Platform provider
Microsoft
Microsoft, a Nasdaq-listed company based in Redmond, Washington, sells Dynamics 365 Finance with Copilot features and a reconciliation agent in preview.
- Ownership
- PublicSourceMicrosoft Corporation, Annual Report on Form 10-K for the fiscal year ended June 30, 2026
Common stock (MSFT) listed on Nasdaq, per the Form 10-K for fiscal 2026.
- Headquarters
- United StatesSourceMicrosoft Corporation, Annual Report on Form 10-K for the fiscal year ended June 30, 2026
- SEC reporting
- YesSourceMicrosoft Corporation, Annual Report on Form 10-K for the fiscal year ended June 30, 2026
- Audit firm
- No
- Website
- SourceDynamics 365 Finance (product page)
- Subprocessor list
- Not stated
- Contract terms
- Not stated
Offering · Software
Microsoft Copilot Studio
Copilot Studio is Microsoft's low-code studio for building and managing AI agents and workflows that connect to company data and systems and publish to channels such as Microsoft Teams, Microsoft Copilot, websites and mobile apps. SourceCopilot Studio overview (Microsoft Learn)
Agents follow their instructions and use tools to take action, some can be given their own account to work proactively, and workflows include human-in-the-loop controls. SourceCopilot Studio overview (Microsoft Learn)
Admins govern authentication, knowledge sources, connectors and publishing through Power Platform data policies, can cap pay-as-you-go spend, and see maker activity in Microsoft Purview audit logs. SourceSecurity and governance in Copilot Studio (Microsoft Learn)
Usage is billed in Copilot Credits, by feature, and unused Copilot Credits do not carry over to the next month. SourcesLicensing for agents powered by the standard harness (Copilot Studio licensing, Microsoft Learn)Billing rates and management (Copilot Credits, Microsoft Learn)
Where it fits
CoE analysis Fits IT and automation teams in Microsoft-centered organizations that want to build their own agents under tenant-level policies rather than buy a separate agent platform. SourcesCopilot Studio overview (Microsoft Learn)Security and governance in Copilot Studio (Microsoft Learn)
CoE analysis Because an agent can hold its own account and act on a schedule, its identity, connector permissions and credit consumption need the same review as a service account. SourcesCopilot Studio overview (Microsoft Learn)Billing rates and management (Copilot Credits, Microsoft Learn)
What it does
- Offering type
- SoftwareSourceCopilot Studio overview (Microsoft Learn)
- Workflow areas
- SourceCopilot Studio overview (Microsoft Learn)
- Agent platform
- Process automation
- Customer size
- Not stated
AI
- Kind of AI
- SourceCopilot Studio overview (Microsoft Learn)
- Agents and automated actions
- General-purpose assistant
- Suggests or acts
- Suggests and actsSourceCopilot Studio overview (Microsoft Learn)
- Availability
- Generally availableSourceCopilot Studio overview (Microsoft Learn)
Agents, workflows and agent flows are documented without a preview label; the app creation experience and building with natural language are labeled preview.
- Models named
- Not stated
Control
- Who controls it
- Customer ITSourcesSecurity and governance in Copilot Studio (Microsoft Learn)Copilot Studio overview (Microsoft Learn)
Commercial
- Pricing model
- Usage-basedSourcesLicensing for agents powered by the standard harness (Copilot Studio licensing, Microsoft Learn)Billing rates and management (Copilot Credits, Microsoft Learn)Copilot Studio overview (Microsoft Learn)
- Public price
- Not stated
Evidence
- Independent outcomes
- None found in the sources read.
- Sources read
- Vendor-stated 12
- Independent market evidence None read
- Independently verified outcomes None read
- Pricing None read
- Known limitations 2
- Coverage
- Directory record
- Last verified
Security and control
- Single sign-on
- Not stated
Not stated on the Copilot Studio pages read; the Microsoft Copilot values do not carry over.
- User provisioning
- Not stated
Not described on the Copilot and Copilot Studio pages read.
- Role-based access
- SupportedSourceCopilot Studio overview (Microsoft Learn)
Administration covers agent inventory with role-based access and cost management.
- Administrator controls for AI
- Per featureSourceSecurity and governance in Copilot Studio (Microsoft Learn)
Power Platform data policies govern authentication, knowledge sources, connectors, HTTP requests, channels and triggers; admins can turn off publishing of agents that use generative AI and set pay-as-you-go credit caps. Security audit telemetry and Agent 365 governance events are outside Customer Lockbox coverage.
- Audit logs
- SourcesSecurity and governance in Copilot Studio (Microsoft Learn)Audit logs for Copilot and AI applications (Microsoft Purview, Microsoft Learn)
Covers AI actions: Yes
Maker audit logs in Microsoft Purview and agent activity alerts through Microsoft Sentinel; Copilot Studio apps are included in Audit Standard.
