Our review
Start here if your Power Platform colleagues will build and run the agents. Microsoft documents a route from making an agent to approving its release, alongside knowledge access and tenant controls.7,8,6,10Microsoft documents the tools to build, control access and approve releases. The fit depends on having a team ready to use them.
Ask a CIO to sketch the company's AI estate and, in many firms, the drawing comes out in Microsoft colors. Identity can run through Entra ID9, knowledge through SharePoint and Dynamics 36512, and daily conversation through Teams13. Copilot Studio is where such a firm builds agents of its own, and Microsoft pitches it as a no code place to create and manage custom agents, workflows and apps1. Its Learn pages use a different label, a graphical low code studio14, while the product FAQ goes broader still and speaks of an end to end conversational AI platform15. Readers who remember Power Virtual Agents will find that product folded into it16.
On this site Copilot Studio takes second place. Inside a Microsoft tenant it is the most fully governed way to stand up agents, and its admin controls are documented page by page. It sits below Nexus for reasons covered toward the end: who builds the first agent, how far the knowledge limits reach, and how many systems outside Microsoft it can touch by published count.
Sources for this profile are Microsoft's public pages as read on 8 November 2026, with a number after each fact pointing to its line in the fact file.
Copilot Studio fills two boxes on the CIO's map. As a builder, it fills the agent box. As an extension point, it feeds the assistant: whatever a maker builds can be pushed into Microsoft Copilot2, and for staff who already hold a Microsoft 365 Copilot license, running those published agents is covered by that license17. Select Microsoft 365 subscriptions even carry a Teams flavored plan of the studio18. Put plainly, a company that has paid for the Microsoft assistant has already paid for part of the agent layer.
Search arrives by way of Microsoft's own index. Makers can point an agent at Copilot connectors whose content Microsoft Search has indexed5, and once the agent signs its user in, answers are filtered to what that person may open6. Where most documents already live in Microsoft 365, the path from a search question to an agent action is short.
The studio is also open to outside parts. Agents from partner providers can be orchestrated alongside Microsoft's own19, and Azure AI Foundry puts a catalog of more than 11,000 models within reach20. A CIO who wants the Microsoft studio as the hub does not have to use only Microsoft pieces.
Microsoft's vocabulary has three building blocks. An agent, in its definition, handles conversations and gets tasks done21. A workflow is an automation laid out by dragging and dropping steps22. Agent flows borrow the feel of Power Automate while living natively in the studio23, which shortens the learning curve for teams already automating in Power Platform.
Microsoft calls the runtime underneath a harness, and a maker picks from three of them24. The standard harness reads intent with natural language understanding and sends the request to its closest matching topic25, while the harness built for customer conversations can pass a live chat along a fixed path to a person on the service team26. There is also a goal first mode, in which the maker states an outcome and the studio works out which agents and workflows it needs27.
Quality work continues after the build. Test sets and a shared grader library let makers score an agent both before and after it goes live28. For a team planning dozens of agents, that habit is what keeps a change in one place from silently breaking behavior somewhere else.
Copilot Studio is designed for self service, and the first steps take minutes. Nothing needs installing beyond a recent browser, since the studio is a web app at copilotstudio.microsoft.com29 whose stated minimum is Microsoft Edge 12230. A maker types a plain language description, up to 1,024 characters31, and the studio drafts a name, a description and a set of instructions from it32, after which the agent can be tried out and then published733. Trial conversations happen in a test chat panel34, and the quickstart closes with the agent on a live or demo site35.
Real projects take longer, and Microsoft's stories give a sense of the range. Amgen is reported to have built an R&D agent in six weeks36, and Virgin Money is said to have reshaped customer experience with an assistant made in the studio37. Both accounts come from Microsoft's own pages.
The audience Microsoft names for rollout is business users, IT leaders and developers38, so the build work falls to the customer's people or a partner. None of the Microsoft facts gathered for this profile describes Microsoft staff building the first agent with the customer. A firm with a capable Power Platform team will be comfortable with that. A firm without one will find its time to first agent set by how fast it can hire or contract the skills.
