--- title: Copilot in SharePoint turned itself on, and skills changed their licensing description: Copilot in SharePoint has been switching itself on since June. Skills are enabled by the Agent Assets site collection feature, and since September only a full Copilot licence can create them. Five switches you have. url: https://www.malachis.eu/en-US/news/copilot-sharepoint-skills published: 2026-09-03 modified: 2026-09-03 --- # Copilot in SharePoint turned itself on, and skills changed their licensing **In short:** Since mid-June 2026, Copilot in SharePoint (formerly AI in SharePoint, and still Knowledge Agent in a number of places) has changed from an opt-in to an **opt-out** preview. It appears automatically for every user with a Microsoft 365 Copilot licence or Copilot Pay as you go enabled in SharePoint unless you actively opted your tenant or specific sites out. Since early July, **custom skills** are generally available — reusable multi-step AI instructions that any user with edit permissions on a site can create — though since September only with a full Copilot licence. Skills have **no tenant-level toggle** — they are switched on one level down, through the **Agent Assets** site collection feature. Governance over them therefore sits in two places: that feature, and your SharePoint permission model. > **Sources:** Microsoft 365 Roadmap ID 501451 (Copilot in SharePoint opt-out preview) · Roadmap ID 559800 (custom skills) · Message center announcements · [Get started with Copilot in SharePoint](https://learn.microsoft.com/en-us/sharepoint/copilot-in-sharepoint-get-started) · [Extend Copilot in SharePoint with skills](https://learn.microsoft.com/en-us/sharepoint/copilot-in-sharepoint-skills) · [pnp/sharepoint-skills](https://github.com/pnp/sharepoint-skills) · [pnp/copilot-prompts](https://github.com/pnp/copilot-prompts) --- ## What changed **Copilot in SharePoint.** Until June you had to switch it on, at tenant or site level. Since mid-June the default is reversed: users with an M365 Copilot licence see a floating Copilot button in the lower-right corner of pages, document libraries and lists, unless you actively opted out. Existing opt-out settings are still honoured, so anyone who made a decision earlier kept it. Anyone who made no decision now has it enabled. Microsoft's own wording is worth reading carefully: *no opt-in step is required.* For Copilot in SharePoint itself, the only decision available to you is whether to take it away again. **Custom skills.** Public preview ran from mid-April; general availability from mid-June through early July 2026. A skill is a named, reusable set of multi-step natural-language instructions — typically something like "review this document against our checklist" or "check this offer letter". Copilot in SharePoint can select a relevant skill from the current site automatically based on the user's query, or the user can invoke it by name. Two sentences from the announcement, both presented as information rather than as a warning: - *The feature is enabled by default and has no separate tenant-level on/off toggle.* - *Any user with edit permissions can create skills.* The first sentence is literally true and still misleading. A toggle does exist — two levels down, on the site collection. The second sentence stopped being true in September. --- ## How a skill actually gets made This is the part worth understanding before you form an opinion on the governance, because the barrier is lower than most people assume. There is no designer, no admin console, no approval step. The whole thing is a sentence typed into a chat panel. **Prerequisite the announcements do not mention:** the **Agent Assets** site collection feature has to be active on that site collection. Copilot in SharePoint works without it; skills do not, because there is nowhere to store them. You will find the feature under Site Settings → Site Collection Features; its description still refers to the old *Knowledge Agent* name. A second prerequisite: since September the author of a skill needs a full Microsoft 365 Copilot licence — Pay as you go is no longer enough. 1. Open the Copilot in SharePoint chat panel from a site page or a document library. 2. **Make sure the page is not in edit mode.** If it is, the option is not offered — and this single detail accounts for most of the "it does not work for me" reports. 3. Ask the agent to create a skill by describing the workflow you want to reuse. The magic words really are *create a skill*. 4. Review the draft the agent produces, then save it. Microsoft's own documented example gives the flavour of the register expected — a plain description of a business check, not a specification: > *Create a skill to review legal contracts to verify whether contract documents mention a lawyer ID in the xxx-xxx format…* From then on, Copilot loads the skill automatically when a request matches it, or the user names it explicitly. **And here is the permission model, which is the fact the announcements bury:** creating a skill requires **Edit** on the site. Running one requires only **View**. Read that again in the context of your own tenant. The population that can *change* how the AI behaves is your editors. The population that then *receives* that behaviour is everyone with read access — which on an intranet is usually the whole organisation. --- ## The entitlement changed in September. That is the important lesson Through July and August, users holding only Copilot Pay as you go could create skills via *create a skill*. The `--agenttools` invocation, which lists the available keywords for Copilot in SharePoint, worked for them too. **Since September, both require a full Microsoft 365 Copilot licence.** We verified this in a tenant. It was not in the Message center, not on the Roadmap, and no announcement accompanied it. The `--agenttools` invocation is not in the documentation at all, so with that one there is nothing to watch even in principle. The practical impact: anyone who built a process over the summer in which PAYG users maintain skills found that process broken in September, and nobody told them. If someone reports that "it suddenly does not work", this is the likely cause. **And here is why it matters, because this is not really about skills.