- Certifications
- Not stated
- Data retention
- Not stated
- Data residency
- Not stated
Admins can disable data movement across geographic locations for generative AI features outside the United States; the Product Terms and Data Protection Addendum govern the service; customer-managed keys are available.
- Training on customer data
- Not stated
Not stated on the Copilot Studio pages read; Microsoft's Copilot statement is scoped to Microsoft Copilot.
AI features
As the vendor or firm describes them. Notes in small print record what the sources leave open.
Agents
AI assistants that follow instructions, draw on connected knowledge and use tools to take action; some can be given their own account to work proactively on tasks.
- Kind
- Agents and automated actions, General-purpose assistant
- Suggests or acts
- Suggests and acts
- Who controls it
- Customer IT
- Availability
- Generally available
Control: Built by makers; admins govern capabilities through data policies and can turn off publishing of agents that use generative AI.
SourcesCopilot Studio overview (Microsoft Learn)Security and governance in Copilot Studio (Microsoft Learn)Workflows and agent flows
Automations built in a designer whose steps can reason and act, with built-in testing, human-in-the-loop controls and human review steps.
- Kind
- Agents and automated actions
- Suggests or acts
- Suggests and acts
- Who controls it
- Customer IT
- Availability
- Generally available
Control: Makers configure the flow and its review steps.
SourceCopilot Studio overview (Microsoft Learn)Build with natural language; app creation
Describe a business goal and Copilot Studio proposes the combination of agents and workflows; app creation inside Copilot Studio.
- Kind
- General-purpose assistant
- Suggests or acts
- Suggests
- Who controls it
- Customer IT
- Availability
- Preview
Control: Used by makers.
SourceCopilot Studio overview (Microsoft Learn)
Questions to ask
For this offering
- Which harness will each of our agents run on, and how does that choice change the Copilot Credits it consumes?
- Which of our agents will run under their own account rather than the user's, and who approves the permissions of that account?
- If pay-as-you-go credit caps are reached mid-month, which agents stop and how are users told?
- Which agent telemetry falls outside Customer Lockbox coverage, and does that matter for our regulatory commitments?
- Can we block agents from moving generative AI processing outside our geography, and which features stop working if we do?
From the diligence question set
- DQ-05 Which AI features are switched on by default, which does an administrator have to enable, and can each be switched off on its own?
- DQ-06 Does each feature suggest or act? Can it create, post, approve or change records, and where is that limit enforced?
- DQ-07 Who can change each feature's configuration, prompts, thresholds, data connections or model: your company, our administrators or individual users? Can we restrict and log those changes?
- DQ-13 What does the system record for each AI output or action, and can we export and keep those records for as long as we need them?
- DQ-19 How are the AI features priced: included in the subscription, sold as an add-on or higher tier, or metered by use? What is the billing unit?
- DQ-20 What happens when use exceeds the included amount: overage charges, throttling, or a feature that stops partway through a critical process?
Offering · Platform module
Microsoft Dynamics 365 Finance (Copilot and finance agents)
Dynamics 365 Finance belongs to Microsoft Dynamics, which Microsoft's 10-K describes as providing financial management and ERP solutions to small and medium businesses, large organizations and divisions of global enterprises. SourcesMicrosoft Corporation, Annual Report on Form 10-K for the fiscal year ended June 30, 2026Dynamics 365 Finance pricing
Its Account Reconciliation Agent, documented as a production ready preview, evaluates reconciliation exceptions and recommends an action for each, which a user can accept or replace; the product page describes it as matching and clearing transactions autonomously. SourcesAccount Reconciliation Agent (production ready preview)Dynamics 365 Finance (product page)
Microsoft also describes Copilot features for invoice capture and collections, a Finance Agent in Microsoft 365 Copilot in preview, and custom agents built with Copilot Studio. SourceDynamics 365 Finance (product page)
Microsoft's published pricing, October 2026, lists Dynamics 365 Finance at $210.00 and the Premium plan at $300.00 per user per month, paid yearly, and says agents run on Copilot Credits and require an Azure subscription. SourceDynamics 365 Finance pricing
Where it fits
CoE analysis Fits organizations on Dynamics 365 Finance that want reconciliation exception handling inside the ERP. SourceAccount Reconciliation Agent (production ready preview)
CoE analysis The reconciliation agent is in preview, Microsoft states a goal of making it a fully autonomous orchestrator, and the model in use may differ from the one shown in the interface, so release tracking belongs in the control set. SourcesEnhancements to Account reconciliation agent (Dynamics 365 release plan, 2026 release wave 1)Account Reconciliation Agent (production ready preview)
What it does
- Offering type
- Platform moduleSourceMicrosoft Corporation, Annual Report on Form 10-K for the fiscal year ended June 30, 2026
- Workflow areas
- SourcesMicrosoft Corporation, Annual Report on Form 10-K for the fiscal year ended June 30, 2026Dynamics 365 Finance (product page)
- ERP core
- Close
- Reconciliation
- Accounts payable
- Receivables and collections
- Customer size
- SourceMicrosoft Corporation, Annual Report on Form 10-K for the fiscal year ended June 30, 2026
- Small business
- Mid-market
- Enterprise
AI
- Kind of AI
- SourcesAccount Reconciliation Agent (production ready preview)Dynamics 365 Finance (product page)
- Built into the platform
- General-purpose assistant
- Agents and automated actions
- Established machine learning and rules
- Suggests or acts
- Suggests and actsSourceAccount Reconciliation Agent (production ready preview)
- Availability
- PreviewSourcesAccount Reconciliation Agent (production ready preview)Dynamics 365 Finance (product page)
The Account Reconciliation Agent is documented as a production ready preview with prerelease documentation; the Finance Agent in Microsoft 365 Copilot is described as in preview.