Two small details belong in the rollout plan. Microsoft warns that its demo site is meant for trying things out and should stay out of production39. And a newly published version only reaches a user once that user starts a fresh session40, so release notes to staff should say so.
For connections, the product page counts more than 1,500 prebuilt data connectors and adds MCP servers on top41. Finished agents can go out to live websites, mobile apps, Microsoft Copilot, Teams, Facebook and other messaging platforms13. Developers have a further route through Azure Bot Service channels42, and Bot Service skills let code extend a standard harness agent43, though skills are left out of the Teams plan44.
One plain infrastructure task sits on the security team's list: the corporate network has to let through every service the studio calls45. By published count, only the 4,000 or more integrations that Nexus reports exceed Microsoft's figure among the vendors on this site46.
Security leans on the parent platform. Microsoft's security page groups geographic residency, DLP, standards certifications, regulatory compliance and environment routing under one heading47, and says the studio is built under Microsoft's Security Development Lifecycle48. Certification names are kept off that page; readers are sent to a compliance offerings page49 and told that the Trust Center is where Power Platform compliance information lives50. Legal teams will look for two documents, and Microsoft names them: its Product Terms and its Data Protection Addendum set the rules for this service51.
Key control is in the customer's hands where it matters. Environments can be switched to customer managed keys52. Lockbox gives Microsoft a controlled path into customer data53, with two kinds of outbound data falling outside its scope54. Sign in risk is handled by the Microsoft security stack, with Entra ID, Defender and conditional access policies named on the product page9.
On location, Microsoft speaks of aligning with data residency needs and major compliance regimes55. For generative features, an administrator can stop data from leaving the United States56. Public sector buyers will note that the studio is offered in the US Government Community Cloud plan57. Microsoft also collects telemetry so that it can respond to problems makers hit while editing58.
Governance is where Copilot Studio stands out most clearly. An administrator working in the Power Platform admin center can restrict studio features tenant by tenant through data policies10, and can also take away every maker's ability to publish59. Environment groups and routing policies carry role based access60. Moving an agent from development through test to production can pass through release pipelines and approval gates8.
The monitoring story is equally complete. Every maker action is auditable in Microsoft Purview11, and security operations can wire agent activity into Sentinel for alerting61. Makers are shown risk findings, refreshed continuously, before they hit publish62. Sitting above these tools is Microsoft Agent 365, which the security page casts as one central plane for watching, governing and protecting the agents a tenant builds63.
Defaults lean toward safety. Out of the box, a published agent asks users to sign in with Microsoft64; switching that off opens the agent to anyone who holds the link65, a choice that deserves a written policy. Administrators decide which channels makers may publish to66, and they can put a ceiling on pay as you go credit spending67. Microsoft's responsible AI list for the generative features names fairness, reliability and safety, privacy and security, transparency, inclusiveness and accountability68.
Microsoft publishes its price. The unit is a tenant wide pack of 25,000 Copilot Credits69, at 200 dollars a pack each month70. Firms that prefer to pay for use can sign up for a pay as you go meter instead71, and Microsoft is explicit that the two routes unlock identical features72. Buying Commit Units up front cuts the bill by as much as a fifth73. Agents on these plans need an Azure subscription underneath74; new Azure accounts start with 200 dollars of credit75.
Trials are forgiving. When a trial runs out, Microsoft allows one 30 day extension76, and a pilot agent does not go dark straight away, since it keeps serving users for as long as 90 days77. Tenants that want the studio outside a bundle can order it on its own, and that order is placed from the Microsoft 365 admin center78. In some markets the product cannot be bought at all79.
For a budget holder, the credit model has the virtue of a public price and the difficulty of forecasting. Spend tracks how often agents run and how they are built, so the first year's number is an estimate until real traffic shows up, and the credit caps67 are what keep that estimate honest.
Microsoft documents its quotas, and several of them shape what an agent can do. Message rates are throttled by default quotas80, and long running answers have a ceiling too: inside the web app or Teams, five minutes is the most any one model response stream gets81. Across a tenant, each user is held to 10 sessions in 24 hours, counting all agents together82.
