Microsoft Copilot Cowork — Complete Skills Guide

The hub for this series — Microsoft Copilot Cowork — The Complete Guide — covers what Cowork is. This spoke is the skills-and-plugins reference for power users and developers.

TL;DR

• Cowork ships with 13 built-in skills, organised into 5 categories (Communication · Documents · Calendar · Search · Automation)
• A skill is a reusable recipe in your OneDrive — different from a prompt, which is a one-time instruction
• Three ways to add custom skills: OneDrive SKILL.md (no-code), Copilot Studio (low-code), Agents SDK (pro-code)
• Microsoft maintains four official plugin pages on Microsoft Learn for full reference — and the first wave of partner plugins (Harvey, Miro, monday.com, Moody’s, and more) is live at GA
• The fastest way to see what your tenant has: ask Cowork “What skills do you have available?” — it lists every one with a description

Skill vs prompt — the simple mental model

This is the question I get asked first. Plain English:

The key idea: a prompt tells Cowork what to do right now. A skill teaches Cowork how to do it whenever asked. Skills also compose — one skill can hand off to another, building up multi-stage workflows.

Where to find skills in the UI

Cowork keeps all of this behind a single Customize door. Three clicks to get there.

Step 1 — Open the attach menu

From the Cowork landing, click the + button to the left of the task input. A menu opens with four options. Pick the bottom one: Customize · Manage skills & plugins.

Step 2 — Land on the Customize page

The Customize page has two tabs at the top: Plugins and Skills. Click Skills.

Step 3 — See what’s installed

The Skills tab is split into two sections:

• Your skills — custom skills you’ve added (or your IT team has rolled out)
• Built-in — pre-installed skills Cowork uses automatically

You can toggle any skill on or off here. Disabled skills won’t be picked by Cowork even if you ask for them by name.

The Plugins tab lives alongside Skills — same Customize door. Microsoft first-party Dynamics 365 plugins (Fabric IQ, Sales, ERP apps, Customer Service) show here as Installed and can be toggled on/off. Third-party and partner plugins (once admin-approved at the tenant level) appear here too. If your tenant hasn’t approved any plugins yet, or if you haven’t installed any from the Discover gallery below, this tab shows just the Microsoft first-party set.

The 13 built-in skills

Microsoft’s official Cowork documentation lists 13 built-in skills — the canonical set every tenant gets:

You can also add up to 50 custom skills of your own — more on that below.

A faster way to reach a skill: type / in the task box and the inline picker surfaces your skills (and people, files, meetings…) on the fly — no need to open the Customize page. (Microsoft demo tenant.)

What you’ll actually see in your tenant’s Customize panel

The Customize UI surfaces the same engine, but it shows the internal skill IDs — so a few names differ from the official list (you’ll spot html, goal, debug-trajectory, and Skill Management in place of Email, Enterprise Search, Deep Research, and Adaptive Cards). Here’s the exact list as it appears in my tenant:

Mapping back to the 5 Agent Academy categories:

📎 Same engine, two label sets. The official Learn names (top of this section) are the canonical taxonomy; the Customize panel shows the internal IDs. When you write a custom skill that calls a built-in, use the tenant ID (e.g. pdf, html); when you explain Cowork to a colleague, use the official names.

Ask Cowork what it can do — the easy way

If you’d rather not click around the Customize page, ask Cowork directly. The single best discovery prompt:

Cowork responds with a grouped list — both the built-in skills it ships with AND any custom skills you’ve added, all together:

Naming convention — UI labels vs skill IDs

You’ll notice the response uses names like schedule-meeting, meeting-intel, pdf, html — the lowercase, hyphenated internal skill IDs. The Customize UI shows the friendly labels (Scheduling, Meetings, PDF, html).

When you write a custom skill that references built-in skills, use the skill IDs — that’s what Cowork’s planner matches against. When you’re explaining Cowork to a colleague, use the UI labels — they’re easier to read.

How plugins extend Cowork

Built-in skills cover the M365 apps you live in. Plugins extend Cowork to systems outside M365 — your CRM, your ticketing system, your project management tool, your data warehouse.

In plain English — connector vs plugin

Two words get thrown around a lot here. The simplest way to hold them:

• A connector is the bridge. It lets Cowork safely reach into another app — Dynamics 365, Fabric, Power BI — and pull data across (and in some cases, send updates back).
• A plugin is the bridge plus the know-how. It packages one or more connectors with the instructions Cowork needs to actually do a job with them.