- Models named
- Not stated
Control
- Who controls it
- Individual userSourceAccount Reconciliation Agent (production ready preview)
Commercial
- Pricing model
- Published list priceSourceDynamics 365 Finance pricing
- Public price
- USD 210 user/month, paid yearlySourceDynamics 365 Finance pricing
Term: annual
Evidence
- Independent outcomes
- None found in the sources read.
- Sources read
- Vendor-stated 8
- Independent market evidence 1
- Independently verified outcomes None read
- Pricing 3
- Known limitations None read
- Coverage
- Directory record
- Last verified
Security and control
- Single sign-on
- Not stated
Copilot experiences are protected by Enterprise Data Protection when users sign in with Microsoft Entra accounts; that is not a statement of single sign-on or federation, and neither is described on the pages read.
- User provisioning
- Not stated
Not described on the Copilot and Copilot Studio pages read.
- Role-based access
- SupportedSourcesWhat is Microsoft Copilot? (Microsoft Learn)Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
An AI Administrator role gives least-privilege access to manage Copilot and AI features without Global Administrator permissions; Copilot surfaces only data a user has at least view permission for.
- Administrator controls for AI
- Per featureSourcesWhat is Microsoft Copilot? (Microsoft Learn)Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
Copilot controls manage image generation, agent creation and use, web search grounding and access to Copilot Chat; admins choose which agents are allowed and whether to use Anthropic and OpenAI models.
- Audit logs
- SourceAudit logs for Copilot and AI applications (Microsoft Purview, Microsoft Learn)
Covers AI actions: Yes
Exportable: Yes
When the organization has auditing enabled, Copilot interactions are logged in Audit (Standard) with the user, time, location and resources accessed, plus model provider and model name (not yet for Cowork); records can be exported and kept under audit retention policies. Audit logs for non-Microsoft AI apps are pay-as-you-go and kept 180 days.
- Certifications
- ISO 27001
Stated for Microsoft Copilot on its privacy page; the certificate scope and period are not given there.
- ISO 42001
Stated for Microsoft Copilot (AI management systems); scope and period not given on the page.
- Other
GDPR and HIPAA listed among Microsoft Copilot's compliance offerings.
- ISO 27001
- Data retention
- SourcesData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)Audit logs for Copilot and AI applications (Microsoft Purview, Microsoft Learn)
Prompts and outputs: Prompts and responses are stored as Copilot activity history under the same contractual commitments as other Microsoft 365 content; admins can set Microsoft Purview retention policies.
Logs: Audit records kept under audit log retention policies.
Users can delete their own Copilot activity history from the My Account portal.
- Data residency
- SourceData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
Regions: EU Data Boundary
LLM calls go to the closest data centers but can be routed to other regions at high utilization; EU traffic stays within the EU Data Boundary. Copilot is a covered workload in the data residency commitments in the Microsoft Product Terms from March 1, 2024.
Models provided by Anthropic as a subprocessor are excluded from the EU Data Boundary.
- Training on customer data
- Not usedSourceData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
Scope: Vendor models
Where stated: Documentation
Prompts, responses and data accessed through Microsoft Graph are not used to train foundation LLMs, including those used by Copilot; optional feedback may be used to improve the service but not to train those LLMs.
AI features
As the vendor or firm describes them. Notes in small print record what the sources leave open.
Account Reconciliation Agent
Evaluates reconciliation exceptions and recommends an action for each (for example, create journal entry), which a user can accept or replace; every exception is logged and reconciliations can be undone.
- Kind
- Agents and automated actions
- Suggests or acts
- Suggests and acts
- Who controls it
- Not stated
- Availability
- Preview
Control: Enabled in Feature management, with start date, modules and exception limits set before activation; the role or function that does this is not named. The user accepts or replaces each recommendation.
