—OpenAI’s Computer‑Using Agent for multi‑step orchestration, or Anthropic’s Claude Sonnet 4.5 for high‑performance reasoning on
dynamic UIs. Having explicit model choice is more than marketing; it lets teams tune for accuracy, latency, and cost by mapping agent workloads to model strengths.
Practical implications for IT and DevOps
- Reduced flakiness: a reasoning‑optimized model handles layout shifts and ambiguous labels more robustly.
- Cost control: route low‑risk, high‑volume flows to cheaper models; reserve high‑capability models for complex decisioning.
- Vendor diversification: adding Anthropic expands options and reduces single‑vendor dependency—important for procurement and resilience planning.
Bottom line: pick the right model for the interface complexity, and your failure rate drops.
Secure authentication: built‑in credentials and Azure Key Vault
What changed
Authentication used to be a major operational stopper for unattended CUA runs: manual login prompts, MFA challenges, and ephemeral sessions forced human intervention. The new computer‑use tooling supports
built‑in credentials for agent runs and gives tenants two storage options:
- Internal, encrypted storage (Power Platform) for quick setup, or
- Azure Key Vault for enterprise‑grade secret lifecycle and access controls.
Microsoft states that credentials are encrypted and
never exposed to the model; instead, authorized agent runtimes access secrets at execution time, which preserves model isolation from secret material. For organizations that require strict secret handling and audit trails, Azure Key Vault integration is the recommended path.
Governance and safety controls to apply
- Use least‑privilege service accounts for Cloud PC sessions; avoid running agents with owner/admin Windows tokens.
- Pair credential use with conditional access and device compliance policies to restrict where those secrets can be used.
- Require just‑in‑time (JIT) or approval gating for any agent that performs destructive actions (deletes, modifies financial records).
- Log secret access attempts and forward to SIEM for anomaly detection.
These practices close a major gap: unattended automation without security debt.
Observability and compliance: session replay, action logs, Purview, and Dataverse
What you can now see
One of the most significant additions is a forensic‑grade observability stack for each computer‑use run:
- Session replay: chronological screenshots that show exactly what the agent saw.
- Step‑by‑step action logs: action types, screen coordinates, timestamps, and contextual metadata.
- Run summaries: instruction text, duration, action counts, average time per action, and human escalation count.
- Resource tracking: websites, desktop apps, and credentials used.
- Exportable session logs for offline review or regulatory audits.
This level of visibility reframes CUAs from opaque automation to auditable process‑actors.
Integration with enterprise compliance controls
- Microsoft Purview: you can forward audit logs to Purview so runs enter the organization’s compliance lifecycle and eDiscovery tooling.
- Dataverse logging: advanced logs can be stored in Dataverse with configurable verbosity—All data, Data without screenshots, or Minimal—so teams can balance forensic needs with storage cost and privacy.
- Retention: defaults and maximums are configurable (default 7 days; custom retention up to indefinite), enabling alignment with sector regulations where long‑term retention is required.
How this matters in practice
Consider an agent that unexpectedly updates a vendor’s master record. Previously you’d have to reconstruct the incident from sparse logs. Now you can replay the agent’s screen view, inspect the exact click sequence, identify the failed detection, and export the record for auditors. That reduces mean time to resolution (MTTR) and strengthens defensibility in regulated audits.
Managed Cloud PC pools: scalable runtime without VM sprawl
The challenge: scaling desktop automation
High‑volume UI automation historically forced organizations to maintain pools of patched machines, handle OS updates, and manage availability windows—operational overhead that erodes automation ROI.
Microsoft’s answer: Cloud PC pool for computer use
Copilot Studio now supports
Cloud PC pools—managed, Microsoft Entra‑joined, Intune‑enrolled Windows 11 Enterprise images designed for computer‑use runs. Key attributes:
- Auto‑scale up to meet demand (Cloud PC pool can scale to multiple machines based on queue).
- Machines are managed by Microsoft and enrolled into tenant governance (Entra + Intune).
- A trial option: up to two Cloud PC pools per tenant with 50 free hours of usage for published autonomous agents to pilot at scale.
The Cloud PC pool model removes the need to run your own hypervisor farm for UI automation, shifting maintenance and patch management to the managed service.
Operational guidance
- Start small: use the free trial pools to exercise automations and measure run characteristics.
- Harden images: lock down shared Cloud PCs—remove local admin, restrict persistent storage, and enforce disk encryption.
- Control identity surface: use dedicated service accounts for agent runs and limit which credentials are available on each pool.
- Monitor quotas and cost: Cloud PC pool is metered—forecast hours for peak windows and set throttles to avoid runaway bills.
Extending, not replacing, classic RPA
A pragmatic coexistence
Microsoft frames CUAs as an extension to classic RPA (Power Automate desktop and unattended RPA), not a wholesale replacement. Use cases:
- Keep deterministic, selector‑stable flows in RPA where cost and reliability favor deterministic automation.
- Employ CUAs to handle non‑deterministic UI interactions: dynamic dashboards, visual changes, or dialog boxes that break selector logic.
- Combine both: have the RPA flow call a CUA for the brittle, reasoning‑intensive portions and continue with robust API‑driven steps afterwards.
This hybrid approach reduces maintenance overhead and preserves investments in existing automation.
