The model picker shipped.
The approval unit did not

A multi-model harness is no longer a roadmap claim; it is a row of options in the enterprise console. Copilot Cowork’s model picker spans OpenAI, Anthropic and Microsoft-hosted models, and the docs state plainly that models carrying a data-retention requirement (Claude Fable 5) are off by default, need an admin to enable them in the Microsoft 365 admin center, and show a persistent banner while selected. The same docs contain the line buyers should read twice: turning the Anthropic family off is a tenant-wide setting and cannot be used to grant those models to a subset of users. Our judgment: models are now replaceable per task, while who may use which model — and at what data-retention cost — is still approved at the level of the whole organisation. The missing piece is not the model list. It is the approval unit.

1. A multi-model picker inside the enterprise console

Microsoft Learn’s “Choose a model for Copilot Cowork” page (self-labelled last updated 2026-09-14) lists the picker options: Auto (default), GPT 5.5 (Frontier, hosted in Azure AI Foundry), GPT 5.6 Sol, GPT 5.6 Terra, GPT 6 Astra, Opus 5, Claude Sonnet 5 and Claude Fable 5.1, with OpenAI and Anthropic models provided as subprocessors. The available list reflects the models the organisation enables. Source: learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-models.

The same page tells admins they can turn off the Anthropic model family under Copilot settings in the Microsoft 365 admin center, that this model control has no effect on whether a user can access Cowork, and that the setting is tenant-wide, so it can’t be used to grant Anthropic models to a subset of users. Cowork also shows a model badge in the conversation so users can see which model produced a response, and reasoning effort levels (Light, Medium as default, High, Extra High, Max) sit next to the picker — higher effort is slower and consumes more credits.

Our judgment: the model list is not the news. What matters is the shape — models turned into a row of replaceable options inside one execution framework, with each one’s cost (speed, depth, consumption, retention) labelled separately. This is the moment a multi-model harness moves from concept to configuration screen, and the unit of selection moves from the model to the model-plus-framework combination.

2. Data retention now attaches to individual models

The Cowork FAQ page (also self-labelled last updated 2026-09-14) is blunter: Claude Fable 5 (Preview) is off by default, so it appears only after an admin turns it on under Copilot settings in the Microsoft 365 admin center; and some models, such as Claude Fable 5, require data retention, with Cowork showing a note in the picker and a banner while the model is selected. Source: learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-faq.

Three further constraints sit on the same page: access to Anthropic models through Microsoft services is limited to regions Anthropic supports; Cowork bills on usage, counting model responses, tool and skill calls, image generation and browser tasks; and sensitive actions such as sending mail or posting trigger an approval prompt, with session-level options to skip repeat prompts by specific recipient, domain or action.

Our judgment: data retention has moved from a supplier-level contract question to a model-level configuration item. That is good news and a new burden. Good news, because it is verifiable, screenshot-able and can be written into acceptance criteria. A burden, because the question of which model touches which data moves out of legal’s drawer and onto the architecture review agenda.

3. Our judgment: the approval unit is in the wrong place

Put those facts side by side and an asymmetry appears. Actions are granular down to a recipient: an approval prompt before sending, with session-level skips scoped to a specific recipient, a domain or a single action. Models and retention are not granular at all: the docs state that turning off the Anthropic family cannot be used to grant those models to a subset of users.

In other words, an enterprise can decide that mail to one domain no longer needs confirmation, but cannot decide that only twenty named engineers, on a defined class of tasks, may use a retention-bearing frontier model. The first is fine-grained authorization; the second is an organisation-wide switch.

Our judgment: this is not a missing feature, it is a design misalignment in the control plane — actions are treated as first-class, models and data retention as configuration. Once models become replaceable, what buyers actually need to purchase is the judgment layer: who is allowed to use which model, within what scope, at what cost. Today that layer has exactly one setting: the whole tenant.

4. The analyst view: harness and model can be two things

On 21 September 2026, Ben Thompson reversed his own November 2025 position in Stratechery’s “Frontier Overhangs”. He had argued that the integration point of model and harness was where agent differentiation lived, which would make frontier labs more profitable than they appeared. He now writes that harness and model can be two things, citing Nadella’s account of a multi-model harness and the shipped Cowork picker, and lands the argument on Christensen: after performance surplus, architectures slide from proprietary interlock toward modularity. Source: stratechery.com/2026/frontier-overhangs.

Citation discipline: this is an analyst revising a position, not a finding of fact, and the evidence base is one vendor’s one product plus one analyst. What can be taken is the direction — after decoupling, the layer that persists is the control plane of policy, authorization, audit and cost — not the conclusion that the industry has finished decoupling.

5. A procurement and acceptance checklist

6. Conclusion and this month’s smallest move

Our judgment: a multi-model harness has already turned which model into a daily operating choice. What remains unsolved is who approves which model and who owns the retention cost. If the control plane cannot push the authorization unit from the organisation down to identity and task, enterprises are left choosing between two bad options: enable the strongest retention-bearing model for everyone, or switch it off for everyone.

Smallest move this month: list the multi-model products you run and fill four columns for each — the model list, the retention terms per model, the authorization unit of the switch (tenant or role), and whether usage records can be exported. Then answer one question: if legal asked tomorrow that the strongest model be available to twenty people only, could your current configuration execute it?

References: Microsoft Learn, “Choose a model for Copilot Cowork”, self-labelled last updated 2026-09-14, curl HTTP 200; model list, tenant-wide model control, reasoning effort levels and usage framing are that document’s account. learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-models | Microsoft Learn, “Copilot Cowork FAQ”, self-labelled last updated 2026-09-14, curl HTTP 200; Fable 5 default-off and retention banner, usage-based billing, approval granularity and Anthropic regional limits are that document’s account. learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-faq | Stratechery, “Frontier Overhangs”, 21 September 2026, curl HTTP 200; analyst opinion and a revised position, not a finding of fact. stratechery.com/2026/frontier-overhangs.