Microsoft’s multi-model strategy for Copilot took its boldest step yet this week. xAI’s Grok is now selectable inside Word, Excel, and PowerPoint through the Microsoft Frontier Program. Federated Copilot connectors reached General Availability, making the Model Context Protocol a first-class citizen in M365 Copilot. Native app building landed in Copilot Studio and Copilot Cowork, blurring the line between agent and application. And September Patch Tuesday brought a critical Copilot Studio vulnerability that underscores a growing reality: AI infrastructure is now squarely in the attack surface.

For IT leaders, the decisions are multiplying. Which AI providers are enabled in your tenant — and under what data handling terms? Are your firewall and Conditional Access rules ready for the copilot.cloud.microsoft URL migration? Have you modeled Copilot Credit consumption after the September 1 credit cliff? And is your Purview governance keeping pace with the inference layer that Copilot exposes?

1. Grok Joins M365 Copilot — Multi-Model Becomes the Default Story

Microsoft officially added xAI’s Grok models to Microsoft 365 Copilot on September 12. Grok is now available as a selectable model inside Word, Excel, and PowerPoint through the Microsoft Frontier Program. Satya Nadella announced the integration; Elon Musk confirmed on X with a characteristically brief “Grok available in Microsoft Copilot.”

Admin gating matters. Grok is disabled by default. Admins must explicitly enable SpaceXAI models in Copilot settings under “AI providers for other large language models.” Geographic restrictions apply — Grok is not available to Frontier customers in the EU, EFTA, or UK during the preview. SpaceXAI has been added to Microsoft’s Online Services Subprocessor List, and admins retain control over what data is processed by Grok models. Microsoft has not confirmed which Grok version powers the Office preview, though Grok 4.6 is xAI’s latest frontier model (August 2026).

The multi-model picture across Microsoft surfaces is now substantial. Grok has been in Azure AI Foundry since September 2025, Copilot Studio since February 2026, and GitHub Copilot since August 14, 2026. With GPT-6 Astra (September 4) and Claude Fable 5.1 (September 1) also live across Copilot surfaces, Microsoft now offers three frontier model families simultaneously. The message is clear: Copilot is a model-agnostic platform, not a walled garden tied to OpenAI.

What this means for IT leaders: Review your AI provider settings in the M365 admin center. Decide whether Grok’s data handling posture is acceptable for your organization — note the EU/EFTA/UK exclusion, which may simplify compliance for European operations but limits model choice. Communicate the expanding model catalog to your Copilot champions and update training materials. Model selection is becoming a per-task optimization decision, not a tenant-wide standard.

2. Federated Copilot Connectors Reach GA

Federated Copilot connectors reached General Availability in September 2026, marking a major milestone for the Model Context Protocol across Microsoft 365.

The key property: no indexing or storage. Copilot connects to third-party data sources over MCP and retrieves data in real time using the user’s identity. Data never lands in Microsoft services — a significant privacy and compliance differentiator. Authentication uses OAuth 2.0, respecting source permissions. The protocol is read-only — agents can search and fetch content but cannot write data back to source systems.

Supported surfaces at GA: Researcher agent, Microsoft 365 Chat, and Agent Mode in Excel. Admins manage connectors through the M365 admin center under Copilot → Connectors, where Microsoft-published federated connectors appear with “Ready” status. Twelve Microsoft first-party MCP servers are included in the default environment group, all Entra ID-authenticated (except the public Microsoft Learn Docs MCP). Availability covers worldwide multi-tenant, GCC, GCC High, and DoD.

New connectors this month span legal, financial, healthcare, and professional services. Legal: iManage Work, Boardwise, Harvey, Descrybe, Relativity, Everlaw. Financial: Mercury, Xero, FactSet, PitchBook, Morningstar. Professional: Asana, Notion, Canva, Linear, Dropbox. Energy: S&P Global Energy. This is not a catalog of experimental integrations — these are enterprise-grade connectors for systems organizations already use.

Self-serve sync connectors also reach public preview. Individual users can connect Jira Cloud and Confluence Cloud using their own credentials, without filing an IT ticket. Content is crawled into Microsoft Graph per-user, not org-wide. GA target is October 2026.

What this means for IT leaders: Review the default federated connectors in your tenant and decide which should remain enabled. Update AI and data governance documentation to account for real-time MCP access. For self-serve connectors, decide whether to allow them and communicate the per-user scope. The connector catalog is growing fast — establish a review cadence for new additions.

3. Native App Building in Copilot Studio

Microsoft added native app-building capabilities to Copilot Studio and Copilot Cowork this week — arguably the most consequential Copilot Studio update of the quarter.

How it works. Makers describe a business outcome in natural language — the users, data, and actions needed. Copilot generates a working first draft. Users refine, preview, test, and publish. Apps use connectors and Work IQ, follow Entra identity and connector policies, and published apps appear in the M365 admin center inventory. Information workers build via conversation; developers can inspect and refine the underlying structure and code.

Billing follows usage-based Copilot Credits for both building and running apps. Apps built in Copilot Cowork can be opened and further edited in Copilot Studio — a deliberate interoperability play. The Copilot Cowork app-building preview began September 8 (Frontier program), with Copilot Studio’s “App (Preview)” rolling out in public preview the week of September 10.

The strategic implication is significant. Microsoft is positioning Copilot Studio as a unified platform for apps, agents, and workflows under a single governance umbrella — not just a chatbot builder. The app-first agent creation experience targeted for October 2026 and interactive MCP Apps rendering (sortable tables, drilldowns inline in conversations, targeted November 2026) signal that Copilot Studio is evolving into a full application development surface.

