Risk · 01
One window is not one account
The updated Copilot app can hold a personal sign-in and a work sign-in. The data stays apart.
Risk
What it may see, decided before anyone relies on it.
Risk, for a company new to Microsoft AI, is not a slide after the rollout. It is what the tool may see, who owns that data, what gets logged, and what a person must approve before a customer sees the output.
September 2026 did not switch every feature on for every seat. Home and Code are a staged Frontier rollout. Autopilot is a private preview. Managed Runtime is a public preview. The notes below each take one announcement, or one licence fact from Microsoft Learn, and read it only as a boundary.
Where a note mentions FrontierOrg, that is a fictional method for rehearsing a decision. It is not a company, not a client, and not a case study.
Twelve short readings
Risk · 02
Autopilot arrives as another identity
A persistent agent has its own tenant identity. Private preview is not permission to leave it running.
Risk · 03
The customer does not see the draft
Cowork can finish a pack. A person still approves anything a customer will read.
Risk · 04
The new app still runs inside the tenant
Managed Runtime hosts Copilot-built code inside Microsoft 365. It is a public preview, with an admin switch.
Risk · 05
Agent 365 does not see every agent
The control plane inventories agents published through Microsoft 365. Agents built outside that path need extra steps.
Risk · 06
A renewal answer is only as good as the record
Work IQ can join sales, service, mail and meetings. Preview is not a licence to write the record back.
Risk · 07
Copilot reads what people can already open
Oversharing is the boundary. SharePoint Advanced Management and Purview are how Learn says you narrow it.
Risk · 08
A label is a boundary, not a sticker
Purview labels and data loss prevention decide what an answer is allowed to lean on.
Risk · 09
Security Copilot is a different room
The 25 September Home announcement did not turn security investigations into a worker chat feature.
Risk · 10
A catalogue of plugins is not a check
A plugin registry can make a connection reusable. It does not prove the action is right.
Risk · 11
Copilot Code is not GitHub Copilot
Natural-language apps, Studio agents, GitHub Copilot and Foundry are different builders with different data.
Risk · 12
Someone has to be able to switch the app off
A field-service app that writes back needs an owner, an audience, and a disable switch.