The super app merge is no longer a roadmap item — it is rolling out now. The consumer Copilot app and the Microsoft 365 Copilot app are becoming a single Microsoft Copilot app, with a new URL, a new icon, and a set of retired consumer features that will catch some users off guard. Meanwhile, September 1 brings a triple deadline: six GitHub Copilot models retire, promotional credit allowances drop 37–44%, and Copilot Studio harness billing goes live. And in a quiet August update, Microsoft deleted existing Copilot spending alerts — admins need to recreate them before agentic workloads burn through credits unnoticed.

For IT leaders, this week is about three things: completing the domain migration before the mid-September desktop rollout, locking down cost governance before the September 1 billing cliff, and operationalizing agent identity management as Entra Agent ID becomes mandatory.

1. The Super App Merge: One Copilot, Two Account Types

Microsoft is merging the consumer Copilot app and the Microsoft 365 Copilot app into a single Microsoft Copilot app. The web URL moved from m365.cloud.microsoft to copilot.cloud.microsoft, with automatic redirect unless your organization blocks the new domain. The new icon drops the M365 badge. An account switcher with clear visual indicators — a green shield for work accounts, a “Work” label — separates personal and organizational contexts. Work and personal data remain fully separated; no data flows between account types.

Retired consumer features (August 18): Copilot Podcasts (fully retired, no export), Group Chat (converted to 1:1 conversations, other participants’ content inaccessible), consumer Deep Research (replaced by “Researcher” for M365 Premium only), Copilot Labs, and the Mico mascot. Copilot-generated files from the standalone app move into OneDrive and consume user storage allowance. Recall exclusions from the old app do not carry over — they must be reapplied.

Rollout timeline: Mobile and web are live worldwide now. Windows and Mac are in opt-in early access, with broad deployment beginning mid-September. The deferred web redirect hits late September.

What this means for IT leaders: Update firewall and proxy allowlists to include copilot.cloud.microsoft before the mid-September desktop rollout. Communicate the consumer feature retirements to users who relied on them. Reapply Recall exclusions. The enterprise security, compliance, and tenant controls are unchanged — but the URL change is a breaking change for organizations that allowlist specific domains.

2. September 1: The Billing Cliff

Three things change on September 1, and none of them have a grace period.

Model retirements. Six models retire from every GitHub Copilot surface — Chat, inline edits, agent mode, ask mode, code completions, and code review. Gemini 3.1 Pro, Claude Opus 4.5, Claude Opus 4.6, Claude Sonnet 4.5, Claude Sonnet 4.6, and Raptor Mini all disappear. MAI-Code-1-Flash follows on September 10. Pinned configurations and CI workflows referencing these models will break. The recommended replacements are Gemini 3.6 Flash, Claude Opus 4.7/4.8/5, and Claude Sonnet 5. For Raptor Mini, skip the suggested MAI-Code-1-Flash target and go straight to MAI-Code-1.1-Flash, since the intermediate replacement itself retires September 10.

Credit allowance cuts. Promotional credit allowances drop sharply and permanently. Business drops from 3,000 to 1,900 credits per seat — a 37% reduction. Enterprise drops from 7,000 to 3,900 — a 44% reduction. A 100-seat Business organization loses approximately 110,000 pooled credits monthly. Claude Sonnet 5 introductory pricing also ends September 1, moving from $2/$10 to $3/$15 per million tokens.

Copilot Studio harness billing. The grace period for GitHub Copilot harness agents in Copilot Studio ends. Existing agents, workflows, and dev/trial environments start consuming Copilot Credits — including build, test, and evaluation usage. Standard and Copilot Chat harness agents are unaffected. Historical non-billed usage is available in PPAC under Licensing > Copilot Studio > Manage Agents, but only as directional data, not a bill estimate.

Spending alerts deleted. In an August Cost Management update, Microsoft wiped existing Copilot spending alerts. Admins must manually recreate them in every spending policy — not just centrally. Without them, agentic workloads like Cowork and Studio agents can consume credits invisibly as more departments onboard.

What this means for IT leaders: Audit pinned model configurations today — before the deadline. Enable replacement models in admin policy. Review historical Copilot Studio consumption in PPAC and set environment-level credit allocations. Recreate spending alerts in every policy. Consider the new environment-group cost control rule (GA August 26) that governs whether environments can draw from the tenant credit pool when their allocation is exhausted. The default is permissive — plan group membership before publishing the rule.

