Test Community Network logoThe 365 Copilot Guide
Home

Build and automate: which Microsoft tool should I use?

As access grows, people discover several overlapping ways to specialise Copilot, automate work or delegate tasks. Start with the shape of the work rather than the newest tool.

Last reviewed 2026-10-06

Start with the shape of the work

NeedLikely tool
I want Copilot to behave like a specialist helper for mePersonal Agent
I want the Agent to use approved organisational knowledgeWork-grounded or SharePoint-scoped Agent
I want a lightweight workflow around a SharePoint list or librarySharePoint Workflows / Copilot in SharePoint where available
I want to hand over a defined multi-step jobCowork
I want 'when X happens, do Y' reliably across a processPower Automate
I need to automate a website or Windows application and there is no suitable API or connectorCopilot Studio Computer use — use as a governed fallback, not the default integration pattern
I want an organisational Agent with controlled actions, knowledge and channelsCopilot Studio

The discovery path matters

A personal agent can feel simple because it is close to ordinary Chat. Once an agent starts using organisational data, being shared with colleagues, calling connectors or taking actions, the governance requirements increase. The same idea applies to automation: the more persistent, shared or action-taking it becomes, the more important ownership and lifecycle controls are.

Awarding-organisation examples

A personal agent might explain assessment terminology. A work-grounded agent might answer staff questions from approved centre guidance. A SharePoint workflow might route a centre submission. Cowork might prepare a multi-source qualification review pack. Power Automate might create and track a case when a form is submitted. Copilot Studio might power a governed centre-facing FAQ agent with approved sources and escalation.

Safety options you can add as capability increases

OptionUse it when
Keep it read-onlyThe Agent only needs to answer, summarise or research. Avoid actions until there is a clear reason to add them.
Use a sandbox and dummy dataYou are testing prompts, Agents, workflows or connectors and do not need live candidate, centre, HR, safeguarding or other sensitive data.
Scope the sourcesGive the Agent only the sites, lists, files or systems needed for the job instead of broad organisational access.
Use a designed execution identityA shared Agent or flow takes actions. Do not let it silently inherit the maker's personal credentials or broader access.
Use a persistent Agent identity deliberatelyA long-lived shared Agent genuinely needs its own Microsoft 365 presence. Treat that account as a governed identity with a sponsor, scoped permissions and a retirement process.
Require human approval for selected actionsThe Agent can prepare or recommend a consequential action, but a person should approve the final tool call or process step.
Use Computer use only when it is justifiedThere is no suitable API or connector and the Agent must interact with a website or desktop application. Use a dedicated environment/account, least privilege, representative testing, activity logs and human supervision for consequential steps.
Keep Work IQ or connected tools read-onlyYou want richer context but do not need the Agent to write back to systems. Enable write operations only for justified use cases.
Evaluate before publishingOther people will rely on the Agent. Test representative and edge cases, inspect failures and rerun evaluations after material changes.
Review self-learning recommendations before accepting themThe Agent suggests a workflow or instruction improvement from completed runs. Check the evidence, configure it deliberately, test it and publish through normal change control.
Set spend limits and review datesThe capability uses Copilot Credits, premium connectors or usage billing, or is being piloted by a defined group.

Related guidance

Sources

Related