Security and governance: strengths and remaining risks
Strengths in the new release
- Secret isolation: credentials are encrypted and can be stored in Azure Key Vault, separating secrets from model contexts.
- Auditable runs: session replay and detailed logs provide the provenance organizations need to satisfy compliance.
- Managed runtime: Cloud PC pools reduce attack surface associated with in‑house VM orchestration.
- Model choice reduces error rates: ability to select reasoning‑optimized models for complex UIs reduces misreads and unintended actions.
Residual risks and operational caveats
- Privilege escalation risk: if an agent runs with elevated Windows credentials, it can perform broadly privileged actions. Mitigate by running with narrowly scoped accounts and applying JIT approvals.
- Credential proliferation: storing many reusable credentials—even in Key Vault—creates a management surface that must be governed with rotation, access policies, and logging.
- Runtime decision hooks: preview features that forward planned actions to enforcement endpoints may default to permissive fallbacks if a third‑party monitor times out—test these failure modes before critical rollout.
- Data residency and third‑party models: using third‑party models (e.g., Anthropic via API endpoints) may route data outside your cloud boundary—verify data handling and residency requirements with procurement and legal. Independent reporting confirms Anthropic models may run outside Azure in some deployments.
What to validate in your tenant before you scale
- Confirm whether chosen models process tenant data in‑region and whether model provider contracts meet your data processing agreements.
- Run a threat model for unattended runs that includes credential compromise, UI spoofing, and malicious web content exposure.
- Validate fail‑safe behavior: define and test what happens when an agent sees sensitive content or cannot authenticate.
Implementation checklist — design, deploy, and operate CUAs
Follow these steps to move from pilot to production with defensible controls.
- Pilot with isolated data and Cloud PC pools: use the two free pools and 50 hours trial to understand run characteristics.
- Harden runtime images: remove unnecessary software, enforce disk encryption and Intune compliance.
- Centralize credential storage in Azure Key Vault and enforce RBAC and rotation policies.
- Enable Dataverse logging with the appropriate verbosity and retention for your compliance posture. Export logs to a secure archive for long‑term evidence preservation if required.
- Configure Purview ingestion for audit records to unify Copilot activity with your wider compliance records.
- Build human escalation paths: any agent performing non‑reversible or high‑risk actions should require a human approval step or alert channel.
- Run red‑team tests: validate resilience to prompt injection, UI spoofing, and simulated secret compromise.
- Document and train: operational playbooks are essential so SOC, SRE, and business owners can act when automation misbehaves.
Cost, licensing, and operational economics
- Cloud PC pools are metered; proof‑of‑concepts should measure average runtime per run and concurrency patterns to estimate consumption. The documentation notes pay‑as‑you‑go billing with Azure meters.
- Dataverse logging consumes Dataverse capacity (database, log, and file storage) when enabled—budget for storage and potential export costs.
- Model selection impacts cost—high‑capability models cost more per token or invocation, so reserve them for steps that materially benefit from deeper reasoning.
Plan total cost of ownership (TCO) by combining Cloud PC runtime, model calls, and Dataverse storage to ensure automation remains economical when scaled.
Community pulse and real‑world reception
Early forum and community threads reflect a mix of enthusiasm and prudent skepticism: practitioners applaud the visibility (session replay) and managed Cloud PC approach but warn about credential hygiene and operation complexity as automation scale grows. These community conversations underscore two consistent themes: governance must lead, and pilots should validate failure modes.
Known unknowns and claims to verify in your environment
Microsoft’s public materials and docs are explicit about many features, but some tenant‑specific behaviors require validation:
- Exact model hosting and data flow for third‑party models (Anthropic) can vary by program and contract—confirm whether the model call is routed through Microsoft Foundry or directly to the provider and whether data is stored or logged by the model provider.
- Runtime enforcement timeouts and default failover behaviors for real‑time monitors: preview tooling may have default‑allow fallbacks that need explicit configuration. Test these scenarios in your environment.
- The encryption guarantees for built‑in credentials are strong in documentation, but compliance teams should request explicit attestations or encryption key handling details from Microsoft when required for audits.
Where vendor statements are ambiguous, treat them as
operational hypotheses and design tests that either validate or disprove those hypotheses before full rollout.
Conclusion: a pragmatic next step for IT leaders
Microsoft’s Copilot Studio updates for computer‑using agents convert a promising capability into a governed, auditable automation platform. The combination of multi‑model choice, built‑in credential options (including Azure Key Vault), step‑level observability, and managed Cloud PC pools addresses the three biggest adoption blockers enterprises reported: scale, unattended authentication, and forensic visibility.
But practicality matters: treat CUAs as an extension of your automation portfolio, not a replacer of good security practices. Run conservative pilots using the free Cloud PC trial hours, lock down credentials with Key Vault and RBAC, enable Dataverse logging at the verbosity commensurate with your risk, and bake human approvals into any high‑risk path.
If you steward automation in a regulated environment, the key to success will be: measure (logs and run characteristics), govern (secrets, identity, and runtime policies), and validate (red‑teaming and failure modes). Do that, and CUAs will move from fragile curiosities to dependable, auditable workhorses in your automation ecosystem.
Source: Microsoft
Improve complex UI automation with computer‑using agents | Microsoft Copilot Blog