SourcesAccount Reconciliation Agent (production ready preview)Enhancements to Account reconciliation agent (Dynamics 365 release plan, 2026 release wave 1)Dynamics 365 Finance (product page)Copilot in Dynamics 365 Finance (Invoice Capture, collections)
Invoice Capture accelerates invoice processing; rules- and prediction-based collections automation using Copilot.
- Kind
- Built into the platform, Established machine learning and rules
- Suggests or acts
- Not stated
- Who controls it
- Not stated
- Availability
- Not stated
Control: Not stated.
SourceDynamics 365 Finance (product page)Finance Agent in Microsoft 365 Copilot
Delivers insights and enables action in the flow of work.
- Kind
- General-purpose assistant
- Suggests or acts
- Not stated
- Who controls it
- Not stated
- Availability
- Preview
Control: Not stated.
SourceDynamics 365 Finance (product page)Custom agents (Copilot Studio)
Customers build agents for finance workflows and data in Copilot Studio.
- Kind
- Agents and automated actions
- Suggests or acts
- Not stated
- Who controls it
- Not stated
- Availability
- Not stated
Control: Built by the customer; the role or function is not stated.
SourcesDynamics 365 Finance (product page)Dynamics 365 Finance pricing
Unclear or conflicting statements
Where the sources are unclear or disagree, both statements are shown with their links.
Whether the Account Reconciliation Agent recommends or acts
Statement A
Product page: the agents carousel describes the Account Reconciliation Agent as "Match and clear transactions between ledgers autonomously to help finance teams close their books with less manual work. Now in preview."
Statement B
Documentation (production ready preview; prerelease): the agent evaluates exceptions and provides a recommended action for each, which the user can accept or replace.
learn.microsoft.com/en-us/dynamics365/finance/general-ledger/acct-rec-agent
Recorded under D-143; not resolved.
Questions to ask
For this offering
- Is the Account Reconciliation Agent still in preview in our region, and what preview terms apply if we use it in production?
- How many Copilot Credits does the reconciliation agent consume per exception, and what happens when prepaid credits run out?
- When Microsoft updates the model behind the agent, how are we notified, and can we test before the change reaches production?
- What do the daily or monthly exception limits do when reached during the close?
- Which user identity is recorded when an agent recommendation is accepted and a journal entry created?
From the diligence question set
- DQ-04 Which AI features are in the modules and edition we license, or would license, and is each generally available, in preview or beta, a paid add-on, or limited by edition or region?
- DQ-05 Which AI features are switched on by default, which does an administrator have to enable, and can each be switched off on its own?
- DQ-08 What will change in these features through your releases, how much notice will we get, and can we test or defer a change before it reaches our production environment?
- DQ-19 How are the AI features priced: included in the subscription, sold as an add-on or higher tier, or metered by use? What is the billing unit?
- DQ-20 What happens when use exceeds the included amount: overage charges, throttling, or a feature that stops partway through a critical process?
- DQ-27 For reconciliation and matching: what rules and tolerances govern automatic matches, can a match be undone, and how are unmatched and partly matched items shown?
Offering · AI agent
LinkedIn Recruiter with Hiring Assistant
LinkedIn, part of Microsoft's Productivity and Business Processes segment, sells Hiring Assistant as an add-on to LinkedIn Recruiter. SourcesMicrosoft Corporation, Annual Report on Form 10-K for the fiscal year ended June 30, 2026Hiring Assistant (LinkedIn Talent Solutions product page)
LinkedIn describes it as an agent that turns a recruiter's intake into searches, sources candidates across LinkedIn, drafts outreach and evaluates applicants from LinkedIn and the customer's applicant tracking system against the hiring criteria. SourcesHiring Assistant (LinkedIn Talent Solutions product page)LinkedIn Hiring Assistant: Data Security & Compliance (white paper)
Its white paper says it categorizes applicants against user-defined thresholds of requirements met but does not move them into the pipeline or screen them out, leaving those decisions to recruiters. SourceLinkedIn Hiring Assistant: Data Security & Compliance (white paper)
Where it fits
CoE analysis Fits recruiting teams already on LinkedIn Recruiter that want an agent to run sourcing and first-pass applicant review. SourceHiring Assistant (LinkedIn Talent Solutions product page)
CoE analysis LinkedIn describes internal per-model bias reviews but publishes no audit results, and its two documents describe the models differently, so buyers should ask for both before relying on the applicant categories. SourcesLinkedIn Hiring Assistant: Data Security & Compliance (white paper)Appendix: Hiring Assistant AI Data Flow Diagram
What it does
- Offering type
- AI agentSourceLinkedIn Hiring Assistant: Data Security & Compliance (white paper)
- Workflow areas
- SourcesHiring Assistant (LinkedIn Talent Solutions product page)LinkedIn Hiring Assistant: Data Security & Compliance (white paper)
- Recruiting and sourcing
- Screening and ranking
- Customer size
- Not stated
AI
- Kind of AI
- SourcesLinkedIn Hiring Assistant: Data Security & Compliance (white paper)Appendix: Hiring Assistant AI Data Flow Diagram
- Agents and automated actions
- Built into the platform
- Suggests or acts
- Suggests and actsSourceLinkedIn Hiring Assistant: Data Security & Compliance (white paper)
- Availability
- Generally availableSourceHiring Assistant (LinkedIn Talent Solutions product page)
Sold as an add-on to LinkedIn Recruiter. LinkedIn's page says Hiring Assistant 2 will begin rolling out to customers in early November; the page does not give a year.