What this means for IT leaders: Decide whether to enable app building for eligible makers in your tenant. Scope to security groups if you want controlled rollout. Review the usage-based billing implications — app building and running both consume Copilot Credits. Establish governance for published apps in the M365 admin center inventory. This is a new development surface in your tenant that needs the same lifecycle management as Power Apps or Dynamics 365 customizations.

4. September Patch Tuesday: A Critical Copilot Studio CVE

Microsoft’s September Patch Tuesday addressed 966 vulnerabilities — including 2 actively exploited zero-days and 105 critical flaws. For the first time, Copilot-specific CVEs appear in the rollout with material severity.

CVE-2026-80098 — Copilot Studio, Critical, CVSS 9.3–9.9. Elevation of Privilege via improper cryptographic signature verification. An unauthenticated attacker could exploit this over a network. Microsoft states the vulnerability was mitigated server-side and no customer action is required. However, the severity rating and network-exploitable nature warrant attention — this is the first Critical CVE specifically targeting Copilot Studio infrastructure.

CVE-2026-81380 and CVE-2026-81381 — GitHub Copilot and VS Code, both Important severity. CVE-2026-81380 is an information disclosure issue; CVE-2026-81381 (CVSS 6.5) involves insufficiently protected credentials over the network. Both affect the GitHub Copilot extension running in VS Code.

Broader context. The same Patch Tuesday disclosed privilege escalation CVEs in Microsoft Fabric, Azure AD B2C, and Azure AI Language. The pattern is clear: as Microsoft’s AI infrastructure expands across more surfaces, the attack surface grows proportionally. Copilot is no longer just an assistant that helps you write emails — it is infrastructure that processes enterprise data, authenticates users, and executes operations.

What this means for IT leaders: While Microsoft mitigated CVE-2026-80098 server-side, review your overall security posture as part of the September rollout. Validate patch levels across SharePoint, Teams, Power Automate, and Office. For GitHub Copilot CVEs, ensure VS Code and Copilot extensions are updated to the latest versions. Brief your security team on the trend — AI infrastructure vulnerabilities will continue to appear, and your vulnerability management process needs to account for Copilot surfaces alongside traditional Microsoft products.

5. The September 1 Credit Cliff and Billing Reality

The grace period for GitHub Copilot harness agents and workflows ended September 1, 2026. Agents and workflows now consume Copilot Credits under usage-based billing — and the included allowances dropped significantly.

GitHub Copilot Business seats went from 3,000 transitional credits to 1,900 standard credits — a 37% reduction. Enterprise seats dropped from 7,000 to 3,900 — a 44% reduction. Credits do not carry over; unused credits are forfeited monthly. One AI Credit equals $0.01.

Copilot Studio credit meters stack. A generative answer costs 2 credits. An agent action costs 5. Tenant graph grounding costs 10. When meters combine — for example, graph grounding plus a generative answer — the costs add up to 12 credits. Reasoning models add 10 credits per 1,000 tokens on top of the feature rate. The services billed through Copilot Credits now include Copilot Studio agents, Copilot Cowork runtime, Work IQ API calls, agent flows, and native app building.

Cost management is available but must be configured. Admins manage spending through Copilot > Cost Management in the M365 admin center — set per-user and per-policy monthly limits, enable threshold notifications. Users can check approximate usage in Copilot Cowork via /cost. Below roughly 20,000 credits per month, pay-as-you-go at $0.01 per credit is cost-effective. Above that, capacity packs ($200/month for 25,000 credits) or annual pre-purchase plans with 5–20% discounts become viable.

What this means for IT leaders: Model your Copilot Credit consumption now — do not wait for the first overage bill. Set spending policies and per-user limits in Cost Management before adoption scales. Identify which agents and workflows are high-volume consumers and evaluate whether they need optimization. The credit cliff is not a future risk — it happened two weeks ago.

6. URL Migration and Enterprise Network Readiness

Two URL changes are underway that require network and security configuration updates.

copilot.cloud.microsoft redirect. Starting early September 2026, m365.cloud.microsoft redirects to copilot.cloud.microsoft for orgs where access is available. Remaining orgs follow in early October. The domain remains within *.cloud.microsoft, so security, compliance, and enterprise allow-listing properties are preserved. But firewall rules, proxy configurations, Conditional Access policies, and URL filtering rules must be updated.

Teams URL change. Teams web is also moving to teams.cloud.microsoft. All redirects should complete by early October 2026. The deadline for confirming compatibility was September 10 — if your organization cannot meet the timeline, contact your Microsoft account representative before the window closes. Limited exceptions are possible until December 31, 2026.

What this means for IT leaders: Confirm that copilot.cloud.microsoft and teams.cloud.microsoft are allowed in firewall, proxy, Conditional Access, and URL filtering configurations. This is not optional — the redirect is happening regardless. Organizations that miss the deadline will find Copilot and Teams inaccessible from managed networks until configurations are updated.

The Bottom Line

This week confirms three things about the trajectory of Microsoft Copilot.

First, model choice is now a core selling point, not a premium feature. Three frontier model families — OpenAI, Anthropic, and xAI — are live simultaneously across M365 Copilot, Copilot Studio, and GitHub Copilot. Enterprises need a model governance strategy, not a model selection.

Second, MCP is the connective tissue. Federated connectors hitting GA means real-time, no-index data access is production-ready. Combined with native app building in Copilot Studio, the platform is evolving from an assistant into an application development surface that happens to have AI baked in.

Third, the governance burden is growing faster than the governance tooling. A CVSS 9.3 Copilot Studio vulnerability, a 44% credit reduction for Enterprise customers, URL migrations, and an expanding connector catalog all demand admin attention. The organizations that thrive will be those that treat Copilot as infrastructure — with the same lifecycle management, security review, and cost governance applied to any other enterprise platform.

For continuing coverage of Microsoft’s AI platform evolution, follow https://x.com/kkaminsk on X.