** Preview features are not a foundation to build on. Their behaviour, their naming and even who is entitled to them change, and the change does not necessarily surface in the Message center. Copilot in SharePoint is still preview. Skills are GA, but they live on top of a preview feature — and inherit its instability. **What we recommend to every customer: restraint with preview features.** Trial them, map them, document them — yes, and the sooner the better. Build a business process on them, train users on them at scale, or admit them into a compliance-relevant workflow only after GA. Rushing a preview feature into production is not speed; it is work you will be doing twice. --- ## Skills are files. That is both the good news and the bad news Skill definitions are stored as Markdown files in the site's **Agent Assets** library, at `/Agent Assets/Skills//SKILL.md`. Note the name: it is *Agent Assets*, not *Site Assets*. If you go looking in Site Assets you will conclude you have no skills, and you may be wrong. The library exists only where the Agent Assets site collection feature is active. The good news: it is a document library. Skills therefore fall automatically under everything you already know how to apply to libraries — versioning, retention policies, DLP, sensitivity labels, backup, audit logging. Your AI's behaviour definition is a version-controlled file rather than an opaque portal setting. From a compliance standpoint that is a substantially better outcome than if Microsoft had hidden it in a proprietary store. The bad news is the same sentence from the other side: **anyone with edit permissions on that site can change how the AI behaves.** And because a skill can be selected automatically based on a query, the user talking to Copilot need not notice. Nothing has to be circumvented — an ordinary file edit in a library is enough. Your SharePoint permission model has just stopped being purely a question of content access and become a governance layer over AI behaviour. For most tenants that is an uncomfortable realisation, because permissions after years of operation are looser than anyone claims. What skills **cannot** do: connect to external systems, or execute custom code. This is not a low-code platform; it is a behaviour template built on top of the native capabilities of Copilot in SharePoint. A user cannot do anything through a skill that they could not already do themselves. That narrows the risk profile considerably — the residual risk is not exfiltration, it is **a silent change in how the AI answers people who trust it**. --- ## Where to get skills you did not write The shape of a good skill is being worked out in the open right now, and the Microsoft 365 & Power Platform Community (PnP) is where it is happening. Two repositories are worth watching: - **[pnp/sharepoint-skills](https://github.com/pnp/sharepoint-skills)** — a curated library of AI skills for SharePoint specifically. Each skill is a folder you upload straight into the Skills library, so the structure matches what your tenant expects. MIT licensed, following the agentskills.io specification. - **[pnp/copilot-prompts](https://github.com/pnp/copilot-prompts)** — broader in scope: prompts, agent instructions and, more recently, skills. Skill samples add the `SKILL.md` file, and there is a published schema spec worth reading before you write your own. Reading a dozen well-written `SKILL.md` files will teach you more about what works than the product documentation does. Both repositories take community contributions, and contributions are recognised — if your team writes a skill that generalises, that is a low-effort way to build visible expertise. **One caveat, and it follows directly from the section above.** A community skill is an instruction file that changes how your AI answers people who trust it, and PnP explicitly labels its samples as demonstration material that may not be accurate for your case. Review one before you upload it the way you would review code before it ships — and then remember that once it sits in the Agent Assets library, anyone with Edit on that site can change it. --- ## Five switches you need to know about There is no *tenant-wide* switch for skills. There is a per-site-collection one, and it is the control most people miss: **1. Deactivate the Agent Assets site collection feature.** Site Settings → Site Collection Features → **Agent Assets**. The feature provides the storage for agent plans, skills and site context files. Without it there is no Agent Assets library, so there is nowhere for a skill to live — and Copilot in SharePoint keeps working for everything else. This is the cheapest and most granular control on this list. Unlike Restricted Content Discovery it needs no additional licence, and unlike the tenant PowerShell it does not take Copilot away from your users. It is also scriptable per site collection: get the feature ID with `Get-PnPFeature -Scope Site` on a site where it is active, then use `Disable-PnPFeature` across a list of sites. Two cautions. There is **no tenant-level default** — you decide site collection by site collection, and every new site starts wherever the platform puts it, so this needs to become part of your site provisioning process rather than a one-off sweep. And deactivating the feature on a site collection that **already has skills or a `SHAREPOINT.md` context file** is not something we would do first in production: test the effect on existing content on a throwaway site collection before you run it widely. **2. Opt the tenant or specific sites out of Copilot in SharePoint using PowerShell.