Microsoft data and AI briefing, 26 October 2026: five developments that matter to anyone running a data and AI estate on the Microsoft platform. This roundup covers updates from 19 to 25 October alongside an earlier Copilot billing announcement that deserves attention now. Here is what they mean in practice.
The thread running through all five is the same: capability is not authority. AI agents can now discover dependencies, migrate databases, build Power BI reports and rewrite Synapse pipelines. The question for IT leaders is no longer whether the agent can do the work. It is who gave it permission, what it costs to run, and who signs off before anything reaches production.
1. Your AI agent should not inherit your permissions
Microsoft’s latest agent security announcement makes a practical point: an AI agent acting on your behalf should not automatically carry every permission you hold.
Through Project Perception and its wider security platform, Microsoft is introducing Dynamic Permissions for agents. The model is simple:
- Give the agent its own identity, separate from the user who invoked it
- Grant only the permissions needed for the task in hand
- Make that access time-limited
- Require human approval for consequential actions
- Reduce or revoke access when the risk profile changes
An agent that needs to read an expense claim should not be able to change banking details. An agent running with broad delegated access can have far more authority than that task requires. The controls need to enforce the boundary outside the model, rather than relying on an instruction in its prompt.
What to do now: Treat agents as a new class of insider. Inventory every agent in your tenant, identify which identity each one runs under, and map that to the actions it can take. If you cannot answer “what is the blast radius if this agent is compromised or goes wrong”, you do not yet have agent governance.
Microsoft announcement: Agents are your newest insiders
Project Perception remains in limited public preview. The announced controls should not be treated as universally available.
2. Can AI make SQL Server migrations easier?
At SQL Modernization Day, Microsoft introduced agent-assisted migration skills alongside expanded Azure Arc migration capabilities for multiple SQL instances.
The potential is real. A migration agent can help you:
- Discover database dependencies
- Assess compatibility
- Compare Azure targets
- Prepare migration plans
- Validate the results
The architecture decision still needs an accountable human owner. Azure SQL Database, Azure SQL Managed Instance, SQL Server on Azure VMs and SQL database in Microsoft Fabric have different cost profiles, operational models and feature support. Assessment tools can flag compatibility issues, including features that need redesign. Those findings still need review against the application’s cross-database queries, SQL Agent jobs, CLR dependencies and operating requirements before a target is selected.
What to do now: Use the agents to reduce repetitive assessment work. Keep target selection and workload analysis with people who understand the application. AI can reduce the cost of assessment. It does not remove the need to understand what you are moving.
Microsoft: SQL Modernization Day
The SQL modernisation agent and the expanded multi-instance Azure Arc migration capabilities described in the announcement are in public preview. Check availability for the specific target and migration route.
3. AI can build your Power BI report. Who reviews it?
Microsoft’s Skills for Fabric project continues to mature AI-assisted Power BI development. Version 0.3.19, published on 21 October 2026, strengthens report authoring, publishing and semantic-model validation.
The direction of travel is clear:
Requirement → AI-assisted build → Validation → Review → Deployment
That is a useful pipeline. But producing a report quickly is not the same as producing a trustworthy one. Before an AI-generated report goes anywhere near a leadership meeting, I would still expect:
- Correct DAX and agreed business definitions
- Validated semantic-model bindings
- Source control for the report and the model
- A visual review by someone who knows the data
- Deployment approval
A dashboard that looks convincing but reports the wrong numbers is worse than no dashboard at all, because people act on it.
What to do now: If your Power BI team is adopting AI-assisted authoring, put the engineering discipline in first. Semantic-model standards, naming conventions, DAX review and a deployment pipeline are what make AI acceleration safe. Without them you are simply producing wrong reports faster.
Microsoft Skills for Fabric releases
4. Your Copilot licence is not your entire AI budget
There is a Microsoft 365 Copilot licensing change worth preparing for now rather than in December.
From 1 December 2026, eligible new Microsoft 365 Copilot Business subscriptions purchased through CSP will have usage-based billing enabled by default. Microsoft documents an adjustable default spending limit of 4,000 Copilot Credits per user per month.
