What's new — June to October 2026
June 17, 2026 — June 16 GA wave: Copilot Cowork is now generally available worldwide, a new
Copilot Credits usage-billing meter has gone live ($0.01 per credit, off by default), and the
Work IQ APIs reached GA on June 16, 2026. None of this changes what Copilot Chat
sees — your licence still determines the data and your permissions still determine the result — but it does change
which surfaces draw a usage charge when they reach into your M365 data. The two new sections below ("Work IQ — the context layer underneath the data scope" and "When access to your data is metered") explain how that fits the data-scope picture in this guide.
July 2026 governance additions: Purview controls now cover Cowork interactions, including sensitivity label inheritance, audit logging, DSPM activity, Insider Risk Management, eDiscovery, and Communication Compliance, all rolled out in June. Copilot-generated files automatically inherit the
highest sensitivity label found in their source data, and users are notified if a label cannot be applied. A Purview DLP control to
exclude external-sender emails from Copilot grounding is in public preview, with general availability targeted for July. Microsoft is also extending
Purview DLP for M365 Copilot into government clouds, letting admins block Copilot and agents from returning a response when a prompt contains sensitive data (Rolling Out, Roadmap 561892).
Mid-July 2026 additions: Content sources in Copilot Chat is rolling out as of 13 July 2026: users can select which content sources ground a response, and answers stay within the chosen sources. The roadmap lists GA for July 2026 (Roadmap 496596).
Purview eDiscovery enhancements for Loop and Copilot Pages reached GA on 13 July 2026: eDiscovery now fully indexes Loop and Copilot Pages content for keyword search in review sets, and adds HTML export from search (Roadmap 561492).
Purview Data Lifecycle Management is adding insights on Copilot and AI app usage with recommended retention policies for governing those interactions; the roadmap lists preview for August 2026 and GA for September 2026 (Roadmap 561209, status as of 14 July 2026).
Late July 2026 additions: The Microsoft Purview DLP policy that restricts Microsoft 365 Copilot from processing sensitivity-labelled files in Word, Excel, and PowerPoint now applies regardless of where the file is stored (Roadmap 557255, GA). In preview, Purview DLP is being extended to restrict Microsoft 365 Copilot and Copilot Chat from processing emails from senders external to the organization (Roadmap 561552), and a separate in-development control will safeguard web searches that contain sensitive data (Roadmap 565870). Purview auto-labelling capacity for SharePoint and OneDrive is rising from 100,000 to 500,000 files per tenant per day (Roadmap 567890, preview), and Data Lifecycle Management retention-based archiving can move inactive OneDrive and SharePoint files to lower-cost storage while keeping them discoverable to Copilot (Roadmap 561208, preview). With a Microsoft 365 Copilot licence, users can also capture offline discussions as searchable voice notes in the Copilot mobile app (Roadmap 498640, preview).
Early August 2026: the web-search control noted above as in development is now
rolling out.
Purview DLP for external web search lets a policy stop Microsoft 365 Copilot and Copilot Chat putting sensitive data into a web query, and Microsoft describes the control as operating in real time (Roadmap 565870). Two DLP diagnostics are in preview:
DLP Policy Change Insights with Security Copilot, which produces a plain-language explanation of what changed in a policy after each update by comparing the version before and after and reporting what changed, where, the impact, and the enforcement implications (Roadmap 559106), and a
guided experience to diagnose and resolve DLP issues, which summarises why a DLP action was taken on a document, which policies were triggered, the order of evaluation, and which conditions evaluated as true or false (Roadmap 561032). Both are aimed at the same recurring problem: a policy blocks something and nobody can say which rule did it. In the other direction,
domain exclusion for web grounding has been rolled back. Microsoft's 4 August post says the feature is withdrawn while it evaluates next steps (Roadmap 503144), so blocking named domains from Copilot web results is not an available control right now.
Mid-August 2026: four changes to what Copilot can reach and how quickly it reaches it.
Vision in Microsoft 365 Copilot can analyse content shared on a desktop screen and, on mobile during a real-time voice session, a live feed from the device camera, answering questions about what it sees in spoken form and grounded in work and web data; the roadmap entry reads generally available against a June 2026 target date (Roadmap 561037). Treat that as a new input surface rather than a new data source: what reaches Copilot is whatever a user puts on screen or in front of the camera, which sits outside the document permission model the rest of this guide describes.
