Microsoft Copilot Wave 3: What Enterprise IT Actually Needs to Know

Microsoft Copilot Wave 3 is GA. Here's a practitioner breakdown of Copilot Cowork, M365 E7 licensing math, and what governance controls you need before enabling it org-wide.


TLDR: Microsoft Copilot Wave 3 went broadly GA on May 5, 2026, with the headline feature being Copilot Cowork — background multi-step task execution powered by Anthropic Claude. For M365 shops already on E5, the upgrade question is whether E7’s bundle (E5 + Copilot + Agent 365 + Entra) pencils out at scale. The short answer: it does for organizations planning to expand agentic AI beyond productivity assistance into governed automation. It doesn’t if you’re still in pilot mode. Governance configuration is the prerequisite no one in the marketing materials emphasizes.

Why Wave 3 Is Different From the Previous Releases

Microsoft has shipped Copilot updates at a pace that’s been difficult to track. Wave 1 was the initial Copilot for M365 release. Wave 2 added draft generation, summarization, and meeting intelligence across Teams, Outlook, and Office apps. Both waves were fundamentally about AI assisting users in doing what they were already doing.

Wave 3 is a different category of capability: autonomous multi-step task execution.

Copilot Cowork, the flagship Wave 3 feature, can plan and execute tasks that span multiple apps — without the user staying in the loop for each step. You give it a goal (“research our top 10 competitors and summarize pricing changes from the last 90 days, then draft a briefing in Word and send it to the strategy team in Teams”) and Cowork handles the execution in the background while you do other work. It notifies you on completion.

That’s not incremental improvement. That’s a qualitative shift from assistant to agent.

The simultaneously launched M365 E7 “Frontier Suite” packages this capability — Copilot + Agent 365 governance + Entra identity management — into a single enterprise license tier. The message is explicit: Microsoft wants large organizations to move from Copilot experimentation to governed, organization-wide agentic deployment.

Whether you should is a different question.

What Copilot Cowork Actually Does

Cowork was developed in collaboration with Anthropic, using Claude’s underlying reasoning and orchestration capabilities. It’s available in the Copilot mobile app (iOS/Android) as of May 5, 2026, with desktop availability rolling out through Q2.

Here’s what it can do in production today:

  • Cross-app task execution: Cowork can move between Word, Excel, PowerPoint, Outlook, Teams, and OneDrive as part of a single task chain — reading source data, creating outputs, and routing results.
  • Background execution with notification: Tasks run while you work elsewhere. Cowork sends a Teams or Outlook notification when complete or when it needs input.
  • Multi-model access: Wave 3 adds support for GPT-5.3, GPT-5.4, Claude Sonnet 4.6, and Claude Opus 4.6 in Copilot Chat. You or your admins can configure which models are available, and to whom.
  • Outlook agentic experiences: Copilot in Outlook can now proactively manage meeting cadence — not just schedule meetings, but wind them down, suggest agenda changes, and surface scheduling conflicts before they become problems.

Here’s what is still maturing:

  • Complex task chains with many conditional branches sometimes require human re-engagement. Cowork handles linear workflows well; highly branching or exception-heavy workflows still need monitoring.
  • Desktop availability is rolling out — at launch, Cowork is fully available on mobile only. Windows and Mac desktop clients are staggered through mid-2026.
  • Reliability at scale (large organizations with high Cowork usage simultaneously) hasn’t been proven in production yet.

Earned insight: The most common early failure mode in agentic M365 deployments isn’t a technical one — it’s a data permission one. Copilot Cowork executes tasks using the data it can access, not the data you intend it to use. Organizations with inconsistent SharePoint permissions, over-broad OneDrive sharing, or documents accessible to larger groups than intended will find Cowork surfacing content in outputs that employees wouldn’t normally see. This is not a Cowork bug — it’s an M365 permissions hygiene problem that Wave 3 exposes rather than creates.

M365 E7 Licensing: Is It Worth Upgrading from E5?

The M365 E7 “Frontier Suite” — launched May 1, 2026 — bundles:

  • M365 E5 (full compliance, advanced security, Power BI, audio conferencing)
  • Microsoft 365 Copilot (Copilot in all M365 apps + Cowork)
  • Agent 365 (governance control plane for AI agents across Microsoft and third-party platforms)
  • Entra Suite (identity governance, privileged identity management, verified ID)

The bundle is positioned for organizations scaling from “Copilot experiment” to full agentic deployment. Here’s the licensing math that matters.

E7 vs E5 + Standalone Copilot: 500-Seat Scenario

ComponentE5 + Add-onsE7 Bundle
M365 E5~$57/user/monthIncluded
Copilot for M365~$30/user/month (add-on)Included
Entra Suite~$12/user/month (add-on)Included
Agent 365~$10–15/user/month (est.)Included
Est. Total (500 users)~$109/user/month~$105–115/user/month est.

At scale, E7 is roughly cost-neutral to E5 + individual add-ons — sometimes slightly cheaper depending on existing add-on commitments. The upgrade makes most sense when:

  1. You’re already paying for Copilot as an E5 add-on
  2. You have or plan to have an active agentic AI deployment that requires Agent 365 governance
  3. You’re using or need Entra Suite capabilities for identity governance

The upgrade makes less sense when:

  1. You’re in a Copilot pilot with limited seat count (the bundle economics don’t favor small deployments)
  2. You don’t plan to use Agent 365 actively — you’d be paying for governance infrastructure you won’t configure
  3. You’re budget-constrained and the marginal cost increase is difficult to justify without a clear ROI case

Tip: If your organization is evaluating E7, ask Microsoft for a Copilot usage report before you commit. Microsoft’s Customer Success team can pull aggregate Copilot adoption data for your tenant — it shows how many licensed seats are actually active. If adoption is below 60%, solve the adoption problem before adding more license cost. E7’s value compounds on active use, not on seat count.

