The roadmap says the Workforce Insights agent in Copilot reaches general availability in November, covering team composition, skills and flexible work patterns. HR is keen; our DPO and works council are not. What can managers and their delegates actually see, and what should we have in place before we switch it on?

Workforce Insights agent: organisational data, access policies, delegation and admin controls — decide what people data Copilot can see before managers start asking.

Will the Workforce Insights agent let managers ask Copilot about their staff?

That’s a sensible split in opinion, and you’re right to settle it before November rather than after. “Ask Copilot about my team” sounds harmless until someone asks about pay, attendance or who’s leaving. In most UK and European organisations, the people who should have a say in that are not just IT.

Here’s what’s going on. Roadmap 515145, Workforce Insights Agent, is In development, with general availability now targeted for November 2026 (it recently slipped from September). It’s pitched at leaders, managers and their delegates, to explore organisational structure, team composition, skills inventories and flexible work patterns in Copilot or Teams. Learn currently lists it as part of the Frontier programme and subject to change, and says it needs a paid Microsoft Copilot licence, for delegates as well as managers.

The reassuring bit: the agent doesn’t go looking for people data on its own. Learn says it uses three sources: Organizational Data you upload to Microsoft 365, custom attributes you choose to send to Workforce Insights, and People Skills. Users can only search information that’s available to them about their own team, based on their role and your policies. So what managers can see depends entirely on what you load and how you label it.

That’s where the access policies matter. Learn’s Set access policies for data in Microsoft 365 defines Public (internal), Selected internal, Manager level (visible to the person, their manager chain and delegates) and Staging. Custom attributes default to Staging, which releases them to nobody until an admin configures it. Some reserved attributes are fixed: hire date and job title are public internally, while hourly rate, current employment status and weekly badge on-site days are manager level. In practice, if you upload badge data, managers and their delegates can ask about it. Learn also notes that Viva Insights and Glint work differently, with extra protections such as minimum group sizes and differential privacy, so don’t assume those protections apply here.

Delegation is the part to watch. A manager can give one or more delegates the same view they have, including confidential attributes; Learn’s own example is a custom attribute called salary. Each access policy has an Allow users to delegate access setting. Admins can stop users assigning delegates with the feature access controls in PowerShell (module name WorkforceInsights), and can assign or revoke delegates on a user’s behalf. Reports can also be shared by link with other Copilot-licensed colleagues.

This is Schofield’s Third Law in HR form: the easier it is for a manager to get at people data, the easier it is for someone else to get at it as well. Steady before scale puts the Governance, Risk & Compliance pane and the Work & Skills pane in front of the Agent Store button.

Options that actually work:

Minimum data, named pilot. Restrict the agent to a small group of HR business partners and willing senior leaders, load only public attributes and People Skills, and leave every custom attribute in Staging. Best Steady default.
Attribute-by-attribute approval. Before any custom or manager-level attribute is released, record who approved it, why, who can see it and whether delegates inherit it. Turn delegation off for anything about pay, performance or attendance.
Block until the paperwork is done. Learn lets you block or remove the agent outright. That’s reasonable while you finish a DPIA and talk to employee representatives. Just don’t leave it as the only plan.
Deploy to all managers with everything uploaded. It’s quick, and it’s also how badge data ends up in a performance conversation nobody agreed to.

12 Panes action / comms: Tell HR and the DPO: We decide which attributes exist in Copilot, at which access level, before anyone can ask. Tell managers: It answers from the data we’ve loaded, at the access level we’ve set; it isn’t a monitoring tool, and it isn’t for decisions about individuals. Tell the Organizational Data Source Administrator: Use the custom AI disclaimer to say what the data is for, add organisation-specific prompts that reflect approved uses, and confirm every column description, because unconfirmed custom columns aren’t used. Employees and representatives: Here’s what’s loaded, who can see it, and how to raise a concern.

Benefits / risks: Leaders get quick answers on structure, spans and skills without waiting on an analyst; the access model is explicit, and custom data starts locked; reserved manager-level attributes and delegation can widen access quietly; the agent is still Frontier and the GA date has already moved, so verify Learn and Message Centre before November.

I’d suggest a one-page attribute register this month (attribute, source, access policy, delegation on or off, owner, lawful basis) and taking it to your DPO and works council before anyone deploys the agent. With that agreed, the November switch-on becomes a configuration task rather than an employee-relations problem.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer