What is Microsoft 365 Copilot Cowork and what are its enterprise governance…

Research Question

What is Microsoft 365 (M365) Copilot Cowork, how does it technically differ from custom Microsoft Copilot Skills, and what are the governance, legal, and shadow Information Technology (IT) risks it introduces for enterprise organisations?

Findings

(Populated from section 6 Synthesis above.)

Executive Summary

• Microsoft 365 Copilot Cowork is a preview, action-taking Microsoft agent whose main enterprise risk is the low-friction conversion of existing user permissions into user-authored automations, not the introduction of a wholly new extensibility stack.
• It technically differs from formal Microsoft Copilot extensibility because Cowork custom skills are OneDrive-hosted instruction files loaded into a prebuilt agent, whereas declarative agents, custom engine agents, connectors, and Copilot APIs are explicit enterprise extensibility artifacts with manifests, deployment paths, or hosting models.
• The legal and regulatory posture is manageable but conditional, because core Microsoft 365 privacy and residency commitments remain in force while Anthropic subprocessor settings, regional exclusions, and a documented DLP gap for uploaded prompt attachments require separate governance decisions.
• Enterprises should therefore govern Cowork as a business-led low-code automation surface, using pilot groups, permissions cleanup, DLP, audit, and explicit registration or review of user-created skills before wider enablement.

Key Findings

1. High confidence. Cowork is a preview Microsoft 365 Copilot agent that can execute multi-step work across Outlook, Teams, documents, calendars, and enterprise search, and it is explicitly designed to request user approval before sensitive actions.
2. High confidence. Cowork custom skills are not the same technical category as Microsoft's formal extensibility options, because they are per-user instruction files loaded into a prebuilt agent rather than packaged agents, connectors, or custom orchestration components.
3. High confidence. Cowork operates in the caller's existing Microsoft 365 security context, which means the dominant risk is not hidden privilege escalation but the faster operationalization of already overshared content and already overbroad user access.
4. High confidence. Microsoft explicitly states that custom skills created by users are not validated by Microsoft, so enterprises cannot treat those skills or their outputs as vendor-assured controls or reviewed business procedures.
5. High confidence. Microsoft's baseline privacy, retention, and residency commitments still apply to Cowork interaction content, including no training on prompts or responses, permission trimming, and local-geography storage commitments for interaction data at rest.
6. High confidence. Anthropic subprocessor dependence creates a material regional governance decision because Anthropic-backed features are outside the EU Data Boundary, disabled by default in the EU, EFTA, and UK, and unavailable in government and sovereign clouds.
7. High confidence. Microsoft supplies meaningful enterprise controls through DLP, audit logs, and group-scoped availability management, but the documented DLP inability to inspect the contents of uploaded prompt attachments leaves a concrete preventive-control gap.
8. Medium confidence. Cowork creates moderate operational lock-in because even though a skill file is portable as Markdown text, the useful workflow depends on Microsoft-specific permissions, data locations, scheduling, approval patterns, and integrated action surfaces.
9. Medium confidence. The defensible adoption pattern is a governed low-code rollout in which Cowork is limited to approved groups and bounded use cases until permissions cleanup, DLP coverage, audit review, and a skill registration process are demonstrably in place.

Assumptions

Explicit assumptions made during the investigation and the justification for each.

• Assumption: Enterprises should assume user-created skills are unmanaged unless they build an internal registry or review workflow. Justification: accessible Microsoft documentation describes agent-level controls but no first-party skill approval or inventory mechanism.
• Assumption: The conflicting availability pages are safer to read as preview inconsistency than as proof of universal tenant readiness. Justification: primary sources disagree, so conservative rollout planning requires tenant validation.

Analysis

• The evidence was weighted toward official Microsoft pages for architecture, controls, and legal commitments, and those pages support a clean distinction between Cowork's instruction-file model and the formal packaged extensibility surface used for enterprise agents.
• Competing interpretations of Cowork as either "just another chat surface" or "a new privileged platform" were resolved by the user-context facts: it does not appear to grant new permissions, but it does materially increase the speed and repeatability with which existing permissions can be exercised.
• The legal trade-off is similarly bounded: Microsoft's existing enterprise commitments remain meaningful, but Anthropic regional exclusions and data-boundary carve-outs mean regulated tenants still need explicit provider-level review rather than relying on the generic Microsoft 365 control story alone.
• Prior repository research was used to interpret the governance pattern, not to replace primary evidence: Cowork's shape matches a governed low-code lane more closely than a centrally engineered pro-code lane.