And one phrase worth knowing: if a plugin says read & write, Cowork can both look at data in that app and — where it’s configured and you approve it — make changes (like creating or updating a record), not just view it. Read means look-only.

Microsoft maintains four reference pages on Microsoft Learn:

Plugins available at general availability

At GA (June 2026), Microsoft shipped the first wave of partner plugins, with more on the way:

• Available now: Enosix · Harvey · LSEG · Miro · monday.com · Moody’s · Morningstar · S&P Global Energy · TeamsMaestro
• Coming soon: Adobe · Atlassian · Box · Canva · CB Insights · Databricks · MoneyForward · Templafy
• Also generally available: Microsoft Fabric, plus Dynamics 365 Sales, Customer Service, and ERP apps

The catalog grows over time — check Microsoft’s Copilot Cowork docs for the current list. Treat each plugin as its own governance decision (consent, connector credentials, data handling, audit) — see the admin & governance spoke.

To browse the full GA catalog, open Cowork, click Customize, switch to the Plugins tab, then scroll down to the Discover section. Microsoft’s official plugin gallery shows every available plugin with a one-line description and a lock icon indicating tenant admin approval is required before you can install it.

What a plugin actually unlocks

The names matter less than the job each one lets Cowork finish without leaving the task. A few examples:

The pattern: a plugin turns “Cowork can tell you about it” into “Cowork can go do it in that tool.” Each one is still a governance decision first — connect the ones your team actually needs, and treat the rest as off until reviewed.

The GA line-up, grouped by what they’re for

The first wave skews toward finance, research, and visual work. Here’s the quick “is this even relevant to us?” read. Exact capabilities — and whether a given plugin is read-only or read & write — live in Microsoft’s plugin catalog, so treat every row as a governance decision first, not a green light.

Generally available alongside them: Microsoft Fabric (your data estate) and Dynamics 365 Sales, Customer Service, and ERP. The coming-soon set (Adobe, Atlassian, Box, Canva, CB Insights, Databricks, MoneyForward, Templafy — full list just above) spans documents, design, dev tooling, data, and brand templates.

Whatever the source, the rule holds: a plugin is a new door into your data — open the ones a team genuinely needs, and leave the rest off until reviewed. The admin checklist for that review is in the admin & governance spoke.

Custom skills — three paths

You’re not limited to what Microsoft ships. There are three ways to add your own.

Path 1 — Custom skills via OneDrive (no-code, works today)

This is the easiest path — no admin involvement, no app installs.

Method A — Ask Cowork to create it for you (fastest):

Tell Cowork in chat: “Create a custom skill called [name] with these instructions: [your steps]” — Cowork validates the skill, writes the SKILL.md file, and syncs it to your OneDrive automatically within ~35 seconds. Ready to use immediately.

Method B — Upload the file manually to OneDrive:

1. Open your OneDrive — navigate to Documents → Cowork → Skills (create these folders if they don’t exist)
2. Create a subfolder for your skill (e.g., morning-briefing)
3. Inside that subfolder, create a file called SKILL.md
4. Use this minimal pattern:

---
name: Morning Briefing
description: >-
  Summarises my day from calendar, email, and Teams. Use when I say
  "morning briefing", "what's on today", or "what do I need to know
  this morning".
---

# Morning Briefing

## 1. Gather context first (never invent)
- Calendar — today's meetings with times and attendees
- Email — top 3 unread emails needing my response before first meeting
- Teams — any urgent messages I haven't responded to

## 2. Output
A scannable bullet list grouped by Calendar / Email / Teams,
followed by "Top 3 priorities" picked from across all three.

5. Save it — Cowork automatically discovers all skills in this folder at the start of every conversation.

Both methods produce the same result. Method A is great for quick personal skills; Method B is useful when you want to pre-build and distribute skill files across a team.

You can create up to 50 custom skills per user. Each file must be under 1 MB.

The SKILL.md pattern that works in practice

Cowork now standardises a richer SKILL.md structure than the earlier minimal template — and it auto-scores skills against this structure (see “Cowork scores your skill” below). When you use Method A and ask Cowork to create a skill for you, the file Cowork writes follows this 8-section pattern:

The “never invent” line is the most important habit. It tells Cowork to leave a clearly-marked placeholder (e.g. [confirm date]) rather than guessing. That single discipline is the difference between a skill that’s safe to demo and one that occasionally embarrasses you in front of a customer.