** Microsoft documents the scripts on Learn, in [Get started with Copilot in SharePoint](https://learn.microsoft.com/en-us/sharepoint/copilot-in-sharepoint-get-started). Three practical notes that will save you time: - The parameters live on `Set-SPOTenant` and still carry the **preview naming** — you are looking for `KnowledgeAgentScope` and the other `KnowledgeAgent` parameters, not anything called *Copilot*. Searching for a Copilot cmdlet returns nothing and people conclude the control does not exist. - The same parameters give you both an allow-list and a block-list model: opt out tenant-wide, selectively **include** named sites, or selectively **exclude** named sites. Decide which of the two you are running before you start, and write it down — the two models are easy to confuse six months later. What effect this has on skills we have not verified, and Microsoft does not state it anywhere. The reliable route to removing skills is switch 1. **3. Restricted Content Discovery on a site.** With RCD enabled, Copilot in SharePoint and AI actions do not appear on that site **even if the tenant is not opted out**. Most people know RCD as an anti-oversharing control for search; here it works as a selective AI kill switch for sensitive sites. Two conditions the announcements do not put next to each other: RCD **requires a SharePoint Advanced Management subscription**, and it does not suppress absolutely — a user who recently worked with a file, or who searches from within the site itself, will still reach the content. It is a control for the period until you fix permissions, not a replacement for fixing them. **4. Break permission inheritance on the Agent Assets library.** Learn names this explicitly as the supported way to change the default model. It separates "who can edit site content" from "who can change AI behaviour on this site". Use this where you want skills to exist but not to be editable by every content author; use switch 1 where you want no skills at all. **5. Site-level AI settings.** Site owners can choose which agent opens from the agent icon, and can hide the Copilot button from site visitors. --- ## Skills are splitting into two places From late July to early August 2026, custom skills also arrive in **Copilot in PowerPoint on the web**. Users can upload or create them directly in the Copilot experience and manage them through a new Manage skills surface. They are stored in the user's **personal OneDrive**, are personal, and are available only to that user. The feature is on by default for eligible users. The practical consequence: skills now exist in two modes with different governance. Shared and site-scoped, in a library with inherited permissions and policies — and personal, in an individual's OneDrive, where in practice nobody will ever look at them. If you are writing an internal AI usage policy, this distinction has to be in it explicitly. --- ## One thing for your audit documentation At opt-out preview rollout, Copilot in SharePoint runs on OpenAI's GPT-5.4 Reasoning model. Customer-controlled model selection is not available, and Microsoft states that it evaluates and adopts newer models on an ongoing basis. If you maintain documentation of AI systems — and under NIS2, ISO 27001, or emerging AI governance requirements you will — record this with a date. Tomorrow it may be a different model, and you will not be notified. --- ## What to check 1. **Is your tenant opted out or not?** And was that the result of a decision, or of nobody making one? Check `KnowledgeAgentScope`. 2. **Sites with sensitive content** — HR, legal, finance, projects under NDA. Consider Restricted Content Discovery on them, and confirm you are licensed for it. 3. **Which site collections have the Agent Assets feature active.** This is your real map of where skills are possible at all. Sites where it is inactive cannot hold skills, whatever the tenant setting says. 4. **Where skills already exist.** Walk the **Agent Assets** libraries. Who created them, when were they last modified, has anyone reviewed them. 5. **How many people hold Edit permissions** on sites with sensitive content. That is now also the number of people who can change AI behaviour there — for everyone who holds View. 6. **Who holds a full Copilot licence and who holds only Pay as you go.** Since September only full-licence holders can create skills. If someone on PAYG maintained your skills, that stopped working. 7. **Retention and DLP policies** — do they cover the Agent Assets library? 8. **Internal policy and training** — shared skills versus personal skills in OneDrive. 9. **Helpdesk** — do they know what the floating Copilot button is, and what to say to "why is it giving me odd advice"? --- ## What we offer: preparing your environment for Copilot Deploying Copilot is not a licence purchase. It is work on permissions, oversharing, documentation and hardening — and this article is the illustration of why: features enable themselves, their governance sits where nobody looks for it, and "no administrator action is required" means "nobody is going to ask you". What we do: - **Permission and oversharing audit** before enabling Copilot, including where Restricted Content Discovery is warranted and whether you are licensed for it - **Skills inventory** across sites — which site collections have the Agent Assets feature active, what skills exist, who created them, and what nobody is reviewing - **Governance model design** for skills: separating Agent Assets from content editors, naming conventions, review process - **Tenant and site scoping** via the documented PowerShell, including the allow-list versus block-list decision - **Compliance integration** — retention, DLP, sensitivity labels, AI system records for your auditor - **Internal policy and training** for users and site owners, including the shared versus personal skills distinction - **Skill authoring and review** — writing skills for your own processes, and reviewing community samples before they enter your tenant - **Documentation and a helpdesk runbook** All work happens inside your own Microsoft 365 tenant, and no data leaves it. **Want to know what is enabled in your tenant?** Email us at [support@malachis.eu](mailto:support@malachis.eu) or use the contact form. Even if no engagement comes out of it, you will get an answer to "are we opted out". --- *Based on Microsoft Message center announcements, the Microsoft 365 Roadmap and Microsoft Learn, as of 2 September 2026, with our own findings from our tenants added. Microsoft may adjust dates and technical details.*