Microsoft Copilot vs Salesforce Agentforce (2026)

Tools are what an agent invokes beyond answering from knowledge. They call APIs, run automated flows, reach external services and fetch real time data, and the orchestrator picks one from the conversation context and the tool's description. Connections and connectors carry the credentials. An agent can be extended with Model Context Protocol so every tool and resource a connected MCP server publishes becomes available automatically, with changes on that server reflected without rework.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/tools-overviewread 2026-09-17

Agents act on the customer's systems through actions. Agentforce Builder connects agents to data, channels and existing Salesforce assets including Flows, Apex, MuleSoft APIs and prompt templates, and out of the box actions cover common jobs such as order and reservation management.

Sourcesalesforce.com/agentforce/agent-builderread 2026-09-18

Generative orchestration lets a custom agent answer with the relevant topics, tools, other agents and knowledge sources, fill inputs from earlier conversation history, chain several capabilities together in one response, and act on event triggers, with a triggered agent choosing which tool, topic or agent to invoke. Deterministic work sits beside it as agent flows, and other agents are attached as connected agents and managed from the agent's own Agents page.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/faqs-generative-orchestrationread 2026-09-17

Agent Script defines how work moves through an agent: every request begins at an agent router that sets initial variables and classifies the request, then the agent processes a subagent and transitions between subagents along paths the script defines. Across agents, an orchestrator agent can invoke specialized agents in other Salesforce orgs and outside Salesforce through the Agent API, and a flow action can invoke an agent as one step of a longer automation.

Sourcedeveloper.salesforce.com/docs/ai/agentforce/guide/ascript-flow.mdread 2026-09-18

Event triggers let an agent act on its own rather than waiting for a person. A chosen event generates a payload, a connector delivers it, and the agent executes against its instructions and the payload's variables. Topic triggers, by contrast, need a user's phrase. In Microsoft's example an agent starts when a new entry lands in a Dataverse table, and agents also reach users through conversational channels and the Microsoft 365 apps.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/authoring-triggers-aboutread 2026-09-17

Headless agents are called without a human trigger from a user interface. An Apex trigger or a scheduled job calls the agent as part of a background process, and a standard AI Agent action lets any flow, including one started by a record change, invoke an active agent with a prompt.

Sourcedeveloper.salesforce.com/blogs/2025/04/build-headless-agents-with-the-agent-api.htmlread 2026-09-18

Knowledge sources are content the maker attaches at design time so every user gets the same grounding. The Add knowledge dialog offers featured sources (public websites, SharePoint, OneDrive for Business, Salesforce, ServiceNow, Azure SQL), advanced sources (Azure DevOps wiki and work items, custom connector, enterprise websites) and direct upload of PDF, Word, Excel and PowerPoint files.

Dataverse tables, Azure AI Search, Bing Custom Search, real time connectors and file groups can also be used, and sources can be managed and edited. New knowledge goes into an index without retraining the model, and a file an end user uploads is handled as an attachment to the conversation rather than as a knowledge source.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/knowledge-sources-overviewread 2026-09-17

Agents are grounded in the customer's own material. An Agentforce Data Library connects an agent to trusted unstructured or semi-structured sources, such as files or a knowledge base, which the customer adds to the library and the agent retrieves from when it answers, and new material is added to the library with no retraining.

Sourcedeveloper.salesforce.com/docs/ai/agentforce/guide/headless-examples-agent-adl.mdread 2026-09-18

Memory gives an agent a separate store per user, held in a dedicated folder in Microsoft managed storage, with a lifecycle of capture, store and apply. Preferences and context from a conversation are written as files and read back on later interactions. The maker turns it on or off per agent, and a user's memories are private to that user and invisible to the maker. Each user can review and remove what the agent remembers, memories are deleted automatically after 28 days without interaction, and turning the feature off stops use without deleting.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/memory-overviewread 2026-09-17

Agent Script variables let an agent deterministically remember information across conversation turns and keep context throughout the session, shared by every subagent, and a session ID carries that context across invocations. Data 360 and Customer 360 give agents live customer records, which are the business records themselves, and Salesforce does not describe a memory the agent keeps across sessions.