3. Copilot Studio: Harness Architecture and Agent Identity

The harness model is now the first architecture decision for any new Copilot Studio agent. Three harnesses are generally available: Copilot Chat for customized chat experiences, Standard for conversational agents, and the GitHub Copilot harness for complex agentic processes with advanced reasoning and multi-step execution. The choice is locked at creation — no conversion between harnesses in either direction. The GitHub Copilot harness bills via Copilot Credits for all work, including maker authoring and evaluations.

Entra Agent ID is now mandatory. Every new agent automatically receives a Microsoft Entra Agent ID, with no environment-level opt-out. Self-service migration for legacy app-registration agents started August 24 in Power Platform Advisor. The governance wins are significant: audit logging in Entra, lifecycle management (deleting an agent deletes its identity), connector permissions surfaced as API permissions, Conditional Access targeting, and sponsor assignment with limited permissions. Batch the migration in small groups, validate channels and connectors, and review sign-in logs and Conditional Access policies.

Multi-tenant agent management is in public preview in the M365 Admin Center, letting administrators manage agents across multiple tenants from a single experience. The agent registry now surfaces risk signals: shadow agents (no registry entry, no owner, no Entra Agent ID) and ownerless agents are flagged as critical.

Coming in September: Evaluations improvements with reasoning traces, cited knowledge sources, and run comparison. Copilot Apps in Canvas enter preview — interactive React-based app experiences within Copilot. Agent Viewer and Editor roles for maker-to-maker sharing in the GitHub Copilot harness are targeted for November GA.

What this means for IT leaders: Treat harness choice as a permanent architecture decision — it affects billing, authoring model, and capabilities. Plan the Entra Agent ID migration now; legacy agents that are not migrated will lack governance controls. Use the agent registry risk cards to identify shadow and ownerless agents in your tenant.

4. Copilot CLI: A Genuine Agent Runtime

The Copilot CLI has moved from a coding assistant to a legitimate agent surface. The August releases — now at v1.0.82 — added session management, safety nets, and orchestration primitives that make it viable for both interactive development and CI/CD automation.

Concurrent sessions with a sidebar for parallel agent workstreams. Session forks for branching without losing the original. /worktree for isolated speculative changes. /rewind without Git restores conversation state and files Copilot changed while preserving your edits. /tasks for subagent management. Queued prompts for stacking instructions during active turns. Headless plan-then-implement combines --plan with --mode autopilot for one-pass CI/CD automation. Session restore on startup means crashes no longer lose work. Air-gapped GHES support and live tool-call durations round out the enterprise additions.

Agent Plugins 1.0 went GA on August 12. The open, vendor-neutral standard — co-developed by AWS, Anysphere, Microsoft, OpenAI, and Vercel, with Google joining as core maintainer — packages Agent Skills and MCP server configs into a single installable unit. One plugin build runs across VS Code, Copilot CLI, the Copilot SDK, and the Copilot app, on every paid tier from Pro through Enterprise. The Awesome Copilot marketplace now catalogues over 800 plugins. Enterprise managed settings support per-plugin version tracking, auto-update for marketplaces, and MCP allowlists with deny-always-wins composition.

Enterprise governance caught up. Managed settings now apply to the CLI, VS Code, and the Copilot app plus cloud agent. MCP allowlists are GA with wildcards and multi-layer composition. Local sandboxing via Microsoft eXecution Container is in public preview with deny-by-default file, network, and credential policies. Cloud sandboxing runs entire sessions in ephemeral Azure Container Apps. Per-agent usage metrics now report activity by agent app — Copilot, Claude, and Codex — with stable agent IDs.

What this means for IT leaders: The CLI is an agent runtime. Apply managed settings, MCP allowlists, credit caps via --max-ai-credits, and audit logging. The headless mode is pipeline-ready but needs cost governance. If you are building custom integrations, build them as Agent Plugins and MCP servers — that is the standard going forward.

5. Copilot Search, Connectors, and M365 Feature Batch

The August 11–25 release notes batch shipped 19 features. The highlights:

Copilot Search is now defined as universal search in the Copilot app, included with eligible licenses at no additional cost. People search by department is supported. SharePoint Authoritative Sites (roadmap 561323) let admins designate official sites prioritized across Copilot Search results.

Self-serve sync connectors for Jira Cloud and Confluence Cloud enter preview. Users connect their own accounts with their own credentials — enabled by default, with Entra group scoping available. Content indexes into Microsoft Graph and becomes discoverable in Copilot Chat and Microsoft Search. GA is targeted for mid-September through mid-October.