- Models named
- SourcesLinkedIn Hiring Assistant: Data Security & Compliance (white paper)Appendix: Hiring Assistant AI Data Flow Diagram
- OpenAI
- LinkedIn in-house models
Control
- Who controls it
- Customer HR teamSourcesHiring Assistant (LinkedIn Talent Solutions product page)LinkedIn Hiring Assistant: Data Security & Compliance (white paper)
Recruiters choose which projects Hiring Assistant works on, can adjust the role details, edit the suggested qualifications and hiring plan, and categorize candidates against user-defined thresholds (the white paper's wording). Administrator controls are not described in the sources read.
Commercial
- Pricing model
- Quote onlySourceHiring Assistant (LinkedIn Talent Solutions product page)
- Public price
- Not stated
Evidence
- Independent outcomes
- None found in the sources read.
- Sources read
- Vendor-stated 12
- Independent market evidence None read
- Independently verified outcomes None read
- Pricing 1
- Known limitations None read
- Coverage
- Directory record
- Last verified
Decisions about people
- Decision use
- SourcesHiring Assistant (LinkedIn Talent Solutions product page)LinkedIn Hiring Assistant: Data Security & Compliance (white paper)
- Ranks or scores
- Recommends
Categorizes applicants by thresholds of requirements met and surfaces top candidates; LinkedIn states it will not screen out applicants or make hiring decisions.
- Bias audit published
- Not stated
LinkedIn describes per-model fairness and bias reviews; no audit report or summary is linked from the sources read.
- Traits the tool infers
- Not stated
Evaluation draws on the LinkedIn profile, resume, screening-question responses and recruiting notes; trait inference is not described. Hiring Assistant 2's new fit measures and voice prescreening are not described in detail.
- Configurable thresholds
- YesSourceLinkedIn Hiring Assistant: Data Security & Compliance (white paper)
Applicants are categorized against user-defined thresholds of requirements met; recruiters can edit the suggested qualifications.
- Candidate notice support
- Not stated
Not stated in the sources read.
- Accommodation route
- Not stated
Not stated in the sources read.
- Human review
- Recruiters review each categorized applicant with a summary of fit and decide whom to contact and advance.SourceLinkedIn Hiring Assistant: Data Security & Compliance (white paper)
Security and control
- Single sign-on
- Not stated
Copilot experiences are protected by Enterprise Data Protection when users sign in with Microsoft Entra accounts; that is not a statement of single sign-on or federation, and neither is described on the pages read.
- User provisioning
- Not stated
Not described on the Copilot and Copilot Studio pages read.
- Role-based access
- SupportedSourcesWhat is Microsoft Copilot? (Microsoft Learn)Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
An AI Administrator role gives least-privilege access to manage Copilot and AI features without Global Administrator permissions; Copilot surfaces only data a user has at least view permission for.
- Administrator controls for AI
- Per featureSourcesWhat is Microsoft Copilot? (Microsoft Learn)Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
Copilot controls manage image generation, agent creation and use, web search grounding and access to Copilot Chat; admins choose which agents are allowed and whether to use Anthropic and OpenAI models.
- Audit logs
- SourceAudit logs for Copilot and AI applications (Microsoft Purview, Microsoft Learn)
Covers AI actions: Yes
Exportable: Yes
When the organization has auditing enabled, Copilot interactions are logged in Audit (Standard) with the user, time, location and resources accessed, plus model provider and model name (not yet for Cowork); records can be exported and kept under audit retention policies. Audit logs for non-Microsoft AI apps are pay-as-you-go and kept 180 days.
- Certifications
- ISO 27001
Stated for Microsoft Copilot on its privacy page; the certificate scope and period are not given there.
- ISO 42001
Stated for Microsoft Copilot (AI management systems); scope and period not given on the page.
- Other
GDPR and HIPAA listed among Microsoft Copilot's compliance offerings.
- ISO 27001
- Data retention
- SourcesData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)Audit logs for Copilot and AI applications (Microsoft Purview, Microsoft Learn)
Prompts and outputs: Prompts and responses are stored as Copilot activity history under the same contractual commitments as other Microsoft 365 content; admins can set Microsoft Purview retention policies.
