Strengthening governance for Copilot extensibility

As Microsoft continues to expand the extensibility options available across Microsoft 365 Copilot, governance is becoming an increasingly important consideration for administrators. New capabilities make it easier to build, publish, and discover agents, plugins, skills, and other Copilot extensions, but they also introduce new decisions around control, ownership, and user access.

In this post, I will look at two recently announced updates focused on Copilot extensibility governance. The first introduces new controls over who can upload advanced agents and plugins, while the second introduces a plugin registry designed to centralize how Copilot extensions are discovered and managed across Microsoft 365.

More control over advanced Copilot agents and plugins

Organizations will soon be able to control who can upload advanced Copilot agents and plugins. The new setting supports all users, selected users, specific Entra ID groups, or no users, providing an additional governance layer for organizations adopting more advanced Copilot extensibility scenarios.

One important detail is that advanced package uploads remain enabled by default. Organizations that are not yet ready to support user-developed agents, actions, or MCP server integrations should review the setting when it becomes available and determine whether uploads should be restricted to approved users or groups. Basic packages are not affected by this change.

Rollout is expected to begin on September 25, 2026, and complete by the end of October 2026. Administrators have until October 25, 2026, to configure the setting before the default behavior takes effect. As always, Microsoft timelines may change. (MC1472007)

Introducing the Microsoft plugin registry

Organizations will soon see a new Microsoft plugin registry that provides a central location for discovering, publishing, and governing Copilot extensions. The registry brings agents, skills, connectors, and MCP servers together into a common framework and provides a more consistent management experience across Copilot and Microsoft 365.

For administrators, the most important preparation is becoming familiar with the new registry and its governance model. While no migration or configuration is required, the update introduces a centralized management experience under Tools in the Microsoft 365 admin center. Organizations should also review user guidance and internal documentation, as the existing Agents, Agents & Skills, and Customize experiences will gradually be replaced by a new Plugins entry point.

The plugin registry rollout began in late September 2026 and is expected to complete by late October 2026. User interface changes are expected to roll out between late October and late November 2026. As always, Microsoft timelines may change. (MC1484008)

More information:

• Extend Microsoft 365 Copilot 
• Manage plugins, skills, and MCP servers in Microsoft 365 admin center 
• Agent settings in Microsoft 365 admin center 

Together, these updates continue Microsoft's work to bring more structure and governance to Copilot extensibility. As adoption of agents, plugins, skills, and other extensions grows, administrators will need clear ownership, governance processes, and approval models in place. The new upload controls and plugin registry are useful additions, but they do not replace the need to actively review default settings and decide how extensibility should be managed within the organization.

If you'd like to stay up to date with Microsoft 365, Copilot, Teams, security, compliance, and AI-related announcements, you can follow me on LinkedIn