Federated Copilot Connectors (MCP-based) fetch data in real time without indexing into Graph. New industry connectors added this month include FactSet, Morningstar, PitchBook, S&P Global, LSEG, Moody’s, Article Galaxy, Nyquist AI, and CB Insights. ZoomInfo and S&P Global announced deep integrations. Federated connectors for GCC, GCC High, and DoD tenants arrive in September. Connector management is consolidated in the M365 Admin Center under Copilot → Connectors, covering both connectors and plugins.

Copilot Chat in Outlook now reasons over the entire inbox, calendar, meetings, and enterprise data instead of a single thread. It is available to Copilot Chat users without an M365 Copilot license. Excel Python in Edit with Copilot executes Python code for advanced analysis directly in the workbook. Image grounding lets Copilot Chat interpret images embedded in Word, PowerPoint, and PDF documents. Copilot Notebooks gains Outlook email references and Markdown/TXT/RTF support. Viva Engage private content grounding is now available, permission-scoped.

On the model front in M365 Copilot: GPT-5.2 brings a model selector with Quick Response and Think Deeper modes. GPT-5.5 Instant and GPT-5.5 Thinking improve everyday work and multistep reasoning. Sonnet 5 is now the default for higher-reasoning drafting and editing tasks in Word. Declarative agents upgraded to GPT-5.1 with automatic routing between fast and reasoning-optimized modes. Claude availability requires admin opt-in of Anthropic as subprocessor — off by default in EU/EFTA.

What this means for IT leaders: Self-serve connectors are on by default — decide your policy before preview lands in your tenant. If you are building custom connectors, build them as MCP servers. The federated model eliminates indexing latency but shifts query load to source systems. The new model selector is a governance surface — decide which models are available to which users.

6. Security, Cancelled Items, and Action Items

Purview auto-labeling throughput is up 5× — from 100,000 to 500,000 SharePoint and OneDrive files per day. This accelerates Copilot readiness labeling significantly. Purview DLP for M365 Copilot is GA, including blocking sensitive prompts and preventing sensitive data from reaching external web search. The default “Protect sensitive M365 Copilot interactions” policy runs in simulation mode — move it to enforcement. A new DLP control in public preview excludes external emails from Copilot grounding, mitigating prompt-injection via manipulated inbound email content. Purview retention policies for Copilot memory preserve historical versions of stored memory and chat-inferred information. Insider Risk Management is expanding to AI agents with agent-specific indicators and risk scoring in October 2026.

Cancelled and walked-back items (admin awareness): Web-grounding domain exclusion was rolled back August 4 — remove it from governance documentation. The =COPILOT Excel function is cancelled. Proactive push notifications for M365 Copilot mobile are cancelled. Interactive Agents for Teams Meetings were cancelled August 17. Copilot spending alerts were wiped by the August Cost Management update. AI-generated image replacement in Copilot Create is not shipping.

Copilot audit and eDiscovery: The audit log captures interaction events (who, when, app, files). Prompt and response compliance copies are stored in the user’s mailbox in a hidden folder, retrieved via eDiscovery with the Copilot activity type condition. Copilot has its own Purview retention location — “Microsoft Copilot Experiences.” Older combined Teams+Copilot retention policies can no longer be edited once separated.

Strategic Next Steps

  1. Allowlist copilot.cloud.microsoft before the mid-September desktop rollout — this is the most immediate breaking change.
  2. Recreate Copilot spending alerts in every spending policy — they were deleted and will not come back on their own.
  3. Audit pinned model configurations before September 1 — enable replacements, regression-test outputs.
  4. Review Copilot Studio harness agents in PPAC — billing starts September 1 with no grace period.
  5. Set environment-level credit allocations — consider the new environment-group cost control rule; the default allows drawing from the tenant pool.
  6. Plan the Entra Agent ID migration — batch small, validate connectors, review Conditional Access.
  7. Move Purview DLP from simulation to enforcement — especially for external web search.
  8. Communicate consumer feature retirements to users who relied on Copilot Podcasts, Group Chat, or Deep Research.
  9. Reapply Recall exclusions — they did not carry over from the old app.
  10. Plan for Ignite 2026 — November 17–20 will reshape the roadmap again.

The story this week is about convergence and cliffs. The super app merge converges consumer and enterprise into one surface. The September 1 deadline converges model retirements, credit cuts, and harness billing into one day. And the operational reality converges on agent identity, cost governance, and security as the ongoing work — not the announcements, but the infrastructure between them. For IT leaders, the next 48 hours are about action, not analysis.

Follow along at https://x.com/kkaminsk for daily Copilot and Microsoft AI analysis.