Roadmap says Work IQ Upload lets agents put files into Microsoft 365 destinations. Security liked agents that only read. Can we approve upload tools without opening every create/delete/share action, and what should we tell makers before October?

Work IQ Upload and SharePoint/OneDrive MCP file tools: 5 MB limits, user permissions, admin MCP registry and tool-level controls — Steady Security before agents write files.

Work IQ will let agents upload files into SharePoint and OneDrive — how do we stop that becoming silent sprawl?

You’re right to treat “read the library” and “put a file in the library” as different risks. Practitioner threads already celebrate agents that accept a chat upload and drop it into SharePoint; Security hears that and correctly asks who chose the destination folder and who can reverse a bad write.

Here’s what’s going on. Roadmap 570850 (Work IQ: Upload) is In development, with Preview and general availability both targeted for October 2026. The MRC blurb is short — agents will be able to upload files and content to supported Microsoft 365 destinations — so treat Message Centre and Learn as the living detail. Learn’s Work IQ SharePoint and OneDrive MCP references already document the write surface makers will lean on: createSmallTextFile, createSmallBinaryFile, uploadFileFromUrl, plus rename, move, copy, delete and share. File create/read/upload tools are capped at 5 MB. Operations run as the signed-in user and honour that user’s Microsoft 365 permissions, sensitivity labels and compliance policies — Work IQ does not invent a god-mode service identity for the file write.

The admin catch is the same pattern as other agent tools: upload is not a separate tenant magic switch. Your controls sit on Agents → Tools in the Microsoft 365 admin center. AI Admins and Global Admins review Requests, approve or reject MCP servers, grant Entra consent, then Block a server or — where tool-level control is available — disable high-risk tools while leaving reads on. Blocking an MCP server disables every tool it exposes; for write-heavy SharePoint and OneDrive servers, that is often the Steady default until Legal names an owner and a destination policy.

This is Schofield’s First Law with a document library attached: never put data into a programme unless you can see exactly how to get it out — and for agent uploads, how to stop putting more in tomorrow morning. Steady before scale puts Security and GRC in front of “just enable Work IQ for makers.”

Options that actually work:

Inventory MCP servers, disable write tools first. On Agents → Tools → Registry, open SharePoint and OneDrive Work IQ servers, list create/upload/delete/share tools, and leave only approved reads enabled for a pilot Entra group. Best Steady default while 570850 rolls.
Approve destinations, not vibes. Name the libraries agents may write to (project scratch, not Legal or HR), require sensitivity labels where labels apply, and put reclaim/ownership rules on those libraries before any broad enablement.
Treat 5 MB as a design constraint, not a loophole. Large decks and zips will fail or force workarounds; document that for makers so they don’t invent shadow Power Automate paths that bypass your MCP story.
Turn everything on and hope people pick the right folder. Fast — and how “save this draft” becomes “overwrite the board pack” with a cheerful toast.

12 Panes action / comms: Tell Security: Upload rides with the MCP server; our control is registry approval, tool-level disable, and which libraries exist for pilots. Tell makers: Writes run as you — you only upload where you already have permission; keep Needs approval on write tools until the destination is named. Tell SharePoint admins: Watch agent-created folders for ownerless sprawl the same way you watch anyone-link sites. Leadership: This is productivity with a change-control story, not a free filing clerk.

Benefits / risks: Agents finish work without swivel-chairing files between chat and SharePoint; permissions and labels still apply; 5 MB and preview tool names will change; tool-level control is rolling out and not every MCP server supports discovery yet — when it doesn’t, you block the whole server; Purview audit of agent and SharePoint activity is the compliance backstop — verify it for your SKUs before you call the risk closed.

I’d suggest a half-day tabletop this month: pick one pilot library, walk Security through the SharePoint MCP Tools list and a live createSmallTextFile call, write the destination rule into the agent register, and only then expand staged rollout. Once people have seen what “upload” actually writes, the Steady habit tends to stick.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer