Microsoft Copilot Studio Wave 2: No-Code AI Agent Building Just Landed Inside Microsoft 365

TL;DR: Microsoft's 2025 Release Wave 2, announced 16 July, turns Copilot Studio into a proper no-code agent builder that sits inside the Microsoft 365 ecosystem your company already pays for. Ops teams can now build AI agents that automate workflows across Teams, Outlook, and SharePoint without touching a separate platform. The governance story is more mature than most standalone tools. But the trade-offs are real, and they'll matter depending on what you're building.

---

Here's a sentence I never thought I'd write: the most interesting no-code platform launch of the month came from Microsoft.

On July 16, Microsoft dropped the plans for its 2025 Release Wave 2, covering features rolling out from October 2025 through March 2026. Buried in the Power Platform section was something that should make every ops team sit up: Copilot Studio is becoming a genuine no-code agent builder, and it lives inside the tools your organisation already uses every day.

I've been watching the 'embedded no-code' thesis play out for a couple of years now. The idea is simple: instead of asking ops teams to adopt a separate platform like Zapier, Make, or Stacker, why not give them the same capabilities inside the SaaS tools they're already in? Asana did it with their $75M StackAI acquisition. Notion's been creeping toward it with their developer platform. But nobody has the surface area Microsoft does. Four hundred million M365 users. That's the beachhead.

What can ops teams actually build?

The short answer: more than you'd expect, less than the demos suggest.

Copilot Studio has always been more of a chatbot builder. Wave 2 changes that. The planned features include multi-step workflow automation, conditional logic, and deeper connectors into Teams, Outlook, and SharePoint. You can now build an agent that, say, monitors a SharePoint folder for new invoice PDFs, extracts the key fields, cross-references them against a Dataverse table, drafts an approval email in Outlook, and posts a summary to a Teams channel when it's done. All configured through a low-code canvas, not a code editor.

That's not hypothetical. The "computer use" capability that went GA in May 2026 already lets agents control browsers and desktop apps. Wave 2 layers in the M365-native connectors that make those agents useful inside the Microsoft ecosystem specifically.

There's a genuine shift in the type of thing you can build. Before Wave 2, Copilot Studio agents were conversational. Now they're orchestrational. They can chain actions across apps, wait for human input, branch on conditions, and hand off between agents. If you've used Make or n8n, the mental model will feel familiar, except the building surface is Microsoft's and the connectors speak M365 natively.

What about governance?

Here's where Microsoft has a structural advantage over every standalone no-code platform: they already own the enterprise identity and compliance layer.

Copilot Studio's governance stack now covers a lot of ground. Data loss prevention policies, environment routing so makers get a safe sandbox, sensitivity labels that propagate from SharePoint sources into agent responses, customer-managed encryption keys, audit logs in both Purview and Sentinel, and automatic security scans before an agent can be published. You can even scope Conditional Access policies to individual agents via Entra Agent IDs.

Compare this to what you get with a standalone platform. Zapier's enterprise plan gives you SAML SSO and an admin dashboard with some usage visibility. Make's got team roles and org-level admin. But neither can match the depth of controls that come from being a citizen inside the Entra ID / Purview / Sentinel ecosystem. If your organisation lives in Microsoft 365, the governance delta is real and it's wide.

That said, governance in Copilot Studio still means governance the Microsoft way. If your IT team doesn't use Sentinel, those audit logs are theoretical. If nobody's configured DLP policies in the Power Platform admin center, the guardrails aren't on. The tooling exists. Whether anyone turns it on is a different question.

Where Copilot Studio wins

Zero procurement friction. Your company already has M365 licences. Copilot Studio is either included or a modest add-on. There's no separate vendor assessment, no security review for a new SaaS tool, no budget line to justify. For ops teams inside large enterprises, this alone is a bigger deal than any feature comparison.

Native M365 connectors. Building an agent that interacts with SharePoint, Teams, and Outlook using a standalone tool means OAuth flows, API permissions, and a lot of swearing at Microsoft Graph documentation. In Copilot Studio, those connections are pre-authenticated and pre-authorised. The agent just works.

Enterprise identity is built in. Agents run as the user or as a service principal. Every action is traceable to an Entra identity. That's the kind of thing auditors care about that standalone platforms have to bolt on after the fact.

Where it falls short

It's still a Microsoft sandbox. If your workflow touches tools outside the Microsoft ecosystem, you're back to building custom connectors or leaning on Power Automate, which adds complexity and cost. Standalone platforms win on breadth. Zapier connects to 7,000+ apps. Make's got a genuinely flexible HTTP module. Copilot Studio's world is M365-first and everything else is a second-class citizen.

The authoring experience is bureaucratic. I've spent enough time in Microsoft's low-code tools to know that 'low-code' in Microsoft-land often means 'we replaced JavaScript with seventeen configuration panels and a confusing property pane.' Compare that to the speed of building in something like Stacker or the sheer visual clarity of Make's scenario builder. Copilot Studio is powerful, but nobody would call it delightful.

Lock-in is real and it's deliberate. Your agents, your data, your logic, your deployment model: everything sits inside the Microsoft stack. That's fine until you need to migrate, or until Microsoft changes the licensing, or until you realise the thing you built only works because of a connector Microsoft hasn't updated in 18 months.

The bigger picture

Wave 2 isn't just a feature update. It's Microsoft planting a flag in the ground that says: AI agent building is now a platform feature, not a separate product category.

That's the 'every SaaS is a no-code builder' thesis playing out in the most consequential way possible. When the world's largest enterprise software company decides that custom AI agents belong inside the productivity suite, it reshapes expectations. Ops teams who've been evaluating Bubble or Softr or Zapier for agent-building workflows will now have a 'free' alternative sitting right there in the tenant they already log into every morning.

Will that kill standalone platforms? No. The best standalone tools still win on flexibility, cross-ecosystem connectivity, and user experience. But it raises the bar for what those platforms need to offer to justify a separate subscription. 'We connect to Microsoft 365' stops being a differentiator when the M365-native option connects better and costs nothing extra.

For ops teams, the practical question is this: is your workflow M365-centric enough that Copilot Studio's advantages outweigh its limitations? If the answer is yes, you've just gained a pretty serious AI agent builder without having to ask anyone for budget. If the answer is no, the standalone ecosystem isn't going anywhere, but it's going to have to work harder to justify its seat at the table.