SharePoint Authoritative Sites lets administrators designate specific sites as official, trusted sources, and Microsoft states that classifying a site as authoritative causes its content, such as company news, policies and updates, to be prioritised across Copilot Search experiences (GA). Copilot connectors now run
content crawl and identity crawl in parallel rather than sequentially, so ingested content reaches users sooner (GA). And
ServiceNow Knowledge and Catalog connectors enforce permissions based on user roles such as admin, knowledge manager and knowledge admin, where permissions were previously determined by user criteria alone without considering roles (GA). Those last three come from Microsoft's 11 August release-notes batch, where general availability means released to Current Channel and still rolling out inside a tenant.
Late August 2026: the web-search control has finished moving.
Purview DLP for external web search is now generally available, so a policy can stop Microsoft 365 Copilot and Copilot Chat using sensitive data for an external web search (Roadmap 565870, entry read 20 August 2026). Note the date: the roadmap gives July CY2026 as its availability month, and the 20 August stamp on the entry is the day the row was last edited, not the day the control shipped. If this is the first you have seen of it, it has been available longer than that stamp suggests. Two Purview items behind it are in development, worth tracking rather than acting on.
eDiscovery will let you select a user-owned SharePoint Embedded container as a data source, which matters to this guide because those containers hold Loop, Copilot Pages and Copilot Notebooks content (Roadmap 569364, October CY2026). And
Data Lifecycle Management retention based on when a file was last accessed is coming for OneDrive and SharePoint items (Roadmap 472030, December CY2026).
Early September 2026: Copilot Chat picked up features that change what leaves a conversation and what can ground one. Microsoft's August roundup lists
text selection (act on a selected sentence, paragraph, or table in a response),
session sharing via a read-only link that recipients can continue,
Power BI reasoning grounded in reports and semantic models (Public Preview in June, worldwide in August), model-driven answer cards for weather, sports, finance, images, video, places, and news, and a Try again option to regenerate a response. Two of those belong in a data-scope review: a shared session is a new way conversation content travels between people, and Power BI reasoning adds reports and semantic models to what can ground an answer. The same roundup announces
new third-party Copilot connectors across industries: financial (Mercury, Xero); legal (iManage Work, Boardwise, Harvey, Descrybe Legal Engine, Relativity, Everlaw); professional and business (Statista, Crossbeam, ZoomInfo, IDC); energy (S&P Global Energy); healthcare (Scite, Consensus); and software (Adobe Journey Optimizer, GoDaddy, Asana). Each one is a new grounding surface with its own permission model, so give it the same review as any new data source rather than switching it on because it appeared in the list. And a status note on the web-grounding control discussed above: the roadmap entry for
domain exclusion for web grounding now reads rolling out, with a target GA per the roadmap of September CY2026 (Roadmap 503144, status change 1 September 2026), so the control withdrawn in August is moving again; treat it as available only when it appears in the tenant.
Mid-September 2026: the web-grounding control has moved once more. Microsoft's 9 September 2026 post says
domain exclusion for web grounding is rolled out again after its rollback: admins can exclude up to 1,000 external domains from Copilot's web grounding, the control is off by default, and it is configured through the PowerShell script Microsoft provides. The early-August withdrawal and the early-September return to rolling out noted above stand as history; organisations that had planned to use the control can proceed with configuration and re-test the exclusion list. On the roadmap,
Purview DLP is extending to Microsoft Cowork so one policy covers Microsoft 365 Copilot and Cowork: blocking labelled knowledge sources, prompts containing supported sensitive information types, and sensitive prompts going to Bing web search (Roadmap 570845, in development). Preview is set for September 2026 and GA for October 2026, worldwide multi-tenant, so line up the Copilot DLP policy owners now. And the
DLP Policy Change Insights with Security Copilot capability noted in early August has a separate roadmap entry scoped to government clouds: Security Copilot in Purview DLP will summarise policies so DLP admins can prompt for coverage across locations, classifiers and notifications, on all or selected policies (Roadmap 472031, in development). Target GA per the roadmap: September 2027, and the entry lists only GCC, GCC High and DoD, so there is nothing to plan yet outside those government clouds.
Late September 2026: one status change and one Purview entry to track. The
session and response sharing noted in early September now reads rolling out on the roadmap: Microsoft 365 Copilot users can share a full chat session or a single response through a link, and recipients open a read-only view and can continue from it in their own Copilot chat (Roadmap 562353, status change from in development to rolling out; the roadmap lists GA August 2026, worldwide multi-tenant). Check that link-sharing of Copilot output fits existing data handling guidance. On the Purview side,
Data Security Posture Management is adding a readiness for Microsoft Copilot view covering sensitive data exposure, oversharing and protection coverage, plus a data explorer that brings sites, sensitive data, permissions and preset views into one investigation surface (Roadmap 571157, in development). Preview is set for September 2026, and target GA per the roadmap is January 2027, worldwide multi-tenant.
