VoltageGPU vs Microsoft Copilot Studio

Copilot Studio in 2026 is Microsoft's answer to the agentic AI moment. The April 2026 release shipped expanded agent governance, the Microsoft 365 Agents Toolkit, and Agent 365 inside Purview — a coherent product story that lets a tenant administrator stand up vertical agents on top of M365 data, attach DLP and sensitivity labels, and audit agent activity through the same eDiscovery surface that already governs email and SharePoint. As a product release this is a serious piece of engineering, and as a corporate signal it confirms what most enterprise buyers already assumed: AI agents will become the dominant interface for business automation by the end of the decade.

What Copilot Studio governs is policy. Purview applies DLP rules to agent inputs, sensitivity labels propagate to agent outputs, audit logs capture which user invoked which agent on which document. This is the same governance model Microsoft built for Exchange, SharePoint, and Teams over the last fifteen years — applied to a new surface. It works the way enterprise IT expects governance to work, and for the majority of internal productivity automation it is more than sufficient.

What Copilot Studio does not govern is the hardware. Agents run on Azure tenant compute provisioned the same way any other Azure workload is provisioned. The host operating system, the hypervisor, and the underlying physical hardware are all under Microsoft administrative control. A Microsoft administrator with the right credentials — or a US government request served against Microsoft Corporation under the CLOUD Act — can technically reach into the workload memory where the agent is processing the prompt and the response. Purview policies are contractually binding; they are not cryptographically enforced.

VoltageGPU sits at the opposite end of that trade-off. Every Confidential Agent runs inside an Intel TDX guest VM where the workload memory is encrypted with an ephemeral AES-256 key bound to the VM lifecycle. The CPU-to-GPU PCIe bus is encrypted by NVIDIA Protected PCIe so model weights, prompt tensors, and output tokens never cross the bus in the clear. An Intel DCAP attestation quote signs the configuration with the Intel root certificate and is exposed to the buyer per session. The operator — VOLTAGE EI, a French sole proprietorship registered under SIREN 943 808 824 — is mathematically constrained from reading workload memory, and the cryptographic evidence of that constraint is produced fresh on every confidential call. Policy-layer governance asks the buyer to trust the operator. Silicon-layer governance produces a proof.

The first thing you give up is jurisdictional clean lines. Microsoft Corporation is a US Washington State entity. Even when European customers contract through Microsoft Ireland Operations Ltd. under the EU-US Data Privacy Framework that replaced Privacy Shield in 2023, the ultimate parent is US-incorporated and is bound by the CLOUD Act — US law enforcement can compel data production from a US controller regardless of where the data physically sits. The Data Privacy Framework reduces the regulatory friction of GDPR transfers but it does not extinguish the underlying extraterritorial obligation. For workloads regulated by French bar-association secrecy under RIN Article 2.2, by HDS for health data, by MiFID II for financial advice, or by the EU AI Act's high-risk classification, the operator's jurisdictional status is part of the technical measures analysis that a CNIL or ANSSI auditor will run, and a US-controlled processor will struggle to satisfy that analysis on the strict reading.

The second thing you give up is operator-blind compute. On Copilot Studio the agent context — the document the agent was asked to analyse, the prompt, the chain of tool calls, the final answer — sits in plaintext inside the Azure VM where the agent runs. A Purview administrator with the right scope can read that context through the audit surface. A Microsoft engineer with break-glass access to the host can in principle read it from the hypervisor side. The operator is contractually bound not to do so and Microsoft has invested heavily in compliance certifications that document the controls, but the technical capacity exists. On VoltageGPU the agent context lives inside the TDX-encrypted memory of a guest VM whose decryption key is held only inside the CPU's TDX module. Neither a VoltageGPU administrator nor anyone with physical access to the host can read workload memory — the encryption is enforced by Intel silicon, and the attestation quote is the cryptographic receipt that proves it.

The third thing you give up is pricing transparency on a single line. Copilot Studio licensing is composite: a Microsoft 365 E5 license per user (~$54/month at standard list), a Copilot Studio capacity component charged either through pay-as-you-go message packs at roughly $200 per 25,000 messages or through a tenant-wide reservation, and frequently a separate Azure consumption bill for connectors and Power Platform components that the agent calls. For a procurement team comparing the run-rate cost of an AI agent program against the projected business value, that composite structure makes it hard to answer the simple question "what does one agent cost per month". VoltageGPU is one line — $349 for the Starter plan, $1,199 for the Professional plan, contact sales for Enterprise dedicated TDX nodes — billed monthly, no per-message metering surprises, no per-seat license stack underneath.

