An AI agent with its own identity: what Microsoft actually announced and what it means

Today, we mostly use artificial intelligence by giving it a task and waiting for a response. A new type of tool, known as autonomous agents, works differently: it runs in the background, monitors your work, and takes action even without being given instructions. Since such an agent needs access to emails, files, and calendars within an organization, its identity becomes a key issue. This year, Microsoft described one of the first major attempts to address this. What has been verified, and what is being exaggerated in the headlines?

What Microsoft Announced

In June 2026, Microsoft introduced an agent called Scout and described it as the first representative of a new category called “Autopilot.” These are agents that remain active in the background and act on the user’s behalf without requiring a new command for every task. In a major update to Copilot on September 25, 2026, the company stated that Autopilot is the agent formerly known as Scout and that it is a permanent background process.

The agent's own identity

The key change is in how the agent logs in. According to Microsoft, each agent runs under its own managed identity in the Entra directory, not under a shared anonymous service account or a human login. This means that the agent’s actions can be attributed to a known entity recognized by the directory and can be traced in audit logs.

What does this mean in practice?

According to reports on the September update, an agent can also be assigned its own user account with a license, its own email, calendar, storage, and place within the organizational structure. This separates the agent’s activities from the permissions of the person who created it.

What are the limitations?

The data varies depending on the source. One overview states that agents with their own user accounts are currently available only to organizations participating in the Frontier Preview program, that mailboxes and storage require a separately licensed account, and that Autopilot is heading toward a private preview. Therefore, the information that agents are already “fully” operational in regular businesses has not been confirmed.

How is this different from a chat?

The difference lies not in the quality of the language model, but in the operating model. The chatbot waits for a prompt. According to the description, Autopilot runs in regular cycles (“heartbeats”) and decides on its own whether and when to act. However, the term “end of chatting” is misleading: the standard Copilot subscription still covers the classic assistant, and the autonomous agent is an add-on to it.

Security Questions

When an agent acted on your behalf, they inherited your permissions. Separate identities change this situation: permissions can be set specifically for the agent, and their actions can be tracked separately. However, the question of what the agent is allowed to do on their own remains open. For example, whether they can contact a customer via email or change server settings in the event of an error. This is a general management issue raised by such systems, not a description of a specific feature.

According to Microsoft, the agent’s login credentials are tied to the task, hidden in logs, and managed in the same way as for the company’s own services. This is a claim made by the manufacturer that has not been confirmed by an independent audit. One independent analysis also points out that in an earlier version of Scout, processing by the language model took place outside the standard data protection conditions for Microsoft 365. This is a secondary source, so as an administrator, please verify this directly before deployment.

Pay-as-you-go

The second major change concerns pricing. According to reports, the standard subscription covers the assistant, but services provided by agents such as Autopilot, Code, and Cowork are billed on a pay-as-you-go basis using so-called Copilot Credits. One overview lists the price at approximately $0.01 per credit and notes that billed services are disabled until the administrator sets spending rules. This is a secondary source; please verify the figures with the provider.

According to a technical analysis, an early version of Scout used credits from another service (GitHub Copilot) and represented an additional cost on top of existing licenses. Sources therefore disagree on which credits were used and when, and budget planning must be based on current conditions.

Why It Matters

An agent that operates on its own initiative may consume more resources than expected. Therefore, it is important to set consumption limits and monitor them. This is a logical consequence of the pay-as-you-go billing model.

What we haven't confirmed

• We were unable to find the quote attributed by some reports to a Microsoft engineer—that the main problem is not intelligence but “authorization”—in the available materials, so we are not including it.
• The claim that agents have already “fully” replaced the classic Copilot does not align with the fact that the standard assistant remains in use and agent-based features are still in the preview phase.
• The exact list of what an agent monitors in practice (calendar, Teams, inbox) depends on the organization’s settings and licenses.

What does this mean for the average user?

For individuals, this change is still a ways off; it primarily affects organizations using Microsoft 365 products and administrators. It’s interesting as an example of where AI governance is headed: from the question of what the model can do to the question of who is responsible for its actions and how much it costs.

Conclusion

An agent with its own identity solves a real-world problem: distinguishing human actions from those of software and enabling audits. The pay-as-you-go billing model is also new. However, this does not mark the end of testing or full deployment, but rather the first steps in a category that is still in the preview phase. For organizations, this means deciding on permissions, usage limits, and oversight rules even before the agent gains access to the first email.