There is a reliable way to predict Microsoft's next product decision: find whatever corner of its software suite has not yet been claimed by Copilot, and wait. The wait, it turns out, is getting shorter. Microsoft's 365 roadmap quietly confirmed last week that Edge will soon automatically open the Copilot AI side pane every time a user clicks a link from Outlook. No prompt required. The pane simply appears.
The feature was listed on the roadmap on 25 February, with general availability scheduled to begin in May 2026. According to Microsoft, the update is designed to "provide contextual insights and actionable suggestion chips based on email and destination content," helping users understand web pages more quickly and take follow-up actions with fewer steps. On paper, that sounds like a reasonable productivity proposition. In practice, the details that matter most remain conspicuously absent from the announcement.
Chief among those absent details: will users be able to turn it off? As reported by The Register, Microsoft has not confirmed whether the feature will be opt-in or opt-out. Given the company's track record, the smart money is not on opt-in. The roadmap entry uses permissive language, noting that Edge "can" automatically open the pane, but that careful wording offers cold comfort to enterprise administrators who have spent the better part of two years trying to manage Copilot's expanding footprint across their organisations' systems.
The scope of that footprint is genuinely striking. The Register notes that finding a part of Microsoft's productivity suite that Copilot has not yet reached is increasingly difficult, with even Notepad among its recent conquests. For IT teams that have not adopted Copilot, each new integration represents another policy to write, another setting to audit, another potential data exposure to assess. The Outlook-to-Edge pipeline is particularly sensitive territory: when a user clicks a link from a work email, the AI assistant would be drawing context from both the email itself and the destination web page simultaneously.
A Corporate Security Headache
That dual-context processing is where many security professionals are likely to take issue. Vivaldi browser co-founder and CEO Jon von Tetzchner, who has been a consistent critic of AI-forward browser strategies, was direct in his assessment. "Considering how sensitive corporate emails can be, the last thing you want is them being snooped on by an LLM hosted who knows where," he told The Register. He went further, raising the spectre of phishing attacks that could exploit the automated summarisation function, and concluded: "Should this be an opt-in rather than an opt-out? Absolutely."
It is a pointed critique, and not an unfair one. Questions about where AI-processed content is stored, for how long, and under what governance framework are not academic. Organisations subject to strict data handling obligations, whether under Australian Privacy Act requirements, financial services regulations, or other compliance regimes, have a legitimate interest in knowing precisely what an AI assistant is doing with the contents of their staff's inboxes. Microsoft has not yet addressed those questions publicly, and The Register reported the company did not respond to queries about administrator controls or what happens when Edge is not the user's default browser.
There is also a prior incident worth noting. A previous Copilot incident in which the assistant summarised emails it was not supposed to access raised data loss prevention concerns that are directly relevant to any feature that automatically processes email context.
The Case for Microsoft's Approach
For fairness, Microsoft's broader vision is not without logic. The company has positioned Copilot as a first-class productivity layer across its suite, and there is a genuine user benefit to seamlessly summarising a linked article or flagging key actions without requiring the user to manually invoke an AI tool. For workers managing high email volumes, contextual AI assistance that reduces the cognitive load of switching between applications has real value. The productivity case is strongest when the AI stays in its lane and the user retains clear, accessible control.
Microsoft's position is also that the feature rolls out to standard multi-tenant cloud environments, which means the largest enterprise customers with existing Copilot governance frameworks will likely have the tools to manage it. Organisations already running Microsoft 365 with Copilot policies in place are arguably better positioned to handle a new integration than they were when Copilot first arrived. The concern is less about sophisticated enterprise customers and more about smaller businesses and individual users who may not realise the feature has activated, or may not know how to disable it.
What remains genuinely unresolved is the question of default behaviour. A feature that opens automatically, without explicit user action, sets a different standard than one that requires a click to activate. The difference matters both practically and philosophically: it shapes what users come to accept as normal, and it shifts the burden of choice from Microsoft onto the user who must seek out a setting to undo something they never agreed to. Whether that trade-off is acceptable depends largely on how much weight one gives to convenience versus control, and that is a question Microsoft's product team is quietly answering on behalf of millions of users without asking them first.
The May 2026 deadline gives organisations some lead time to prepare. IT administrators would be well advised to treat this as a governance question now rather than a support problem later. And Microsoft, if it is serious about building trust in Copilot rather than simply maximising its exposure, would do well to make the off switch both obvious and easy to find.