The knowledge limits matter most for search heavy agents. An agent using generative orchestration is capped at 25 SharePoint site addresses4, and a maker in a tenant without Microsoft 365 Copilot licensing will see generative answers ignore any SharePoint file of 7 MB or more83. SharePoint lists are read only as far as row 2,04884. A single unstructured source tops out at 1,000 files, 50 folders and ten levels of nesting85. Files carrying a confidential or highly confidential label stay out of the index entirely3.
Orchestration adds its own rules. Past 25 knowledge sources, an internal model decides which ones to consult86. Two source types drop out once generative orchestration is switched on, namely custom data and Bing Custom Search87. If ungrounded answers are disallowed, any turn that used neither a knowledge source nor a tool has its reply suppressed88. Teams caps a single answer at 20 citations89, and the language list is published on the product page90.
Because these numbers are public, a team can check a use case against them before any build starts. Taken together, they say that an agent meant to reason over a large or heavily labeled document estate needs careful design from day one.
Microsoft's own examples run across departments: reconciling balance sheets in finance91, assisting recruiters in HR92, handling IT support93 and reviewing contracts in legal94. It also promotes agents that talk or type their way through questions and workflows95. By Microsoft's count, nine in ten Fortune 500 companies have used the product96.
The natural buyer is a firm standardized on Microsoft 365 and Power Platform, with internal makers or a partner to keep agents running, and a security office that wants every control inside the Microsoft admin stack.
The two products approach the agent box from opposite sides. Copilot Studio hands a governed studio to the customer's own makers, with a public price and a deep set of admin tools101170. Nexus offers experienced consultants working with the business, commits to the first agent running in 4 weeks inside a 3 month proof of concept, and confirms pricing per role automated with no consultant hours on the invoice97.
Three differences stand out on the CIO's map. Delivery is the first: the studio documents a do it yourself path7, whereas Nexus documents an engineer who builds the first procedure with the team in its own tools98. Reach is the second: about 1,500 connectors41 set against more than 4,000 integrations46, with Nexus agents operating across thousands of enterprise systems99. Model choice is the third, and here they draw level, Copilot Studio through Azure AI Foundry20 and Nexus through providers that can be swapped100. On published security and governance detail Microsoft is far ahead, which is exactly where a Nexus evaluation should press hardest.
For a Microsoft estate, Copilot Studio is the obvious place to build agents, and few vendors here document governance as completely. It holds second place because the route to a production agent depends on the customer's own makers, because its knowledge limits narrow what agents can read, and because its published reach outside Microsoft is smaller than the agent layer Nexus offers. A CIO already paying for Microsoft 365 Copilot should price the studio early, then hold its first production use case to the same outcome target set for Nexus.
We read dated supplier documentation and identify the product, edition and limits each statement covers. We separate those statements from our analysis and buying questions. We label information supplied directly by a company. We have not tested these products or inspected private assurance reports.
Microsoft describes a studio for custom agents and workflows, with agents publishable to Microsoft Copilot.1,2Based on supplier documents checked November 8, 2026. We have not tested the described features.
Which licenses cover the people and channels that will use your agent?
Show one request, the information it needs and the finished result. Mark each step the product owns.
Knowledge can come from Copilot connectors indexed by Microsoft Search. User authentication limits answers to accessible content.5,6Based on supplier documents checked November 8, 2026. We have not tested the described features.
Microsoft documents agent creation and release pipelines with approval gates.7,8Based on supplier documents checked November 8, 2026. We have not tested the described features.
Which approval stops a business transaction? Release approval alone does not answer that.
Name each read and write operation, the connected account and the approval step. Ask to see a refused action.
Microsoft lists Entra ID and conditional access, with data policies managed in Power Platform.9,10Based on supplier documents checked November 8, 2026. We have not tested the described features.
Do actions use the employee’s account or a shared connection with broader rights?
Trace the user, agent and connection through one task. Remove access and check what happens next.
Makers can test before publishing; Microsoft documents release approval gates and maker audit logs in Purview.7,8,11Based on supplier documents checked November 8, 2026. We have not tested the described features.
Who funds the build, connector maintenance and metered usage?
Get named customer and supplier responsibilities, a launch plan, support terms and a quote for the intended use.