September 2026 is the month Microsoft Copilot stops being a single-model product and becomes a multi-model platform. Two new frontier models — OpenAI’s GPT-6 Astra and Anthropic’s Claude Fable 5.1 — landed in Copilot Cowork and Copilot Studio within four days of each other. The GitHub Copilot harness in Copilot Studio reached general availability, transforming Studio from a chatbot builder into a genuine agentic platform. And human approval gates for agent tool calls finally give enterprises a deterministic guardrail for high-stakes actions.

For IT leaders, the decisions this week are not about whether to adopt — they are about governance posture. Which models are enabled, for whom, and under what data handling terms. Whether agents can act autonomously or require human authorization for sensitive operations. And how prepared your tenant is for the inference governance gap that Purview was never designed to close.

1. Two Frontier Models in One Week

Claude Fable 5.1 arrived September 1 in Copilot Cowork and Copilot Studio. Anthropic’s model is pitched for long-running work, financial analysis, and front-end visual coding — workloads where tight reasoning and concise summaries matter more than raw throughput. Admins manage access through the M365 admin center under AI providers operating as Microsoft subprocessors. Per-user and per-group gating is available.

GPT-6 Astra followed September 4, rolling out across four Microsoft surfaces on day one: Copilot Cowork, Copilot Studio, GitHub Copilot, and Microsoft Foundry. Charles Lamanna, EVP of Microsoft Copilot, framed it as a cross-surface release — Astra enables delegating larger, complex tasks without breaking them into small steps. Less hand-holding, more delegation. Work IQ grounds Astra responses in tenant files, meetings, chats, and business data within existing permissions.

The governance catch: Enabling Anthropic as a subprocessor does not automatically enable Purview DLP, audit logging, or insider risk detection for Claude usage. Admins must configure those separately. Preview models like Fable 5.1 may operate under Anthropic as an independent data processor rather than a Microsoft subprocessor — a different data handling posture that compliance teams need to review. On the GitHub Copilot side, GPT-6 Astra is default-on for Business and Enterprise plans unless admins explicitly disable it.

A broader shift is also in play. As of June 2026, Microsoft added OpenAI as a Microsoft Online Services subprocessor for certain M365 Copilot and Copilot Studio services. Copilot requests can now be handled by OpenAI-operated infrastructure rather than Microsoft-operated Azure OpenAI. OpenAI models are included in the EU Data Boundary but are not available in government or sovereign clouds. Admins can disable the OpenAI service via security groups without affecting Azure OpenAI services.

What this means for IT leaders: Review your model allow-list in both the M365 admin center and GitHub Copilot settings. Confirm whether OpenAI-operated infrastructure is acceptable for your compliance posture. If enabling Claude, configure Purview DLP and audit logging separately — do not assume defaults cover you. Communicate the GPT-6 Astra default-on status to GitHub Copilot admins before it surprises them in next month’s usage report.

2. Copilot Studio GitHub Copilot Harness: GA

The GitHub Copilot harness reached general availability on September 2 — the most significant architectural shift in Copilot Studio this year. The harness sits between the AI model and the agent, orchestrating when to call the model, what context to provide, and which tools, MCP servers, and connected agents to use. It brings code execution, reasoning loops, and tool orchestration to agent development.

What shipped GA alongside the harness: Workflows, MCP servers as agent tools, the Windows 365 for Agents MCP server, Claude Sonnet 5 and GPT-5.5 Chat as primary models, and Skills — modular, reusable instructions packaged across agents.

Three harnesses now coexist. Copilot Chat for customized chat experiences, Standard for conversational topic-based agents, and GitHub Copilot for complex agentic processes. The choice is locked at creation — no conversion between harnesses. The GitHub Copilot harness bills via Copilot Credits for all work, including maker-side authoring, evaluations, and testing. Billing began September 1.

Skills are the portability story. Write modular instructions once, add them to multiple agents, share with teammates. Agents can generate skills from successful patterns but cannot modify their own skills — the maker remains responsible for importing and validating. SharePoint personal skills are in public preview with worldwide rollout targeted for December.

Work IQ in Copilot Studio (preview) lets GitHub Copilot harness agents connect to organizational context — emails, calendar events, files, Teams messages, people info. Foundry IQ connection is also available for knowledge bases built in Microsoft Foundry. SharePoint metadata filtering gives agents two built-in tools for targeted knowledge retrieval, filtering by metadata columns before searching — a major improvement for enterprises with large document libraries.

What this means for IT leaders: Treat harness choice as a permanent architecture decision affecting billing, authoring model, and capabilities. Review historical non-billed usage in PPAC under Licensing > Copilot Studio > Manage Agents to understand what your consumption will look like once billing is in full effect. Begin evaluating which agents should migrate to the GitHub Copilot harness versus remaining on Standard or Copilot Chat.

3. Human Approval Gates and Credential Safety

Two governance features landed this month that directly address the enterprise compliance story for agentic AI.

Per-tool, per-agent human approval (Feature 570434) lets makers require human authorization before an agent runs specific tools. The toggle is independent of the agent’s instruction set — even if AI logic says “go,” the call pauses with a request describing the intended action. Approvers can approve, approve for the session, or deny. Approval requests appear inline in Teams and Microsoft 365 Copilot, with no context switching. Target GA is September CY2026. Use cases: sending emails, closing service tickets, processing payments — any action where the cost of an error exceeds the cost of a delay.