Sourcedeveloper.salesforce.com/docs/ai/agentforce/guide/ascript-ref-variables.mdread 2026-09-18

Human supervision is a configurable setting. When the agent needs confirmation or more information mid execution, it escalates to the named reviewer, sending a review request by Outlook email or showing an inline review card in the activity panel, and a published table shows which underlying models support the feature. Microsoft also covers administration of computer use and its troubleshooting and limitations, and warns explicitly that these agents can meet prompt injection attempts and should run in trusted isolated environments with validation before instructions are executed.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/human-supervision-computer-useread 2026-09-17

Escalation to a person is a built-in agent utility: utils.escalate hands the conversation to a human service rep through an Omni-Channel routing connection the customer defines, and instructions tell the agent when to call it. Agent Script structures what the agent may do, with every request passing an agent router that classifies it before any subagent runs and explicit transitions between subagents, and Salesforce's own guidance recommends a person check model responses before they are shared in most use cases.

Sourcedeveloper.salesforce.com/docs/ai/agentforce/guide/ascript-ref-utils.mdread 2026-09-18

Copilot Studio is covered by Microsoft's standards certifications and regulatory compliance programs, and its customer facing controls include geographic data residency, data loss prevention, environment routing, regional customization, an agent runtime protection status view for makers and an automatic security scan. Where an organization onboards Microsoft Agent 365, Copilot Studio agents are represented as identities in Microsoft Entra and governed with Conditional Access, role based and attribute based access control and access governance workflows, in addition to the existing Power Platform and Microsoft 365 mechanisms.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/security-and-governanceread 2026-09-17

Salesforce holds attestations scoped to the agent layer itself, including a SOC 2 report and a SOC 3 report for the Einstein Platform and Agentforce on Hyperforce, an ISO 42001 certificate covering the Salesforce AI Platform and Agentforce, a PCI attestation of compliance for Data Cloud, the Einstein Platform and Agentforce, a C5 report, an IRAP assessment and Spain ENS High for the Einstein Platform and Agentforce, alongside FedRAMP High and Moderate and ISO 27001 categories.

Sourcecompliance.salesforce.com/enread 2026-09-18

After publishing, the Monitor tab reports conversation sessions, user engagement with message counts and session duration, credit consumption over a chosen period, thumbs up and thumbs down reactions with comments on specific responses, and response quality indicators over time, filterable by time range. Errors can be reviewed in their own view. Computer use runs have their own monitoring, and where Agent 365 is onboarded it carries centralized observability and policy enforcement across agents rather than only where each was built.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/analytics-overviewread 2026-09-17

Every step of an agent interaction is recorded. The Agentforce Session Tracing data model and the Generative AI Audit and Feedback data model capture turns, messages, LLM calls, actions, metric scores and feedback, and the Session Trace OTel API exports a full session as OpenTelemetry-format JSON for any observability tool or OTLP collector. Trace files can also be managed from the command line during development, and the Einstein Trust Layer keeps an audit trail of generations.

Sourcedeveloper.salesforce.com/docs/ai/agentforce/guide/otel-api.mdread 2026-09-18

In Copilot Studio, geographic data residency covers where data is stored, processed and managed, tied to the environment's geography. Microsoft also covers data locations, the security side of residency, and deliberately moving data across regions when generative features are needed outside the geography or capacity is constrained. Model availability is published per region in tables on the model selection page, with a warning that data in an experimental model may be processed outside the organization's geographical boundary. Virtual network support is also offered.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/geo-data-residencyread 2026-09-17

Salesforce runs on Hyperforce, its public-cloud infrastructure, where customer data is generally stored in the country where the customer's org is located, provided the services in use are available in that Hyperforce country, and a secure backup of an org can be held in a secondary Hyperforce region.