Cowork’s 5-step skill creation pipeline

When you ask Cowork to create a skill (Method A above), it runs through a deterministic 5-step pipeline rather than just writing a file blind:

The pipeline:

This is new behaviour — older Cowork builds wrote the SKILL.md and stopped there. The validation + scoring + report pattern means a custom skill arrives audit-ready.

Cowork scores your skill — Skill Quality Report

After writing the SKILL.md, Cowork displays a Skill Quality Report card in the chat. The score is out of 100, computed from four 25-point dimensions, with three hard gates that decide whether the skill is publishable.

The four dimensions

The three hard gates

What you see in the chat after creation

The final chat summary tells you what the skill is, the score, the trigger phrases, and attaches the standalone skill-quality-report.html file for review later.

💡 Use the scoring to tune your prompts. When I asked Cowork to create the friday-portfolio-digest skill above, the first generation scored 96 — the 4 lost points came from two dimensions (Scope Boundaries and Robustness) where my create-prompt could have been more explicit. If a skill scores below the Publish bar, re-issue the create-prompt with more guardrails, more sibling-skill delegation, and more specific tool names. Cowork will re-score the next version. It’s a working feedback loop.

The Skill Quality Report — the friendly HTML version

Alongside the technical Dimension Breakdown card in chat, Cowork also writes a standalone skill-quality-report.html file to the task output folder. Same data, much friendlier presentation — designed for a human reader to skim in 30 seconds.

Friendly names — the same four dimensions, in plain English

The chat card uses technical names (Trigger Clarity, Instruction Specificity, Scope Boundaries, Robustness). The HTML report uses the friendly version. Mapping for reference:

Safety warnings — scope flags you should know about

Below the four-dimension scores, the HTML report surfaces a “Please double-check the safety items” panel listing any sensitive scopes the skill touches. For the friday-portfolio-digest example above, Cowork flagged people-profiling (WARN) because the skill scans other people’s emails and meeting attendee lists to classify customers.

Common scope flags worth knowing:

A WARN doesn’t block publication — it’s a reminder to double-check the skill handles the sensitive scope responsibly. The friday-portfolio-digest skill is read-only and never sends anything, so the people-profiling WARN is acceptable.

Technical details for the curious

The HTML report also has a collapsible “Technical details” section at the bottom showing the machine-readable classifications behind the friendly summary.

These machine-readable values are the ones to reference if you’re building an admin dashboard, a skill governance audit, or a CI check that wants to enforce a minimum publish score across a team’s shared skill library.

Worked Example #2 — building a new-account-research-brief skill

To show what the scoring looks like for a higher-risk skill, here’s a second worked example. The intent: when I’m about to engage a brand-new customer for the first time, I want Cowork to produce a “what we know about Contoso” briefing — fanning out across my email, Teams, SharePoint, calendar, and the public web simultaneously, and identifying which colleagues have already touched the account.

This skill is more ambitious than friday-portfolio-digest:

• It uses Deep Research (touches the public web)
• It does people-profiling at scale (matches every internal colleague who has interacted with the customer)
• It produces a Word briefing for me to read pre-meeting

I expected the Risk tier to escalate. It did.

The create prompt

Cowork’s planning

The score — 95/100, Risk: HIGH

What changed vs friday-portfolio-digest

Two skills, two scores, two risk tiers. The pattern is informative.

What this tells you:

• More explicit sibling delegation → higher Scope Boundaries. Naming 4 sibling skills in “When NOT to Use” got the full 25/25.
• More guardrails matter more than I realised. 6 guardrails got 20/25; 10 got 23/25. Aim for 8-10+ explicit numbered guardrails for full marks.
• Risk tier escalates when you add capabilities, not when you add guardrails. Even with the same care, a skill that touches the public web AND people data AND writes documents will land on High — which is fine, it’s a signal not a blocker. The publish bar still passes.

💡 The publish bar has two visible tiers. The HTML report says Publish bar: 70 (MVB — Minimum Viable Bar). The chat card for higher-risk skills like this one shows the threshold as ≥80 (the Excellent tier). A skill scoring 75 would publish (clears MVB) but wouldn’t earn the Excellent banner — useful when you want to lift quality across a shared team library.

Final chat summary

Worked Example #3 — building a cowork-skill-author meta-skill (and the UI evolves)

The third example is a meta-skill — a skill that creates other skills. Its job is to take a one-line brief from me and produce a high-quality SKILL.md against the 8-section pattern, every time, with the quality scoring automatically run on each new skill it authors.