That figure is a spending limit, not an included credit allowance or a forecast. Eligible consumption-based experiences can generate usage charges alongside the per-seat licence; this does not mean every Copilot prompt becomes chargeable. Microsoft names Copilot Cowork, Work IQ APIs and GitHub Copilot Harness among the eligible experiences.
The questions I would want answered for every agent in the estate:
- How often does it run?
- What does each run consume?
- How much human review does the output need?
- What happens to cost when usage doubles?
- What measurable business value does it produce?
Agent cost goes beyond licensing. It is workload economics, and it belongs in the same FinOps conversation as your Azure consumption.
What to do now: Build a per-agent cost and value register before the billing model changes under you. Set spending limits deliberately rather than accepting defaults.
Microsoft Partner Center: October 2026 announcements
The change applies to eligible new CSP purchases, with market exclusions and rollout conditions. It does not automatically change all existing Copilot subscriptions.
5. The interesting part of AI deployment is the approval gate
One detail in the Skills for Fabric v0.3.19 release notes is worth more attention than it will get.
The Synapse migration skill can now help identify and update dependent Azure Data Factory and Synapse procedure callers after generating Fabric notebooks. That is a significant amount of migration work automated. Yet the release explicitly preserves explicit approval and no-automatic-execution safeguards.
That is the right design. For AI-assisted engineering, the pipeline should look like this:
Discover → Assess → Plan → Approve → Build → Test → Deploy
Not:
Prompt → Production
AI can reduce repetitive migration and development effort. Somebody still needs to approve consequential changes and verify that the business process works afterwards. The goal is faster, controlled delivery, with approval at the point where the consequences require it.
What to do now: When you evaluate any AI engineering tool, look for where the approval gate sits and whether it can be bypassed. For consequential changes, require the tool to propose the change and wait for approval before execution.
Skills for Fabric v0.3.19 release notes
What this means for IT leaders
Five developments, one pattern. Microsoft is expanding agent capabilities alongside identity, permission, cost and approval controls. My view is that organisations will get more dependable value from agentic AI when they adopt both halves together.
| Area | Who owns it | First action |
|---|---|---|
| Agent identity and permissions | CIO, security lead | Inventory agents and the identities they run under |
| SQL Server modernisation | Head of IT, DBAs | Run an agent-assisted assessment, keep target selection human |
| AI-assisted Power BI | Head of Data, BI lead | Put semantic-model standards and review in place first |
| Copilot cost governance | CIO, finance | Build a per-agent cost and value register before 1 December |
| Fabric migration and deployment | Data engineering, architecture | Confirm approval gates in every AI engineering tool |
If you are unsure where your organisation sits on any of these, start with the AI Readiness Assessment. It takes a few minutes and gives you a clear picture of where governance, skills and data foundations need work before agents go further.
For five practical prompt frameworks and worked examples your team can use, download The AI Adoption Playbook. The guide is free, with your name and email required to download it.
And if you want help with agent governance or a SQL Server modernisation assessment, get in touch. Both are services GRE Solutions delivers today.
Gethyn Ellis is a Microsoft Data Platform MVP, Microsoft Certified Trainer and founder of GRE Solutions, a UK consultancy specialising in the Microsoft data platform, AI enablement and training. He is the author of AI That Actually Works and host of the Putting the Human into Technology podcast.
PakarPBN
A Private Blog Network (PBN) is a collection of websites that are controlled by a single individual or organization and used primarily to build backlinks to a “money site” in order to influence its ranking in search engines such as Google. The core idea behind a PBN is based on the importance of backlinks in Google’s ranking algorithm. Since Google views backlinks as signals of authority and trust, some website owners attempt to artificially create these signals through a controlled network of sites.
In a typical PBN setup, the owner acquires expired or aged domains that already have existing authority, backlinks, and history. These domains are rebuilt with new content and hosted separately, often using different IP addresses, hosting providers, themes, and ownership details to make them appear unrelated. Within the content published on these sites, links are strategically placed that point to the main website the owner wants to rank higher. By doing this, the owner attempts to pass link equity (also known as “link juice”) from the PBN sites to the target website.
The purpose of a PBN is to give the impression that the target website is naturally earning links from multiple independent sources. If done effectively, this can temporarily improve keyword rankings, increase organic visibility, and drive more traffic from search results.