Logs: Audit records kept under audit log retention policies.
Users can delete their own Copilot activity history from the My Account portal.
- Data residency
- SourceData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
Regions: EU Data Boundary
LLM calls go to the closest data centers but can be routed to other regions at high utilization; EU traffic stays within the EU Data Boundary. Copilot is a covered workload in the data residency commitments in the Microsoft Product Terms from March 1, 2024.
Models provided by Anthropic as a subprocessor are excluded from the EU Data Boundary.
- Training on customer data
- Not usedSourceData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
Scope: Vendor models
Where stated: Documentation
Prompts, responses and data accessed through Microsoft Graph are not used to train foundation LLMs, including those used by Copilot; optional feedback may be used to improve the service but not to train those LLMs.
AI features
As the vendor or firm describes them. Notes in small print record what the sources leave open.
Intake and sourcing
Builds a sourcing strategy from the recruiter's intake and past Recruiter activity, suggests required and desired qualifications and runs searches across LinkedIn, learning from recruiter feedback.
- Kind
- Agents and automated actions
- Suggests or acts
- Acts
- Who controls it
- Customer HR team
- Availability
- Generally available
Control: Recruiters can edit role details, qualifications and the hiring plan.
SourcesHiring Assistant (LinkedIn Talent Solutions product page)LinkedIn Hiring Assistant: Data Security & Compliance (white paper)Applicant evaluation
Evaluates applicants from LinkedIn and the customer's ATS against the hiring criteria, categorizes them by user-defined thresholds of requirements met and summarizes why each may be a fit; it does not move applicants into the pipeline or screen them out.
- Kind
- Agents and automated actions
- Suggests or acts
- Suggests
- Who controls it
- Customer HR team
- Availability
- Generally available
Control: Recruiters set the thresholds and decide whom to advance.
SourcesHiring Assistant (LinkedIn Talent Solutions product page)LinkedIn Hiring Assistant: Data Security & Compliance (white paper)Outreach and pre-screening
Drafts personalized outreach messages and pre-screens interested candidates.
- Kind
- Agents and automated actions
- Suggests or acts
- Suggests
- Who controls it
- Customer HR team
- Availability
- Generally available
Control: Recruiters edit and send draft messages.
SourcesHiring Assistant (LinkedIn Talent Solutions product page)LinkedIn Hiring Assistant: Data Security & Compliance (white paper)Hiring Assistant 2
Adds new LinkedIn fit measures that go beyond stated qualifications, enhanced outreach, voice prescreening and interview scheduling.
- Kind
- Agents and automated actions
- Suggests or acts
- Not stated
- Who controls it
- Not stated
- Availability
- Announced
Control: Not stated.
SourceHiring Assistant (LinkedIn Talent Solutions product page)
Unclear or conflicting statements
Where the sources are unclear or disagree, both statements are shown with their links.
How the models behind Hiring Assistant are described
Statement A
White paper: the generative AI models for intake and search were developed by OpenAI and are used through Microsoft's Azure AI services; messaging uses an in-house model for English and GPT for other languages; candidate summaries use an in-house LLM.
business.linkedin.com/content/dam/lem/business/en/hire/ai-transparency/liha-white-paper.pdf
p. 10; p. 16
Statement B
Data flow diagram: intake, sourcing, evaluation and outreach sub-agents each run inference on Microsoft Azure and a LinkedIn in-house model, footnoted as a fine-tuned open-source model with LinkedIn Economic Graph data.
business.linkedin.com/content/dam/lem/business/en/hire/ai-transparency/liha-data-flow-diagram.pdf
diagram boxes; footnote *
Recorded under D-143, not resolved. Both documents are linked from LinkedIn's AI transparency page; the PDF files carry creation dates of March 18 and March 24, 2026.
Questions to ask
For this offering
- Which model, from which provider, produces the applicant categories and fit summaries today, and how will we be told when that changes, including with Hiring Assistant 2?
- Can we see the results of LinkedIn's fairness reviews for the evaluation model, including the groups tested and the data used?
- Can we export Hiring Assistant's applicant categories and our recruiters' actions by requisition to monitor adverse impact ourselves?
- Who in our organization can set the requirement thresholds, are changes logged, and can administrators restrict Hiring Assistant by team or region?
- What notice or explanation can candidates receive about Hiring Assistant's evaluation, and how is an applicant's request for human review handled?
- What do Hiring Assistant 2's new fit measures and voice prescreening use as inputs, and can each be switched off?
From the diligence question set
- DQ-37 Has an independent auditor tested this tool for adverse impact, on data like ours? Can we see the full results: the groups tested and excluded, the data and its dates, the thresholds used, and the auditor's relationship to you?
