Skip to main content

Decision brief

Microsoft Copilot Studio Review: Building Agents Inside a Microsoft Tenant

Copilot Studio builds agents and agent flows for Microsoft 365 Copilot, Teams and websites, billed in Copilot Credits. Price the credits per action, then set data policies before makers publish.

Reading time
3 min read
Sources
18 cited
In this piece
Microsoft Copilot Studio−53 Strong negative

GILD verdict

Build agents in Copilot Studio when your organization runs on Microsoft 365 and wants them next to its Microsoft data, under the same data policies and Purview audit.

Budget in Copilot Credits from a pilot's real use, since every answer, action and flow step meters credits. Before makers publish, set data policies, a credit cap per agent and an owner for each agent's connections.

Microsoft Copilot Studio

Workflow Automation by Microsoft

−53 Strong negative
Product page

Fit and limits

Who it fits

  • Your organization runs on Microsoft 365, and agents should answer from SharePoint, Dataverse and Microsoft 365 content.
  • Many of your employees already hold Microsoft 365 Copilot licences, so their answers and grounding in Copilot Chat, Teams and SharePoint consume no credits.
  • Agents need Power Platform connectors, MCP servers and deterministic agent flows with human approvals.
  • IT wants agents governed by the same data policies, environments and Purview audit as the rest of Power Platform.

Where it falls short

  • Every answer and action meters credits, and tenant graph grounding costs 10 credits a time, so heavy knowledge agents get expensive.
  • Prepaid credits expire monthly with no carry-over, and usage above purchased capacity can be denied.
  • Security researchers have shown prompt injection by email exfiltrating data from an agent connected to Salesforce, and an agent leaking card data.
  • A builder on Microsoft GCC reported missing integration blocks, poor determinism and a laggy authoring interface in December 2025.

Implementation reality

  1. Set environments and data policies

    Create environments for development and production, and apply Power Platform data policies to both before anyone builds. Policies decide which connectors agents may use, with no exemption for agents.

  2. Pick models

    New agents on the standard harness default to GPT Chat Latest. Makers can also choose GPT-5.5 Chat, Claude Sonnet 5, Claude Sonnet 4.6 or Claude Opus 4.6, add external models from Anthropic, xAI or Mistral, or bring their own model from Azure AI Foundry for prompts. Models marked cross-geo can process data outside the tenant's region, so approve the list per environment.

  3. Budget credits

    Count credits per conversation in the pilot: a generative answer costs 2, an agent action 5, tenant graph grounding 10, and agent flows 13 per 100 actions. A pack of 25,000 credits costs US$200 a month; pay-as-you-go bills US$0.01 each. Set a monthly credit cap per agent.

  4. Audit and test

    Turn on Purview audit for Copilot Studio activity and test each agent against prompt injection through every channel that can reach it, including email triggers, before it reads production data.

What to verify before you buy

Data and retention

  • Data location: a tenant whose location the data locations table does not list stores Copilot Studio data in the United States.
  • Retention: prompts and responses covered by Microsoft Purview retention policies for AI apps can be retained and deleted for compliance.

Compliance and audit

  • SOC reports: available for Copilot Studio from the Microsoft Service Trust Portal.
  • Medical use: Microsoft says Copilot Studio isn't intended for use as a medical device.
  • Activity logging: administrative activity logging is on by default, provided users have an assigned Microsoft 365 license and the tenant isn't a FedRAMP tenant.

Models

  • Primary model: Microsoft says to choose it by response speed, output quality, reasoning and cost.

What to measure in your pilot

  • GILD found no independent measurement of credits per conversation for a typical knowledge agent; record your pilot's average before you size packs.
  • Recheck the model list each month, since Microsoft retires models such as GPT-5.3 Chat, which retired on Oct 15, 2026 in favor of GPT Chat Latest.
  • Ask Microsoft how credits apply to agents built with the GitHub Copilot harness, which practitioners report costs more than the standard harness.

Sources

Official documentation
18
  1. Microsoft: Microsoft Copilot StudioOfficial documentationmicrosoft.com
  2. Microsoft: Copilot Studio plans and pricingOfficial documentationmicrosoft.com
  3. Microsoft Copilot Studio Licensing Guide (October 2026, PDF)Official documentationcdn-dynmedia-1.microsoft.com
  4. Azure: Copilot Studio pricing (pay-as-you-go)Official documentationazure.microsoft.com
  5. Microsoft Learn: Copilot Studio licensingOfficial documentationlearn.microsoft.com
  6. Microsoft Learn: Copilot Studio billing rates and managementOfficial documentationlearn.microsoft.com
  7. Microsoft Learn: Select a primary AI model for your agentOfficial documentationlearn.microsoft.com
  8. Microsoft Learn: Agent flows overviewOfficial documentationlearn.microsoft.com
  9. Microsoft Learn: Use connectors in Copilot Studio agentsOfficial documentationlearn.microsoft.com
  10. Microsoft Learn: Configure data policies for agentsOfficial documentationlearn.microsoft.com
  11. Microsoft Learn: View Copilot Studio audit logs in PurviewOfficial documentationlearn.microsoft.com
  12. Microsoft Learn: Review ISO, SOC, and HIPAA complianceOfficial documentationlearn.microsoft.com
  13. Microsoft Learn: Data locations in Copilot StudioOfficial documentationlearn.microsoft.com
  14. Microsoft Learn: Quotas and limits for Copilot StudioOfficial documentationlearn.microsoft.com
  15. Microsoft Learn: Security and governance in Copilot StudioOfficial documentationlearn.microsoft.com
  16. Microsoft Learn: What's new in Copilot StudioOfficial documentationlearn.microsoft.com
  17. Microsoft Learn: Bring your own model for promptsOfficial documentationlearn.microsoft.com
  18. Microsoft Learn: Learn about retention for Copilot & AI appsOfficial documentationlearn.microsoft.com

Keep reading

  1. Buyer guideCopilot Studio Rollout PlaybookA checklist for taking Copilot Studio agents from a pilot to production: environments, data policies, models, credit budgets and monitoring.
  2. Buyer guideCopilot Studio Security, Data & Residency ChecklistHow data policies, Purview audit, customer-managed keys and data location apply to agents, and the agent security risks researchers have shown.
  3. ResearchCopilot Studio Credits in Practice: What an Agent Costs to RunHow Copilot Credits meter each answer, action and flow step, what the Microsoft 365 Copilot licence covers, and what admins and makers report about cost and control.
Read the research