End of September 2026: one roadmap entry was cancelled outright and one changes how retention works. Microsoft's 18 September update states it is
cancelling the Content Sources in Copilot Chat entry at this time. That entry described letting users pick content sources in Copilot Chat so responses drew only on the selected ones, and the roadmap moved it from rolling out to cancelled (Roadmap 496596). If a planned control was resting on users narrowing their own grounding, it is not coming. On retention,
legacy Teams retention policies that cover Copilot will be converted to Teams-only policies (Roadmap 571306, in development). Retention scoped to Microsoft Teams may today also cover Microsoft 365 Copilot interactions; after the change, any Copilot retention requirement needs its own policy rather than riding on the Teams one. Target GA per the roadmap: October 2026, worldwide multi-tenant. Check whether a Teams policy is currently the only thing retaining Copilot interactions in your tenant. Two surface additions: a
Copilot chat pane inside Microsoft Forms helps improve forms and quizzes, draft and send invitations, and analyse responses, reached through the Copilot icon by Microsoft 365 Copilot licensed business users; and
buildings, rooms and desks in the Places directory gain profile cards reachable from Copilot Chat and other Microsoft 365 entry points, listed for Windows.
Early October 2026: three additions to what can ground an answer, and all three are grounding surfaces rather than features.
Copilot Chat is rolling out better matching of search results from scanned PDFs among the files a user is working on (Roadmap 559613, moved from in development to rolling out on 1 October 2026). Read it as a retrieval change rather than a permission change: scanned-PDF content your permission model already covered, and which Microsoft describes as previously hard to find, now turns up in results.
Copilot Chat in Microsoft Edge for Business will answer questions about the cloud documents a user has open in the browser, with the roadmap targeting general availability for October 2026 (Roadmap 499423, in development). And in Copilot Studio a
Copilot node in a workflow is in preview: where available it runs Copilot Chat or a Cowork task grounded in the connected user's mail, files, calendar and chats, and can call Researcher, Analyst or an Agent Builder agent. It runs in that user's context, so the question for a reviewer is not whether permissions still apply but who decides the scope, and on the page's own wording that decision sits with whoever governs the workflow. One Purview note worth recording because it looks like a duplicate and is not: a second roadmap entry now carries the same auto-labelling capacity increase from 100,000 to 500,000 files per tenant per day first noted above in late July (Roadmap 571309, in development, alongside the earlier Roadmap 567890).
Mid-October 2026: Microsoft documented a retrieval tool that reaches your Microsoft 365 content, and one line in it matters more than the feature does. On 13 October Microsoft published
the retrieve tool in Work IQ MCP, in public preview, which lets an agent search Microsoft 365 content and return results rather than a final answer. It takes a
capabilities list that acts as a source allow list for a single call, naming People, Meetings, OneDriveAndSharePoint, Email, TeamsMessages and GraphConnectors. The default is the part to read twice: the page states that if capabilities is omitted, or an empty array is passed, Work IQ searches every source available to that agent and strategy.
Omission is not restriction. Two reach settings sit above it, grounding, the default, covering Microsoft 365 indexed content including SharePoint, OneDrive, Teams and Outlook, and copilot, covering that plus connected enterprise sources, so the difference between those two words is whether your connectors are in scope. The same page lists Dataverse as a capability name while stating that Dataverse is not currently a supported retrieval source and that the name should not be taken to imply current support: a name in a schema is not a connection. All of it is public preview.
Mid-October 2026, continued: Memory citations reached GA on 14 October. When Copilot Chat uses memory to personalise a response, a user can select Sources beneath the response and open a Personalization tab showing the custom instructions, saved memories, memories learned from conversations and past chats that shaped it (Roadmap 574111). That belongs with the section below on why two people get different answers to the same prompt, because it is the first surface that answers the question from inside the product rather than from an admin centre. Three further entries are in development. Two change scope, and the third adds function inside Copilot Chat.
Purview DLP is extending Administrative Units support to Microsoft 365 Copilot, Copilot Chat and Cowork, so a DLP policy can apply to one region, department or subsidiary rather than the whole tenant (Roadmap 575287, 13 October 2026).
Copilot Chat is planned for shared and delegate mailboxes in classic Outlook, for users holding read and manage (full access) and/or mail folder-level permission, when the mailbox is added as a resource (Roadmap 573698, in development as of 13 October 2026); that is a new answer to whose data a Copilot session reaches, and it is worth deciding before it arrives rather than after. And
Planner Agent is planned to surface Planner work management inside Copilot Chat, covering personal tasks and shared basic plans (Roadmap 573168, 14 October 2026).