- DQ-38 Can we monitor adverse impact on our own applicant flow, by job and by stage, and export the data to do it?
- DQ-39 What evidence shows that the tool measures something related to the job, and was it validated for the way we will use it: as a pass-or-fail screen, or to rank people?
- DQ-40 Which settings change who passes: weights, thresholds, knockout questions, cut scores? Who can change them, are changes logged, and does a change trigger a new audit?
- DQ-41 What notices, explanations and alternative processes does the tool support, and can a person with authority review and change an adverse decision?
- DQ-44 What will you commit to in the contract to support our obligations: audit cooperation, documentation of intended use and limits, notice support, records, and cooperation if a decision is challenged?
Offering · Platform module
Microsoft Copilot
Microsoft Copilot, formerly Microsoft 365 Copilot, coordinates large language models with Microsoft Graph content and the Microsoft 365 apps, and surfaces only data a user already has permission to view. SourceData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
The Premium add-on license grounds answers in emails, files, meetings and calendars, while Copilot Chat (Basic) is included with eligible Microsoft 365 licenses and mainly uses web data. SourceWhat is Microsoft Copilot? (Microsoft Learn)
Copilot Cowork, which carries out tasks across Microsoft 365 on the user's behalf, is billed by usage through Copilot Credits on top of the per-user license. SourcesWhat is Microsoft Copilot? (Microsoft Learn)S-3067; S-3066Microsoft Copilot pricing: Business plans
Microsoft says prompts, responses and Graph data are not used to train foundation models, and that Copilot interactions and admin activities are logged automatically in Purview Audit (Standard) when auditing is enabled, with references to the files accessed. SourcesData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)Audit logs for Copilot and AI applications (Microsoft Purview, Microsoft Learn)
Where it fits
CoE analysis Fits organizations already standardized on Microsoft 365 that want an assistant grounded in their own email, documents and meetings. SourceWhat is Microsoft Copilot? (Microsoft Learn)
CoE analysis Because Copilot answers from whatever a user can open, the quality of SharePoint and Teams permissions becomes a control for this tool, and the move to usage-billed agents such as Cowork turns part of the cost into a metered line. SourcesData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)Microsoft Copilot pricing: Business plans
What it does
- Offering type
- Platform moduleSourcesWhat is Microsoft Copilot? (Microsoft Learn)S-3067; S-3066
- Workflow areas
- SourcesData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)What is Microsoft Copilot? (Microsoft Learn)
- Enterprise assistant
- Enterprise search
- Customer size
- Not stated
AI
- Kind of AI
- SourcesWhat is Microsoft Copilot? (Microsoft Learn)Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
- General-purpose assistant
- Built into the platform
- Agents and automated actions
- Suggests or acts
- Suggests and actsSourceWhat is Microsoft Copilot? (Microsoft Learn)
- Availability
- Generally availableSourceWhat is Microsoft Copilot? (Microsoft Learn)
Microsoft documents Copilot Chat (Basic), Microsoft 365 Copilot (Basic) and (Premium) as licensed experiences; Copilot Cowork is billed by usage and Copilot Code is in Frontier, Microsoft's preview program. Copilot might not be accessible in certain markets.
- Models named
- SourcesData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)What is Microsoft Copilot? (Microsoft Learn)
- OpenAI
- Anthropic
Control
- Who controls it
- SourceWhat is Microsoft Copilot? (Microsoft Learn)
- Customer IT
- Individual user
Commercial
- Pricing model
- Per userSourcesS-3067; S-3066Microsoft Copilot pricing: Business plans
- Public price
- Not stated
Evidence
- Independent outcomes
- None found in the sources read.SourceOWASP Top 10 for Agentic Applications 2026
- Sources read
- Vendor-stated 16
- Independent market evidence 1
- Independently verified outcomes None read
- Pricing None read
- Known limitations 1
- Coverage
- Directory record
- Last verified
Security and control
- Single sign-on
- Not stated
Copilot experiences are protected by Enterprise Data Protection when users sign in with Microsoft Entra accounts; that is not a statement of single sign-on or federation, and neither is described on the pages read.
- User provisioning
- Not stated
Not described on the Copilot and Copilot Studio pages read.
- Role-based access
- SupportedSourcesWhat is Microsoft Copilot? (Microsoft Learn)Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
An AI Administrator role gives least-privilege access to manage Copilot and AI features without Global Administrator permissions; Copilot surfaces only data a user has at least view permission for.
- Administrator controls for AI
- Per featureSourcesWhat is Microsoft Copilot? (Microsoft Learn)Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
Copilot controls manage image generation, agent creation and use, web search grounding and access to Copilot Chat; admins choose which agents are allowed and whether to use Anthropic and OpenAI models.