This worked example also surfaces something interesting: Cowork’s Skill Quality Report UI is evolving rapidly. The card shown here is materially different from the earlier two — Microsoft is iterating on this surface week to week. The signal value is unchanged, but the layout and labels are not yet stable. Treat this as a snapshot, not a contract.

The create prompt

The result — 98/100 with a brand-new 3-column card

What’s new in this card vs the earlier ones

Cowork is context-aware, not just keyword-matching

The single most interesting thing in this card is the per-signal rationale:

Destructive scope — WARN — “mentions destructive actions in context of flagging them; guardrails present”

People-profiling scope — WARN — “mentions profiling to prohibit it; guardrails present”

Cowork’s classifier reads the intent. A skill that prohibits destructive actions isn’t penalised the same way as one that performs them — but it still surfaces the WARN so a reviewer can confirm the intent is correctly framed. That’s a thoughtful design choice and it matters for any team reviewing skills at scale.

The stubborn -2 on Scope Boundaries

All three skills lost 2 points on Scope Boundaries (got 23/25 once and 25/25 once across this set). Pattern observed:

• The full 25/25 was earned by new-account-research-brief with explicit delegation to 4 named sibling skills (customer-session-prep, inbox-drafts, meeting-recap, customer-session-followup)
• The 23/25 was earned by skills with fewer named sibling delegations (2-3) even with strong When NOT to Use sections

If full marks on Scope Boundaries matters for your team’s library, name at least 4 sibling skills in the When NOT to Use section.

Worked Example #4 — building a linkedin-carousel-microsoft skill (and the first amber bar)

The fourth example builds a skill that produces an external-facing artefact — a LinkedIn carousel deck about a Microsoft product topic (Copilot, Cowork, Scout, etc). The output is a .pptx that I export to PDF and upload to LinkedIn as a document carousel.

This skill behaves differently from the first three in one important way: it generates an artefact that LEAVES my tenant. That changes the scoring.

The create prompt

The result — 91/100 with the first amber bar of the series

Why the score dropped — Cowork explains it

The chat summary for this skill is more diagnostic than the earlier ones. Cowork explains where each point was lost AND why some of those losses are acceptable.

What the amber bar means — Robustness has an external-facing ceiling

The first three worked examples all stayed inside the tenant — read from M365, wrote a Word doc to OneDrive, surfaced output in chat. Cowork’s scorer treats those as lower-blast-radius skills and rewards them with full Robustness if the guardrails are explicit.

This fourth skill is different. It produces a deck that I export to PDF and upload to LinkedIn — an externally-visible artefact. Even with the same care given to guardrails, the scorer drops Robustness by 5-6 points because the blast radius extends beyond the tenant.

The scorer also surfaces a new qualifier next to the Risk Tier: “Behavioural review recommended.” Plain English translation: run the skill once on a topic you know well, audit the output by hand, then trust it in front of customers.

New things in this card vs the earlier three

What the 4 worked examples teach us

Iterating an existing skill — push the score higher

A skill doesn’t have to be perfect on the first try. Cowork’s Skill Management skill can update an existing SKILL.md based on your refinement instructions — and the quality scorer re-runs automatically every time. Two patterns are worth knowing.

Pattern A — tweak that hits perfect 100

I asked Cowork to update friday-portfolio-digest (which had scored 96/100) with two changes: expand “When NOT to Use” from 2 sibling delegations to 6, and add 3 more guardrails (including confirmation gates).

The update worked — and revealed something important: Cowork’s scorer can self-correct mid-run.

What happened in that header narrative:

1. Cowork applied the tweak I asked for
2. Ran the scorer — got 98/100
3. Cowork itself noticed Robustness was 23/25 because the scorer’s specific text pattern (confirm before) wasn’t matched, even though my new guardrails had the same INTENT
4. Cowork re-worded rule 9 itself to include the matching pattern, without me asking
5. Re-ran the scorer — landed on 100/100

That’s autonomous skill improvement. The lesson: when you tweak a skill, Cowork doesn’t just apply-and-stop — it iterates against its own scorer until it’s hit the wall.

Pattern B — tweak that hits a structural ceiling

I tried the same trick on new-account-research-brief (which had scored 95/100). Asked Cowork to add 5 more guardrails — push Robustness from 20 to 25.

The skill went from 95 → 97. Not 100. Cowork explained why.

The diagnostic at the bottom is the takeaway:

“The scorer’s Robustness rubric caps at 22/25 for the current pattern mix — it’s looking for a specific combination of negative-path handling, edge-case examples, and fallback instructions beyond guardrail count… 97 is effectively the ceiling the rubric can reach for this skill’s structure without adding a dedicated Edge Cases or Fallback Procedures section to the SKILL.md body.”

