Microsoft Gave Its AI Agents Their Own Work Email

Microsoft has given its AI agents their own email addresses, calendars and a place on the company org chart. Under the Copilot relaunch it detailed this week, every Autopilot agent gets a full Entra Agent ID user account with a productivity license — a real identity inside Microsoft 365, not a borrowed one.

That is a bigger change than it sounds. For two years, work agents have been assistants that answer inside a chat window. The moment an agent has its own mailbox, it becomes something you can assign work to, that appears in a directory, and that someone has to pay for by the minute.

What Microsoft actually announced

The company rebuilt Copilot around three surfaces: Home, Code, and Autopilot — the always-on agent, which reports describe as a rebrand and expansion of Microsoft Scout. Alongside it:

• A real identity per agent. Each Autopilot agent is a full Entra Agent ID user account carrying a productivity license. That is what unlocks its own email, calendar, OneDrive storage and Teams access, and puts it on the org chart as itself rather than as a shared service account.
• A licensed seat, not a free rider. The mailbox and storage are not free extras — several outlets note they depend on a separate licensed agent account and Frontier access, so "the agent has an email address" is a licensing decision as much as a technical one.
• Metered billing with a gate. Agent usage is billed by consumption, and Microsoft says usage-based services stay switched off until an administrator creates a spending policy. Nothing bills before that.
• Governance built in. The pitch is enterprise-grade control: Entra identity, audit logs, Purview data protection and human-controlled autonomy.
• A runtime for agent-built apps. Code-generated applications run on Copilot Managed Runtime, in public preview, hosted inside each customer's own Microsoft 365 tenant under existing identity and governance.

Autopilot enters private preview at the end of September 2026. Microsoft's stock moved up on the news, which tells you how much the company is betting on this framing.

Why an agent needs its own mailbox

The interesting engineering problem here is not the model. It is attribution.

When an agent acts through a shared service account, everything it does looks like the service did it. Audit logs can't cleanly separate the agent's actions from a human admin's. You can't revoke the agent's access to one thing without touching everyone else's. And you can't answer the question every security team eventually asks: which account sent that email?

A per-agent directory identity fixes all three at once. The agent can be granted a narrow permission set, its actions land in the log under its own name, and revoking it is a single directory operation rather than an archaeology project.

The trade-off arrives on the same day as the benefit. An identity that can hold a mailbox is an identity that can be phished, that needs a password policy, and that occupies a paid seat. Giving an agent an identity means giving it something to lose.

What admins have to decide now

If you run Microsoft 365, this turns into a checklist before the preview reaches you:

1. Find the identities you already have. Agents from Foundry have been receiving their own Entra identities since their June public preview. Look at what exists in your directory before you assume you know.
2. Set the spending policy first. Metered billing is off until an admin creates one, so the policy is the switch that turns cost on. Set the ceiling before the capability.
3. Decide the licence question. Whether an agent gets a mailbox is a licensing and Frontier-access question. That answer belongs in a policy, not in a per-team decision.
4. Write down what the agent may do unattended. Audit logs and data protection only help if someone defined the boundary they are auditing against.

That last point is the one teams skip. The controls Microsoft shipped are real, but they govern an agent whose limits were decided by a human somewhere upstream. Our guide to making an agent ask before it acts covers where to draw those lines in practice.

What this means if you are not on Microsoft 365

The pattern is the point, and it is arriving everywhere. Work agents get directory identities; consumer agents get their own Google or Meta accounts. You can see the same shape in Microsoft's earlier Scout agent, in Google's household agent with a separate account, and in the general argument for why agents need identities of their own.

For a personal agent, the practical version of "give it an identity" is simpler and you should do it anyway:

• Do not hand over your own credentials. The agent's access should not be your access. If it can read your mail as you, nothing it does is attributable and nothing is revocable without breaking your setup.
• Give it its own keys and its own scopes. A separate token with the minimum scope you can live with — that is the personal-scale equivalent of an Entra Agent ID.
• Add a spending ceiling. Wolffish's take on this is a budget you set once and an approval step for anything irreversible; the mechanics are in the safety patterns docs, and the same idea applies whether you run one agent or fifty.
• Keep the receipts. If you cannot answer "what did my agent do last Tuesday", you have an agent you cannot safely give more power to.

The organisation-chart tell

The most revealing detail in the whole announcement is that agents appear on the org chart as themselves. That is not a UI flourish. It is a company stating, in the one diagram every employee already understands, that a non-human worker now holds a seat with a name, a manager-facing cost and an access level.

Whether or not you touch Copilot, expect the same questions on a smaller scale: who does this agent report to, what is it allowed to spend, and what happens when it gets something wrong. Those are not AI questions. They are the questions you ask about anyone you give a mailbox.

Takeaway

Microsoft's Copilot Autopilot move turns agents from features into identities — an Entra account, a licence, a mailbox, a metered bill and a seat on the org chart. The technical core is attribution: a directory identity makes an agent's actions auditable and revocable, which is exactly what you need before you let it act unsupervised. Copy the pattern at your own scale: separate credentials, narrow scopes, a spending ceiling set before the capability.

Copilot Autopilot agents: the one-page brief