- Audit logs
- SourceAudit logs for Copilot and AI applications (Microsoft Purview, Microsoft Learn)
Covers AI actions: Yes
Exportable: Yes
When the organization has auditing enabled, Copilot interactions are logged in Audit (Standard) with the user, time, location and resources accessed, plus model provider and model name (not yet for Cowork); records can be exported and kept under audit retention policies. Audit logs for non-Microsoft AI apps are pay-as-you-go and kept 180 days.
- Certifications
- ISO 27001
Stated for Microsoft Copilot on its privacy page; the certificate scope and period are not given there.
- ISO 42001
Stated for Microsoft Copilot (AI management systems); scope and period not given on the page.
- Other
GDPR and HIPAA listed among Microsoft Copilot's compliance offerings.
- ISO 27001
- Data retention
- SourcesData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)Audit logs for Copilot and AI applications (Microsoft Purview, Microsoft Learn)
Prompts and outputs: Prompts and responses are stored as Copilot activity history under the same contractual commitments as other Microsoft 365 content; admins can set Microsoft Purview retention policies.
Logs: Audit records kept under audit log retention policies.
Users can delete their own Copilot activity history from the My Account portal.
- Data residency
- SourceData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
Regions: EU Data Boundary
LLM calls go to the closest data centers but can be routed to other regions at high utilization; EU traffic stays within the EU Data Boundary. Copilot is a covered workload in the data residency commitments in the Microsoft Product Terms from March 1, 2024.
Models provided by Anthropic as a subprocessor are excluded from the EU Data Boundary.
- Training on customer data
- Not usedSourceData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
Scope: Vendor models
Where stated: Documentation
Prompts, responses and data accessed through Microsoft Graph are not used to train foundation LLMs, including those used by Copilot; optional feedback may be used to improve the service but not to train those LLMs.
AI features
As the vendor or firm describes them. Notes in small print record what the sources leave open.
Copilot Chat and Copilot in Microsoft 365 apps
Chat grounded in web data (Basic) or in Microsoft Graph and Work IQ organizational data (Premium); in-app drafting and summarizing in Word, Excel, Outlook, PowerPoint and Teams.
- Kind
- General-purpose assistant, Built into the platform
- Suggests or acts
- Suggests
- Who controls it
- Customer IT, Individual user
- Availability
- Generally available
Control: Admins manage access, image generation, web search grounding and agents in Copilot controls; users choose a model or leave the default Auto router.
SourceWhat is Microsoft Copilot? (Microsoft Learn)Copilot Cowork
Carries out tasks across the Microsoft 365 environment on the user's behalf.
- Kind
- Agents and automated actions
- Suggests or acts
- Acts
- Who controls it
- Customer IT
- Availability
- Generally available
Control: Requires a Microsoft 365 Copilot (Premium) license and usage-based billing; usage monitoring and cost management controls are described for admins.
SourcesWhat is Microsoft Copilot? (Microsoft Learn)Microsoft Copilot pricing: Business plansAgents in Microsoft Copilot
Agents, including third-party agents, that Copilot can call on the user's behalf; admins select which agents are allowed.
- Kind
- Agents and automated actions
- Suggests or acts
- Not stated
- Who controls it
- Customer IT
- Availability
- Not stated
Control: Admins view each agent's permissions and data access in Integrated apps and choose which agents are allowed.
SourcesData, Privacy, and Security for Microsoft Copilot (Microsoft Learn)What is Microsoft Copilot? (Microsoft Learn)
Questions to ask
For this offering
- Which Copilot experiences and agents in our tenant run on Anthropic or OpenAI models, and how do we see that in the audit log for each request?
- Which of our users' Copilot activity would fall outside the EU Data Boundary, given that Anthropic-hosted models are excluded from it?
- How do we keep Copilot Cowork usage billed through Copilot Credits within budget, and what happens when the monthly credits run out?
- Before rollout, how will we find content that is overshared in SharePoint and Teams, since Copilot can surface anything a user is able to open?
- What protections and monitoring apply to prompt-injection attacks of the EchoLeak kind, and how would we learn of a new one affecting our tenant?
From the diligence question set
- DQ-05 Which AI features are switched on by default, which does an administrator have to enable, and can each be switched off on its own?
- DQ-13 What does the system record for each AI output or action, and can we export and keep those records for as long as we need them?
- DQ-16 Is our data, including inputs, outputs, documents and corrections, used to train or improve any model, yours or a third party's? Is that off by default, and is the commitment in the contract?
- DQ-17 How long are prompts, outputs and logs kept, where are they stored and processed, and can we have them deleted?
- DQ-18 Can a feature reach data or take actions beyond the permissions of the user it works for, and how is it protected against instructions hidden in the documents or data it reads?
- DQ-19 How are the AI features priced: included in the subscription, sold as an add-on or higher tier, or metered by use? What is the billing unit?
