Summary
- Microsoft is introducing a new admin control for advanced Copilot extensibility that lets organizations restrict who can upload advanced agents and plugins.
- Administrators can allow uploads for all users, selected users, specific Microsoft Entra ID groups, or block them entirely.
- The setting applies only to advanced-package uploads created after the control is available; basic package uploads are not affected.
- Microsoft states no action is required to keep current behavior, but admins should review and choose the desired governance setting.
- This change primarily affects Microsoft 365 admins and users who create or upload Copilot agents or plugins.
Microsoft is introducing a new administrative control for Microsoft 365 Copilot that governs who can upload advanced agents and plugins starting September 2026. Global rollout runs through October 2026. Uploads are enabled by default for all users unless administrators restrict access to specific individuals or Entra ID groups by October 25. Administrators should review their organizational governance policies and configure these settings before the default state applies.
Administrator impact: Administrators must configure new upload permissions in the Microsoft Admin Center by October 25 if they wish to restrict advanced package deployments beyond the default setting.
End user impact: End users will be subject to new organizational restrictions regarding which individuals can upload advanced Copilot agents and plugins.
Score rationale: This change introduces new governance controls that require administrative review and configuration to prevent unintended advanced agent uploads across the tenant.
Starting September 25, Microsoft 365 admins can control who uploads advanced Copilot agents and plugins, limiting access to specific users or Entra ID groups. This governance feature rolls out worldwide by October 2026, with default uploads enabled unless admins configure restrictions by October 25. Basic uploads remain unaffected.
Microsoft 365 Message Center ID: MC1472007
Admin Impact: Medium
User Impact: Low
Release Start: 25 Sept 2026
Release End: 31 Oct 2026
Published: 15 Sept 2026
Expires: 30 Dec 2026
Last updated: 15 Sept 2026
Products & Platforms: Microsoft Copilot (Microsoft 365)
Category: Plan for Change
Tags: New feature, Admin impact, Major Change
Status: Launched
History
Updated September 15, 2026: We have updated the content below with additional information.
9/14/2026 Item Added to Message Center
Microsoft Message
To help organizations manage the deployment of advanced Copilot extensibility scenarios, we are introducing a new admin control that determines who can upload advanced agents and plugins. This enhancement strengthens enterprise governance and manageability by allowing administrators to limit advanced-package uploads to specific users or Microsoft Entra ID groups while maintaining flexibility for organizations that want broader access.
Rollout Schedule
- General Availability (Worldwide): Rollout begins September 25th
- Expected completion by the end of October 2026.
Impact on Your Organization
Who is affected
- Microsoft 365 administrators responsible for managing Copilot agents and plugins.
- Organizations that allow users to upload advanced agents or plugins.
- Users who create or upload advanced agents and plugins after this feature becomes available.
Platforms/Services
- Microsoft 365 Copilot and Cowork surfaces, ATK
- Copilot agents
- Copilot plugins
- Microsoft Entra ID
What will happen
- On September 25th, the control will be visible in MAC under Copilot Settings and admins will have until October 25th to select their preference of all users, no users or specific users or groups (see Advanced package uploads screenshot).
- Starting October 25th, Advanced-package uploads will be enabled by default unless the admin has selected no users or specific users or groups.
- Admins can configure uploads for all users, selected users, Entra ID groups, or no users.
- Basic package uploads remain allowed and are not impacted.
- An advanced agent is a package that has either a Declarative Agent with actions or with an MCP server. All other packages are considered basic.
- This setting is only applicable to user uploaded packages and does not cover 1P or 3P built agents.
- IT admins can view user uploaded packages as shared in MAC and the details page will show the components of the package.
- The setting applies only to advanced agents and plugins uploaded after the control becomes available.
- No action is required to maintain current behavior,
Action Required/Recommendations
- Review the advanced-package upload setting when it becomes available on September 25th.
- Determine whether advanced-package uploads should be available to all users, selected users, groups, or no users prior to October 25th.
- Update internal administrator and help desk documentation as needed.
- Inform support teams of the new governance control.
- If no action is taken, advanced-package uploads remain allowed by default.
Compliance Considerations
- The change introduces new administrative governance controls for advanced agents and plugins.
- The feature supports administration through Microsoft Entra ID group membership.