Translation: the rubric has sub-patterns inside each dimension. For Robustness to hit 25/25 on a skill like this, the scorer is looking for:

1. ✓ Lots of explicit guardrails (we had 13)
2. ✓ Failure handling (we had it)
3. ✓ Confirmation gates (we had them)
4. ✗ A dedicated ## Edge Cases H2 section (we didn’t have one)
5. ✗ A dedicated ## Fallback Procedures H2 section (we didn’t have one)

Adding more bullets inside existing sections doesn’t satisfy points 4 and 5 — the scorer wants distinct H2 sections. Cowork offered to add them (“Happy to do that if you want to chase 100”).

Pattern C — structural restructure to reach 100

Per Pattern B above, new-account-research-brief capped at 97/100. The scorer wanted two NEW H2-level sections (## Edge Cases and ## Fallback Procedures) — not more bullets. I asked Cowork to add them.

This time the score hit a clean 100/100.

What the rubric is actually looking for

Robustness 25/25 needs ALL of these — not any one alone:

Skill D had 4 of 5 with the bullet tweaks. Adding the missing 2 H2 sections produced the perfect score.

Skill D’s final structure (12 sections total)

After the restructure, the SKILL.md now has 12 H2 sections instead of 8:

1. YAML frontmatter
2. Overview
3. When to Use
4. When NOT to Use (4 sibling delegations)
5. Quick Start
6. Core Instructions (7 numbered steps with named tool calls)
7. Output
8. Formatting rules
9. Guardrails (13 numbered rules)
10. Edge Cases (6 negative-path scenarios with handling) ← NEW
11. Fallback Procedures (5 service/data-source failure paths) ← NEW
12. Templates / Output examples

This is now the canonical reference structure for any skill that needs to reach 100/100 — every section above contributes to a specific sub-pattern in the rubric.

Final scoreboard across all worked examples

Three Patterns observed — each illustrative for different skill types:

💡 Practical guidance for skill authors: Use Patterns A and B first. Move to Pattern C only when the improvements list is empty AND the skill genuinely benefits from edge-case + fallback documentation (most real production skills do). Don’t add ceremonial H2 sections to chase the score on a simple skill — keep the SKILL.md proportional to the skill’s complexity.

Path 2 — Custom skills via Copilot Studio (low-code, for admins)

If you’re an IT admin or power user, Copilot Studio lets you build custom skills using Power Automate flows, API connectors, or AI-powered topics. Once published, they appear as callable actions inside Cowork.

Path 3 — Pro-code skills (for developers)

For full control, the Microsoft 365 Agents SDK lets developers build skills in .NET, JavaScript, or Python. Register them in Copilot Studio and they become available inside Cowork — just like any built-in skill.

Where to find more skills

⚠️ Admin tip: Before adding third-party skills, review the permissions they request. Each skill accesses data on behalf of the user — so treat skill approval the same way you’d treat an app approval in Entra ID. Start with a pilot group.

📖 Add and manage skills in Copilot Studio

Other Cowork spokes

• Cowork: How to use it step by step
• Cowork: Use cases by role
• Cowork: Prompts to try
• Cowork: Pricing and cost management
• Cowork: Admin enablement and governance
• Cowork: On mobile

Official Microsoft references for skills + plugins

• Microsoft Learn — Copilot Cowork overview
• Microsoft Agent Academy — Cowork Collective — official hands-on labs:
  • Badge Bandit — 25 min · CSV analysis + styled HTML report email
  • Vacay (Out-of-Office Prep) — 20 min · full OOO handoff in one conversation
  • Audit Ace — 25 min · compliance packet assembly

Community Cowork skill libraries (with attribution)

The Cowork developer community is publishing creative skill patterns publicly. One worth a look if you build custom skills:

• ITSpecialist111/Copilot-Cowork-Skills — a personal research repository containing two interesting patterns:
  • skill-factory — a meta-skill that batch-creates other skill packages to a defined quality bar
  • rfp-agent-swarm — a 7-skill pipeline for RFP response work (intake → fit assessment → drafting → human gates → review → assembly), shared substrate, 4 hard human-approval gates

⚠️ Note on community content: Community repos like the one above are independent research artefacts, not Microsoft products. The author of that repo states this clearly. They can be excellent learning material but should always be validated against Microsoft Learn — Cowork before being used with real data.