Credential oversharing detection (MC1465744) automatically blocks unsafe credential-based sharing within Copilot Studio. It detects when agents or flows rely on maker or system credentials not intended for reuse, blocking at design, publish, and share stages. No admin action required — enforcement is automatic. GA date: September 30, 2026.

What this means for IT leaders: Map your agent inventory against the human approval framework. Identify which agent-tool combinations warrant gating — payments, external communications, data deletion. Communicate the credential oversharing detection to makers so they understand why previously shareable agents may now be blocked. These are the enterprise compliance building blocks that make agentic AI deployable in regulated environments.

4. Copilot Notebooks Becomes a Serious Analysis Tool

Three new reference types in September transform Copilot Notebooks from a note-taking aid into a grounding surface for organizational data.

Power BI reports (Feature 569928) — Bring report data directly into notebooks alongside files. Copilot reasons over the report’s semantic model and visualizations.

CSV/TSV structured data (Feature 569210) — Structured data ingestion for grounded AI outputs. Users can bring tabular data without needing a Power BI workspace.

JPG/PNG image grounding (Feature 569211) — Visual grounding. Copilot extracts insights from charts, diagrams, and screenshots referenced in a notebook.

Copilot Chat also gained image understanding for embedded images in Word, PowerPoint, and PDFs. Declarative Agents can now ground answers in scanned PDFs and image-based documents from SharePoint — unlocking a large class of enterprise content that was previously inaccessible to AI scenarios. Scanned PDF understanding reaches GA this month.

On Android, Copilot Notebooks gains multimodal capture — audio, images, and notes are captured and structured automatically. The OneNote workspace and lightweight Copilot app experience stay in sync.

What this means for IT leaders: Notebooks is now a viable surface for analyst workflows — bring organizational data, structured tables, and visuals into a single AI workspace. Review governance for Power BI and CSV references in notebooks. The scanned PDF capability means previously unstructured archives are now AI-accessible — revisit retention and access policies for scanned document libraries.

5. Connectors: Federated GA and Self-Serve Preview

Federated Copilot Connectors are GA. Copilot can now link to third-party data sources over MCP and retrieve data in real time without storing or indexing it in Microsoft services. Admins retain governance through the M365 admin center. Supported in Researcher, Microsoft 365 Chat, and Agent Mode in Excel. Dozens of new connectors landed across legal (iManage, Harvey, Relativity, Everlaw), financial (Mercury, Xero, FactSet, PitchBook, Morningstar), healthcare (Scite, Consensus), and professional services (Asana, Notion, Canva, Linear, Dropbox).

Self-serve sync connectors are in public preview. Individual users can connect external data sources using their own credentials — first connectors are Jira Cloud and Confluence Cloud. Content is crawled and copied into Microsoft Graph per-user, not org-wide. Only the user’s accessible content is synced. GA target is October 2026. This solves a real pain point — users can ground Copilot in their project data without filing an IT ticket for a tenant-wide connector deployment.

What this means for IT leaders: Federated connectors mean Copilot can reach into external systems without data residency concerns — data stays at the source. Review the connector catalog for systems your organization uses and enable the relevant ones. For self-serve connectors, decide whether to allow them in your tenant and communicate the per-user scope to users who request Jira or Confluence grounding.

6. Governance: The Inference Gap

Purview covers data at rest — labels, retention, access controls. It was not designed to interpret AI inference. Copilot can synthesize across permitted sources to surface confidential details that no single file would reveal. As Richard Harbridge noted on the m365.fm podcast, Copilot does not arrive in a clean tenant — it inherits years of accumulated technical debt, unstructured data, and oversharing. AI does not create entirely new governance problems, but it significantly amplifies and exposes existing ones.

Practical governance needs three layers. Source controls — sensitivity labels, access reviews, oversharing remediation. Exposure controls — Restricted Content Discovery to exclude sensitive sites from Copilot grounding, DLP for Copilot to block sensitive content from grounding responses. Use controls — policy enforcement at the AI layer, including human approval gates, Copilot Memory retention policies, and audit logging for agent actions.

Several governance updates this month help. Purview adds Copilot Memory retention with versioning and historical visibility. Auto-labeling capacity for SharePoint Online and OneDrive increased from 100K to 500K files per tenant per day. DLP expands to calendar events on Mac and mobile. De-identified row-level metrics export from Copilot and Agent 365 Dashboards enables custom reporting. Domain exclusion for web grounding — while its status reversed from GA back to “rolling out” — should reach GA this month.

What this means for IT leaders: The inference gap is real and will not be closed by a single product. Layer your controls: source, exposure, and use. Prioritize oversharing remediation — Copilot surfaces what it can see. Use Restricted Content Discovery to fence off sensitive sites. Update DLP policies for the new surfaces (calendar, Mac, mobile). And brief leadership on the distinction between data governance and AI governance — they are related but not identical.

The Bottom Line

This week’s updates mark Copilot’s transition from a product to a platform. Model choice is real — three frontier model families side by side, each suited to different workload types. The Studio harness GA makes agentic development production-ready. Human approval gates and credential safety detection close the enterprise compliance loop. Notebooks grounding expansion and federated connectors make Copilot a more capable tool for real work.

The governance gap remains the critical risk. Purview was built for data at rest, not AI inference. Organizations that treat Copilot deployment as a licensing exercise rather than a governance exercise will find that out the hard way.

For deeper coverage of Microsoft’s AI platform evolution, follow https://x.com/kkaminsk on X.