Microsoft Puts Day-Long Agent Work Inside a Windows 365 Cloud PC

On September 7, 2026, Microsoft CEO Satya Nadella announced Project Opal, a new capability for Microsoft 365 Copilot that takes a different approach to enterprise agents. Instead of promising smarter chat, Opal is built for work that unfolds over hours or days: compliance audits, IT ticket triage, onboarding workflows. The agent plans the task, executes it step by step, and delivers finished output — while a supervisor system watches every action it takes.

The architecture is the story. Every Opal job runs on a dedicated, secure Windows 365 Cloud PC — a managed, isolated environment separate from the user's local machine. The agent operates through computer use: it navigates browser-based applications and sites, fills forms, and compiles results on the user's behalf, according to Microsoft's official documentation. For enterprises weighing agent deployments, the design choices Microsoft made here — identity-bound access, browser-only scope, full audit logs — are as notable as the capability itself.

How Opal Works

The workflow is task-first. A user opens Opal from the Microsoft Copilot app, describes a job in natural language, and selects Start. Opal's reasoning engine converts the request into a dynamic plan, sequences the necessary tools, and adapts the approach mid-flow as the task progresses. A Windows 365 Cloud PC initializes, the user signs in once so Opal can act on their behalf, and the job begins.

Opal runs asynchronously in the background. Users can maximize a computer view to watch the agent's actions in real time, review a replay of everything that happened after the fact, or step in at any point. If Opal needs credentials, sensitive information, or clarification on ambiguous instructions, it pauses and asks. A "Take Control" option switches the user into a remote desktop session on the Cloud PC — pausing the agent — and "Return Control" hands the job back, optionally with a note describing what the human did so the agent can resume from the right place.

There is a hard concurrency limit worth knowing: up to three jobs can run at the same time. Starting a fourth closes out the oldest running job, per Microsoft's documentation.

Microsoft's demo, publicized alongside the announcement, showed the scope of what a single job can cover: Opal analyzed a month of outdoor camera footage, identified every frame containing animals, cut highlight clips, tagged each record with camera source, date, and species, catalogued everything in a spreadsheet, generated a PowerPoint summarizing the results, and shared the outputs via Teams.

The Guardrails That Matter for Enterprises

The security model has several layers, and each one answers a specific concern that has stalled enterprise agent rollouts.

**Identity-bound access.** Opal uses the requesting user's identity and only accesses data and systems that user is authorized for. There is no broad service account with sweeping permissions — the agent inherits the employee's own access rights, nothing more.

**Browser-only scope.** Opal is restricted to a browser-only experience on the Cloud PC. All other computer access is blocked, and browser policies are enforced through Microsoft Intune. Administrators can additionally configure blocklists or allow lists restricting which websites the agent may touch.

**Step-level supervision.** A separate supervisor monitors Opal's reasoning engine at every step. If suspicious activity is detected, Opal pauses and requests user confirmation before proceeding — a design meant to catch unauthorized actions before they complete, not after.

**No silent sensitive actions.** Opal never performs sensitive actions — entering passwords or submitting forms — without explicit user confirmation, per Microsoft's documentation.

**Full audit logging.** Every action Opal takes is logged for transparency and traceability, so compliance teams can review what was done and why. Combined with the replay function, this gives auditors a complete record of agent behavior.

**Admin-level governance.** Opal is opt-in and managed through the Microsoft 365 Admin Center. Administrators configure Cloud PC pools, define what the system can access through allow lists and scenario starters, and decide which users or teams get the feature. Tenant-level enablement happens through the Frontier program settings.

The Numbers and the Use Cases

Microsoft's early-use-case list is pointedly operational: quarterly compliance audits, security group membership requests, timesheet and vacation request processing, and employee onboarding. The company's own documentation names four concrete scenarios — collecting and validating audit evidence for compliance reviews, triaging IT incidents by updating ticket status and closing duplicates based on meeting transcripts, managing security group membership requests, and compiling Excel data into a financial close deck.

The headline number: Microsoft has said its engineers saved up to 20 hours per week in audit scenarios during early testing, with the agent accessing approved websites, collecting and organizing screenshots, and verifying documents. That figure comes from Microsoft's own account of internal use, not an independent audit — treat it as a vendor's benchmark, not a guarantee. But the direction is consistent with what audit teams report about evidence-collection work generally: the labor is in the gathering, not the judgment.

There is also a Skills feature, which lets users write reusable instructions for repeatable jobs — importable as Markdown files, written from scratch, or built conversationally with Opal — and re-run them across future sessions.

Availability and What It Is Not

Opal is currently available only to users in Microsoft's Frontier early access program with a Microsoft Copilot subscription, and administrators must complete setup before anyone in the tenant can use it. Microsoft describes Frontier features as experimental and subject to change — the company's own positioning is that Opal "is expected to evolve substantially" as feedback accumulates. This is not a generally available product with an SLA; it is a preview of where Microsoft intends to take Copilot.

It is also not a general-purpose autonomous worker. The browser-only restriction, the three-job limit, and the supervision requirements all signal deliberate scope control. Opal is designed for structured, repetitive, rules-based processes — the kind where the steps are known, the outputs are checkable, and the cost of an error is containable.

What Practitioners Should Take From This

For enterprises building agent programs, Opal's design choices are worth studying even if you never deploy it:

- **Put the agent in a container, not on the desktop.** Running agent work in an isolated Cloud PC gives you a blast radius you can control and observe. Expect this to become the default pattern for long-running agent work. - **Bind agent access to user identity.** Opal's approach — the agent inherits exactly the requesting user's permissions — sidesteps the over-privileged service account problem that has plagued enterprise automation for years. - **Demand audit logs and replay from day one.** If your agent platform cannot show you a step-by-step record of what the agent did, you cannot deploy it in any regulated process. Opal treats logging as a core feature, not an add-on. - **Start with evidence-gathering tasks.** The audit use case is telling: collection and verification of documents across approved sites is high-labor, low-judgment work with a checkable output — the ideal profile for a supervised agent. - **Verify vendor productivity claims against your own workflows.** The 20-hours-per-week figure is Microsoft reporting on Microsoft engineers. Run a bounded pilot with your own audit or triage workload before committing to a number in any plan.

The gap between "agent that answers questions" and "agent that owns a multi-day process" is bridged not by model capability alone but by the surrounding control system — supervised execution, contained environments, and complete logs. Project Opal is Microsoft's most explicit bet yet on that architecture, and the compliance-audit-first use-case list suggests the company sees regulated enterprises, not consumer productivity, as the proving ground.

As of September 9, 2026, Opal remains an early-access experiment. The architecture it demonstrates — isolated execution, identity-bound permissions, step-level supervision, full auditability — is the part built to last.