Sourcesalesforce.com/platform/public-cloud-infrastructureread 2026-09-18

The Agents page in Copilot Studio offers a set of agent templates, each a complete agent a maker creates from and then customizes. IT Helpdesk, Safe Travels, Weather, Website Q&A and Sustainability Insights are custom agents, and Benefits is a Microsoft 365 Copilot agent, each with its own documentation page. The catalog sits inside the product and can be browsed, each template works as soon as it is chosen, and the set is small.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/template-fundamentalsread 2026-09-17

Agentforce Builder starts agents from out of the box subagents, actions and templates that cover common jobs such as order management, reservation management and general FAQs, which the customer then extends and refines with natural language instructions.

Sourcesalesforce.com/agentforce/agent-builderread 2026-09-18

The maker chooses the primary model for an agent's generative orchestration from a dropdown, with separate settings for deep reasoning, for generative responses and for the prompt builder. An external model can be chosen as the primary model, and Microsoft publishes tables of model availability by region and by scope. Models carry tags for their status, experimental ones are marked as not recommended for production with a limitations page, and makers can continue on a model after it is retired.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/authoring-select-agent-modelread 2026-09-17

An administrator sets the org-level model for Agentforce on the Agentforce Agents page in Setup, and Agent Script overrides it for a specific agent or subagent with a model configuration naming any supported model. The supported list spans Salesforce-managed models from OpenAI, Anthropic on Amazon Bedrock, Google Gemini on Vertex AI and Amazon Nova, most running inside the Salesforce trust boundary, and customers can also bring their own model.

Sourcedeveloper.salesforce.com/docs/ai/agentforce/guide/ascript-model.mdread 2026-09-18

The Microsoft 365 Agents SDK builds agents in code in C# and .NET, JavaScript on Node.js, and Python, and such an agent is attached to a Copilot Studio agent by its messaging endpoint so the platform can call it. The platform is itself callable. The Power Platform REST API triggers agent evaluations programmatically for release validation, regression testing and CI/CD pipelines, and separate admin APIs delete, quarantine and reassign ownership of agents. Model Context Protocol brings external tools and resources in.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/add-agent-microsoft-365-agents-sdk-agentread 2026-09-17

The Agent API opens a conversation with an agent, sends prompts synchronously or as a server-sent event stream with progress, text-chunk and end-of-turn events, and closes the session, authenticated through a connected app with OAuth scopes, with a published Postman collection and Node.js client. Inside the platform, an invocable action runs any active agent from Apex or Flow, and Salesforce Hosted MCP Servers expose Salesforce data and automation to external AI agents and LLM applications over MCP.

Sourcedeveloper.salesforce.com/blogs/2025/04/build-headless-agents-with-the-agent-api.htmlread 2026-09-18

Evaluations are named test sets. A conversation is a test case with user messages and optionally expected responses, created by hand, generated with AI, or uploaded from CSV, grouped into an evaluation with a test method, and run to produce scored results that track quality across changes and validate behavior before publishing. Evaluations run under a chosen authenticated user profile so the agent's tools and connections are exercised. The Power Platform REST API runs them programmatically against predefined test sets for release validation, regression testing and CI/CD.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/analytics-agent-evaluation-introread 2026-09-17

Agents are tested before release with scored test cases. A test spec describes test cases as utterances with the expected agent behavior, can set context variables and include out-of-the-box metrics in the output, and is created and run in a development org from the command line or the Agentforce Testing Center, with pass and fail results.

Sourcedeveloper.salesforce.com/docs/ai/agentforce/guide/agent-dx-test.mdread 2026-09-18

Computer use is a tool an agent adds from its Tools page. It interacts with a Windows computer through a virtual mouse and keyboard, working across websites and desktop applications by selecting buttons, choosing menus and typing into fields, described in natural language rather than code, for work where no API exists.

It is powered by a computer using agent model combining vision with reasoning, which Microsoft says adapts when buttons or screens change rather than breaking. Microsoft also covers where runs execute, human supervision, monitoring, administration and limitations for computer use.

Sourcelearn.microsoft.com/en-us/microsoft-copilot-studio/computer-useread 2026-09-17

Salesforce does not describe an Agentforce agent operating a browser or desktop interface. Agents act through actions, flows, Apex, APIs, prompt templates and MCP tools, reached through the agent router and subagents in Agent Script.

Sourcedeveloper.salesforce.com/docs/llms-genai.txtread 2026-09-18