The fourth thing you give up is Purview-or-nothing as the governance ceiling. Microsoft's governance story is excellent if the buyer is fully inside the M365 ecosystem and is happy to govern agents the same way email is governed. For buyers whose compliance framework requires technical measures enforced at the hardware layer rather than at the policy layer, Purview is the wrong tool for that part of the requirement, and stacking a separate hardware-enforced confidential agent on top of an M365 deployment is not a Microsoft-supported configuration. VoltageGPU is designed for the hardware-enforced part of that requirement and is interoperable with the rest of the M365 stack through the OpenAI-compatible API and the OpenClaw runtime — the agent can read documents out of SharePoint or Teams through standard graph API calls, then process them inside the TDX boundary, then return results to the M365 surface without the prompt and the response ever sitting unencrypted on Azure compute.

Microsoft wins on ecosystem integration and it wins decisively. Copilot Studio is a native surface inside Teams, SharePoint, Outlook, Excel, OneDrive, and the entire Power Platform. The agent can read a SharePoint document with the same authentication the user already has, post a result to a Teams channel, attach a sensitivity label that propagates automatically into the next document the agent touches, and surface its audit trail inside the same eDiscovery view the legal department already uses for email. For a buyer whose document gravity is fully inside Microsoft 365 — and for most large European enterprises that is the truthful description of where their data lives — that integration depth is real, it is hard to replicate from outside, and it is the right reason to choose Copilot Studio for workloads where Cloud Act exposure and policy-layer governance are acceptable.

Microsoft also wins on enterprise procurement friction. Copilot Studio is part of the existing Microsoft Enterprise Agreement that the buyer's procurement team has already negotiated, the existing MSA covers the contractual posture, and the existing CISO sign-off on Microsoft 365 extends naturally to a new agent surface inside the same tenant. Adding a new vendor — even one with stronger hardware controls — means a fresh vendor risk assessment, a fresh DPA, a fresh penetration-test review, and a fresh procurement cycle. For a fast-moving internal automation program with limited compliance ambition, the friction cost of "yet another vendor" is non-trivial and Copilot Studio wins the moment the buyer decides the workload does not need hardware enforcement.

Microsoft does not win on hardware seal. Copilot Studio agents run on standard Azure tenant compute, the underlying host is administered by Microsoft, and there is no attestation surface that lets the buyer verify cryptographically that the operator cannot read the agent context. Azure has confidential VM SKUs with Intel TDX and AMD SEV-SNP, but Copilot Studio agents do not run inside those SKUs as of May 2026 and Microsoft has not published a roadmap commitment to put them inside that boundary. For workloads where the threat model assumes the cloud operator is part of the attack surface — which is the standard threat model for client files under professional secrecy, for patient records under HDS, and for any data subject to a foreign sovereign's discovery powers — Copilot Studio cannot satisfy that threat model and VoltageGPU's Intel TDX deployment in France can.

Microsoft does not win on EU sovereignty without caveats. The Data Privacy Framework is a legal posture, not a hardware posture. It reduces the documentary friction of GDPR Chapter V transfers but it does not change the fact that the ultimate processor is US-incorporated and subject to US extraterritorial law. For buyers whose compliance team has flagged the CLOUD Act as a residual risk that needs a technical mitigation rather than a contractual one, the answer is a non-US operator running on hardware where the operator cannot technically read the data. VoltageGPU's combination — French SIREN, GDPR Article 28 DPA under French law, Intel TDX silicon enforcement, Intel DCAP attestation per session — is the architecture that produces that mitigation. The honest summary: if your data is already in Microsoft 365 and Cloud Act exposure is acceptable, Copilot Studio is the path of least resistance and the right answer; if your data is governed by GDPR Article 28 with strict technical-measures requirements, HDS, French bar secrecy, or EU AI Act high-risk classification, VoltageGPU is the only architecture that mathematically proves Microsoft and us cannot read it.