Copilot Agents in Microsoft 365: Who can use what ?

I get a version of the same question from customers pretty often.
“If I build an agent in Copilot Studio OR Copilot cclient, who needs a license? Who can use it?”
Fair questions. The annoying part is that the answers have moved at least three times in the last twelve months, and they will move again before this article is a quarter old 🙂

April 2026 made the picture sharper, not simpler. From April 15, Microsoft removed Copilot Chat from Word, Excel, PowerPoint, and OneNote for unlicensed users in tenants over 2,000 seats. A few days later, on April 20, prepaid Copilot capacity packs started working without an Azure subscription. Two changes pulling in opposite directions: less free Copilot for users, easier paid consumption for tenants.

A Copilot agent is not just a license decision. It’s four: the user license, the agent’s authentication choice, the sharing surface, and the consumption layer. They interact, and any of them can quietly limit what you thought you could do….

TL;DR

Licensing, auth, sharing, and consumption interact in non-obvious ways.

You don’t need M365 Copilot licenses for every agent user.

Layer 1: the user license

Three different license tiers .

Microsoft 365 Copilot

This is the paid add-on, It gives you the deep Office app integration in Word, Excel, PowerPoint, Outlook, and Teams, and it gives the user the broadest agent access, including some agent consumption that’s covered by the seat license rather than billed separately.

Microsoft 365 Copilot Chat

Yeah i know – name has changed…. AGAIN 🙂
This is the free tier that comes with most paid Microsoft 365 subscriptions. By default it’s web-grounded only, no tenant data.
Copilot Chat in Outlook stays available to unlicensed users for inbox and calendar grounding regardless of tenant size, While inside Word, Excel, PowerPoint, and OneNote the picture splits: for tenants over 2,000 seats Microsoft removed Copilot Chat for unlicensed users on April 15, 2026, leaving only the Microsoft 365 Copilot app and the web; for tenants under 2,000 seats it stays in-app under throttled “standard access” apparently with persistent upgrade prompts.

The part that surprises people is that a Copilot Chat user can run agents you build, including agents that read from your tenant, i wasnt even sure about this when testing.
The billing depends on how that tenant access is wired in the agent settings…. a SharePoint knowledge source pointed at a specific URL behaves like a scoped lookup, and in tenants with M365 Copilot licenses already in play it “just” works for unlicensed users without you ever buying a capacity pack.

I tested this in our own tenant, with myself as a licensed agentbuilder, sharing to an unlicensed user, an agent reading from a single SharePoint document library by URL, no capacity packs configured, the agent answered fine ! 👌
Consumption is still happening somewhere, most likely drawn from a pooled Copilot Studio credit allocation that comes along with M365 Copilot licensing, but no one has to actively configure it.

Broader Graph grounding is the premium path, and an unlicensed user calling that should get blocked unless the tenant admin has set up Copilot Studio billing (capacity packs or pay-as-you-go).
Cost moves from the seat to the action either way; what changes is whether you can see the bill or not

CoPilot Studio license

This is a separate license, paid for builders and the capacity that powers agents.
It has nothing to do with the user-facing M365 Copilot license.

There is an elaborate CP studio licensing guide here: https://go.microsoft.com/fwlink/?linkid=2320995

The headline …. you do not need to buy Microsoft 365 Copilot for everyone who uses your agent.
Copilot Chat ccan be enough. The cost CAN the show up as metered consumption against the tenant or be covered by allocation that comes along with M365 Copilot licensing as mentioned earlier.

Layer 2: the authentication choice

This is the layer some admins discover by accident, for instance when a channel they wanted is suddenly greyed out…. that happened to me at least.

Open any agent in Copilot Studio, go to Settings, Security, Authentication. Three options.

“Authenticate with Microsoft” is the default. It uses Entra ID and is the right answer for almost every internal agent. The cost: this choice silently restricts where your agent can run.
The Channels page shows the change

If you want to publish to a Demo website, an external web channel, or any other surface, you have to switch to “Authenticate manually” and configure an OAuth provider yourself. There is no in-between. The authentication toggle forces the channel options.

A few sub-rules worth knowing before you publish anything.

Single sign-on with Entra ID works for Teams 1:1 chats. It does not work in group chats or channel messages yet.
Multi-tenant mode, still in preview, doesn’t support end-user authentication.
The connection manager can’t complete a cross-tenant request, so manual authentication is the only option there today.

If your agent has to span Teams and the public web, you will end up running two configurations or moving to manual authentication. Decide that before you start building. Backing out of the auth choice later is painful.
Best bet here in my opinion is to built TWO agents and make them target either Teams or www.

Layer 3: the sharing surface

Once authentication is in place, sharing is the easy part.
The catch now is that there are several sharing surfaces and they don’t all do the same thing. 🙂

The direct share dialog gives you per-user, per-group, or “Everyone in organization” access. Useful for pilots, useful for restricting an HR or finance agent to the right group.

Beyond direct share, there are two paths to wider distribution. The first is the “Show in Built By Your Colleagues” checkbox on the share dialog. Tick it and your agent surfaces in the Teams app store under “Built with Power Platform”, visible to colleagues who go looking.
EASY and no admin involvement.

The second is admin promotion.
Agents can be submitted for placement in the “Built for your org” section of the Teams app store and the Microsoft 365 Agent Store.
That requires admin approval and is the right path for anything you want to be used more broadly

Inside the agent details, another set of toggles matters. “Users can add this agent to a team” and “Use this agent for group and meeting chats” decide whether your agent can be invited into team channels and meetings. That second one in particular has implications: a meeting-eligible agent can listen, summarise, and respond inside a meeting context. Microsoft warns about spam risk for a reason.

Layer 4: the consumption layer

In September 2025 Microsoft replaced “messages” with “Copilot Credits” as the unit of consumption.
One credit is roughly one US cent.

Two consumption rules are worth remeber.

Autonomous triggers cost 25 credits each, every time, no exceptions.

Interactive consumption varies. A simple Q&A response is cheap. Grounding in tenant data via SharePoint or a Copilot connector is more expensive. Generative actions and tools cost more again.

For Copilot Chat users running your agents there is no seat license, just metered consumption charged to the tenant…. but again there are credits pooled with your addon licenses 🙂

I honestly havent yet figured out how to calculate that…. but I am working on it.

What this means in practice

Before you share an agent with the organisation, walk the four layers in order.

Decide which user license your audience has. If most are on Copilot Chat, your cost model is consumption only, and you should size capacity packs accordingly – OR rely on pool.
Decide your authentication choice next, because it locks your channels, don’t pick “Authenticate with Microsoft” if you also need a web entry point.
Decide your sharing surface, both the share dialog and the agent details, and pick the right combination for the audience.
Estimate consumption last, with autonomous triggers as a separate line, before flipping “Everyone in organization”.

The bigger picture

I guess Microsoft is in the middle of moving the commercial model from per-seat to per-action…. as other AI providers also the April 2026 changes are two ends of the same strategy
Copilot Chat gets pulled out of Office for unlicensed users in large tenants, which pushes those organisations toward the per-seat license.
At the same time, capacity packs get easier to buy, which makes per-action consumption viable for organisations that don’t want to license everyone…. but also dont have Azure as such enabled (no subscriptions)

Both directions point at the same assumption: They expect more users to interact with agents than will ever hold a Copilot seat license, and the billing model is being rebuilt around that.
Agents are a very visible evidence of that shift.

Relevant Microsoft documentation:

Copilot Agents in Microsoft 365: Who can use what ?

TL;DR