Governance: What You Need Configured Before Enabling Cowork

This is the section most vendors skip. It’s also the most important.

Copilot Wave 3 introduces autonomous task execution. That means Copilot can take actions — not just suggest them. Before you enable Cowork at the organizational level, three governance components need to be configured:

Purview Data Classification

Microsoft Purview (included in E5/E7) can classify documents by sensitivity — confidential, restricted, internal, public. When Copilot Cowork executes a task, it respects Purview labels. If a document is labeled “Confidential,” Cowork won’t surface it in outputs going to users without the appropriate clearance.

The prerequisite: your documents need to actually be labeled. Enabling Purview without running a classification sweep first means Cowork operates on unclassified data — which is essentially the same as no governance at all.

Timeline: expect 4–8 weeks to run a meaningful Purview classification effort across a mid-sized M365 tenant before Wave 3 enablement.

Agent 365 Oversight Configuration

Agent 365 is the governance control plane for AI agents in the Microsoft ecosystem — first-party (Copilot, Power Platform agents) and third-party. In the context of Wave 3 rollout, the relevant configurations are:

  • Anthropic model access controls: Admins can enable or disable access to Claude Sonnet 4.6 and Claude Opus 4.6 by user group. Start with a pilot group; don’t enable org-wide on day one.
  • Cowork action logging: Agent 365 captures logs of what Cowork tasks were executed, by whom, and what data was accessed. Configure log retention before enabling Cowork — retrofitting audit logging is harder than enabling it upfront.
  • Risky agent detection: Agent 365 + Defender integration can flag unusual agent behavior. Set the alert thresholds before you have a situation requiring investigation.

Admin Controls for Anthropic Model Access

A new Wave 3 capability worth noting: admins can now configure Copilot model access at the user or group level. You can give your leadership team access to Claude Opus 4.6 while restricting the broader org to GPT-5.3 or Claude Sonnet 4.6 — useful for cost management and for staged capability rollout.

This is configured in the Microsoft 365 admin center under Copilot settings. It’s one of the cleaner governance additions in Wave 3.

What’s Still Missing

Wave 3 is a meaningful release, but enterprise IT teams should know what gaps remain:

  • Cowork rollback is limited. If a Cowork task takes an action you want to undo — sending an email, updating a SharePoint document, creating a Teams post — there’s no Cowork-native undo. You’re relying on M365’s standard edit/recall functionality, which varies by app.
  • Audit granularity by app varies. Agent 365 logs Cowork tasks, but the level of detail differs by application. Outlook task execution is logged more granularly than SharePoint document modifications in current preview.
  • Cross-tenant data governance is still developing. Organizations with guest users or multi-tenant architectures need to carefully scope Cowork access — guest user context handling in Cowork is in preview.

Warning: “Generally Available” in Microsoft’s release cadence doesn’t mean feature-complete or fully enterprise-hardened. Wave 3 features are GA for release purposes, but several capabilities — desktop Cowork, Cowork in channels, cross-tenant governance — are still rolling out through Q2 2026. Build your rollout timeline around confirmed GA dates, not announced ones.

Competitive Landscape: Why This Matters for Your Stack

Microsoft Copilot Wave 3 is targeting the same buyers as Salesforce Agentforce, ServiceNow Now Assist, and emerging platforms like Google Gemini for Workspace. The differentiator is ecosystem depth.

For organizations whose work lives in M365, Copilot’s integration advantage is real: no API connectors, no data extraction, no permission re-mapping. Cowork accesses the same data your employees access, using the same identity and permission model.

For organizations with mixed stacks (Salesforce + M365, or ServiceNow + M365), Wave 3 adds a new decision: do you centralize agentic automation on Copilot, on Agentforce, or build a cross-platform orchestration layer? Agent 365 is Microsoft’s answer to the latter — it’s designed to govern agents from multiple vendors, not just Microsoft’s own.

That’s an important architectural claim. How well Agent 365 actually governs non-Microsoft agents in production remains to be validated at scale.

Bottom Line

Microsoft Copilot Wave 3 is the most significant Copilot release since the initial launch. Copilot Cowork is genuinely useful for cross-app task automation, and the M365 E7 bundle makes sense for organizations that were already paying for E5 + standalone Copilot. Wave 3 shifts Copilot from AI assistant to AI agent — and that shift requires governance infrastructure that isn’t pre-configured out of the box.

The critical prerequisite: configure Purview classification and Agent 365 oversight before enabling Cowork org-wide. Organizations that skip this step will discover the problem through an incident rather than a configuration review.

For M365-centric enterprises ready to invest in governance setup, Wave 3 is worth enabling on a staged basis — pilot group first, then department-level, then org-wide. For organizations still in Copilot pilot mode with low adoption, the E7 upgrade can wait until adoption exceeds 60% of licensed seats.

Rating: 4.0 / 5 for Wave 3 Copilot Cowork in governance-ready M365 shops. Drops to 3.2 / 5 for organizations enabling it without Purview configuration in place.


Laura Kessler — Enterprise Integration Architect
Laura Kessler Enterprise Integration Architect

Laura has spent 20 years designing integration platforms for global enterprise rollouts. She is a certified MuleSoft Architect and has led automation center of excellence buildouts using Workato, Boomi, and MuleSoft at organizations with thousands of connected systems. Her work sits at the intersection of API-first platform design and the operational reality of legacy systems that vendors pretend do not exist. She evaluates automation tools by how they perform on the third integration, not the first.

Discussion