Copilot Studio app building arrives on by default in preview

What shipped

Microsoft's September 2026 update for Copilot Studio arrived on October 7, and its main addition is app building from natural-language prompts. The feature is in public preview, and app creation is turned on by default. 3 Alongside it, Microsoft introduced the Microsoft Copilot Managed Runtime, also in public preview. It hosts apps built in Copilot Studio, Copilot Cowork and Copilot Code. 3

Other parts of the release are at different stages. Hooks are in preview and limited to agents running on the GitHub Copilot harness. The Foundry IQ integration and the Review panel are now generally available, evaluations cover more scenarios, and plugin registry support is still rolling out. 3 Microsoft describes the whole package as "one studio" where makers build apps, workflows and agents in the same place. 3

Cowork came first

App building did not start in Copilot Studio. Microsoft's message center notice MC1469329, published September 8, 2026, announced the experience in Copilot Cowork first and said Copilot Studio would follow within a couple of weeks. 4 The workflow is the same in both. A licensed user describes an app in conversation, gets a working first draft, refines it, tests it, and then publishes and shares it. 4

Apps can draw on organizational data through whatever connectors the tenant's policies permit. Apps started in Cowork can be opened and edited further in Copilot Studio. 4 Microsoft also says these apps will be visible to administrators and managed through the Microsoft 365 admin center under existing policies. 4 That last commitment matters because the feature is on by default.

Governance built in, not added later

On-by-default app creation follows a series of changes that push Copilot Studio toward mandatory governance. Starting in July 2026, the platform automatically creates a Microsoft Entra Agent ID for every new agent, and administrators can no longer opt out at the environment level. 5 Recent months also brought preview certification for MCP servers, which signals that a server meets Microsoft's bar for reliability, security and compliance. Microsoft added Azure SQL tables and Work IQ as grounding sources as well. 5

Those identity IDs feed into Agent 365, which Microsoft presents as a single control plane and registry for finding and managing agents across a company. 2 Using Entra Agent IDs, administrators can apply approval workflows and conditional access. They can also block an agent, reassign it to a new owner, or reroute it. 2 A registry sync feature, in preview, imports agents from other clouds and platforms so the same controls can apply outside Microsoft's own tools. 2 Microsoft says its own tenant holds more than 500,000 agents. 2 Coming from a company that builds the tooling, that figure shows how quickly agent counts can grow.

The problem customers describe

Security leaders say they need these controls now. In Microsoft-hosted roundtables, nine in ten groups reported agents running across SaaS, multicloud and third-party environments with no governance visibility. Eight in ten said shadow AI already exists in their organizations, often tracked only through network logs, if at all. 1

The most common complaint was ownerless agents, raised by nine in ten groups. These are agents tied to the identity of the person who built them that keep running after that person changes roles or leaves. 1 Over time they end up over-permissioned, unreviewed and hard to decommission. 1 Participants also named chains of agents calling other agents as the point where control breaks down most often. 1

Reading the move

The sources agree on the facts but stress different things. The release notes and coverage of the update focus on what makers can build. 35 Microsoft's security and admin material focuses on what administrators can see and control. 12 Read together, they suggest a deliberate trade. Microsoft is making it easier to create software and agents while requiring identity and registry hooks for everything created.

This is my interpretation, but on-by-default app building seems reasonable only because the governance layer now exists. Automatic Entra Agent IDs, admin-center visibility for apps and lifecycle actions in Agent 365 directly target the ownerless-agent and sprawl problems customers describe. 1245

The gaps remain significant. Registry sync is still in preview, hooks work only with the GitHub Copilot harness, and plugin registry support has not fully rolled out. 23 Agent-to-agent interactions, which customers called the hardest to secure, get no specific answer in this release. 1

For administrators, the practical step is to check app-creation settings and connector policies now. Turning it off later, after users have built apps, is harder than deciding up front. The default favors adoption, so tenants that want tighter control will need to opt out on purpose.