Risks, Gaps, and Uncertainties

• Preview instability remains a live uncertainty because Microsoft documents contradict each other on both skill limits and rollout conditions.
• A concrete control gap remains for files uploaded directly into prompts, because DLP does not inspect their contents before submission.
• The accessible documentation does not show a first-party skill inventory, versioning, or approval surface, so enterprises may need compensating controls outside the product.
• Region-sensitive organizations still need tenant-specific validation of Anthropic toggles, data-boundary behavior, and feature availability before legal review can be considered complete.

Open Questions

• Should the repo add a dedicated backlog item on how enterprises should inventory, review, and retire Cowork custom skills when Microsoft does not yet expose clear first-party skill governance?
• What export and migration path exists for scheduled prompts, custom skills, and conversation metadata if an enterprise later moves away from Cowork?
• How should enterprises classify Cowork tasks that bridge multiple sensitivity zones, such as combining internal documents with customer-facing messaging, within a formal intake process?

sources

• [x] Microsoft 365 Copilot Cowork overview — - primary product documentation for capabilities, built-in skills, approvals, and preview status.
• [x] Use Cowork — - primary workflow documentation for approvals, scheduling, file handling, and custom skill creation.
• [x] Get started with Cowork — - prerequisites, channel availability, and Anthropic dependency.
• [x] Cowork frequently asked questions — - primary documentation for admin disablement, limitations, security statements, and regional restrictions.
• [x] Manage Cowork for your organization — - replacement for the seeded admin-guide URL, which returned 404 in this environment.
• [x] Microsoft 365 Copilot extensibility documentation — - top-level entry for Microsoft's formal extensibility model.
• [x] Agents for Microsoft 365 Copilot — - official distinction between declarative agents and custom engine agents.
• [x] Declarative agents overview — - official packaging, distribution, and compliance model for declarative agents.
• [x] Custom engine agents overview — - official architecture, hosting, and compliance responsibilities for custom engine agents.
• [x] Microsoft 365 Copilot connectors overview — - official external data access models for synced and federated connectors.
• [x] Microsoft 365 Copilot APIs overview — - official API-based extensibility and governance model.
• [x] Microsoft 365 Copilot extensibility planning guide — - official guidance on choosing connectors, agents, and APIs.
• [x] Microsoft 365 Copilot extensibility frequently asked questions — - official clarification of agents, actions, plugins, and connector differences.
• [x] Data, privacy, and security for Microsoft 365 Copilot — - primary privacy, training-use, data residency, and agent-governance documentation.
• [x] Anthropic as a subprocessor for Microsoft Online Services — - primary source for Anthropic enablement, exclusions, and regional defaults.
• [x] Data residency commitments for Microsoft 365 Copilot and Copilot Chat — - primary source for at-rest geography commitments, Advanced Data Residency (ADR), and Multi-Geo.
• [x] Privacy, security, and compliance in Microsoft OneDrive — - primary source for tenant-boundary and data residency claims relevant to Cowork file handling.
• [x] Learn about the Microsoft 365 Copilot and Copilot Chat location for Data Loss Prevention (DLP) — - primary source for DLP controls and control gaps.
• [x] Overview of audit logs for Microsoft Copilot and AI applications — - primary source for auditability and accessed-resource logging.
• [x] Microsoft Trust Center data management — - primary source for retention and deletion commitments.
• [x] Microsoft Frontier program — - official source for preview enrollment framing.
• [x] Creating custom skills for Copilot Cowork — - secondary practitioner confirmation of per-user skill creation and preview behavior.
• [x] How to create custom skills in Cowork — - secondary practitioner confirmation of preview behavior, skill discovery, and lack of visible per-skill approval.
• [x] How to get your Microsoft 365 tenant ready for Copilot Cowork — - secondary governance-focused analysis used only where marked as inference.
• [x] Business-led low-code agent governance: conditions for durable value versus fragmentation in regulated environments — - prior completed repository work on governed citizen development.
• [x] Enterprise AI use-case routing frameworks — - prior completed repository work on routing low-code versus pro-code work.
• [x] Enterprise AI platform operating models: organisational structure and ownership — - prior completed repository work on shared control planes and federated delivery.