Copilot Can Now Generate Your Spreadsheets. Your Business Still Shouldn't Run on Them.

Microsoft announced the May 2026 update to Microsoft 365 Copilot Notebooks at the start of the month, and the headline feature for small and mid-size businesses is the one called Frontier. You describe the data you need in plain language, and Copilot returns a fully formatted, formula-filled worksheet sourced from your Microsoft Graph data. Budget rollup, sales tracker, inventory snapshot, all generated on demand.

If you have ever built one of those by hand, that is a real time-saver. If you are running a real business on one of those, it is also a trap.

What Frontier actually does

Frontier is currently rolling out through Microsoft's early-access experimentation program, so it is moving fast and the exact shape will keep shifting. What is confirmed: natural-language prompts that produce structured Excel worksheets, sourced from data that already lives inside your tenant. Bring me last quarter's regional sales and a YoY comparison. Build me a 12-week cash-flow model with these line items. Pull payroll by department and flag anything over budget.

The output is real Excel. Real cells, real formulas, real charts. You can edit it, ship it, email it. For the analyst writing a board pack on Thursday night, that is a clear win. For a marketing lead who needs a quick KPI rollup, also a clear win. Microsoft's own Work Trend Index puts the average time saved at around ten hours per week for people doing data tasks in Excel with Copilot, which tracks with what most people report once they get past the prompting learning curve.

That is the part Microsoft is selling, and it is mostly accurate. So where does it go wrong.

Frontier does not turn Excel into business software

There is a category of spreadsheet that should never have been a spreadsheet. The customer list with a "status" column. The inventory tracker shared across three locations. The quoting tool with seventeen tabs and a macro that breaks every time someone opens it on a Mac. The job board kept in a Google Sheet because the team needed something faster than the CRM.

I wrote about this in early May, and the underlying point has only gotten louder. A recent industry survey found that more than half of businesses are now investing in custom software specifically because spreadsheets stopped scaling. Multiple editors. Version drift. Mobile users locked out by a layout that breaks on a small screen. Permission models that boil down to "do not share the file with the wrong person." Manual data entry that depends on whoever is at their laptop that morning.

Frontier does not solve any of that. It just lets the AI build the same broken tool faster. The sheet still lives on someone's OneDrive. It still has no audit trail beyond version history. It still cannot enforce a workflow, surface a dashboard to a customer, or be edited safely by three people at once. You are not buying business software. You are buying a faster way to make spreadsheets.

The new attack surface nobody is talking about

There is a security story underneath this rollout that should make every IT-light business think twice about handing Copilot Agent unsupervised access to operational data.

On March 10, Microsoft patched CVE-2026-26144, an Excel cross-site scripting vulnerability that combined with Copilot Agent's network egress permissions to enable zero-click data exfiltration. A booby-trapped spreadsheet, rendered in Excel's preview pane, could instruct the embedded agent to fetch local data and forward it to an attacker-controlled server. No clicks. No "do you want to enable macros." Just open the email.

That specific bug is patched. The class of bug is not going anywhere. Concentric AI's 2026 data risk reporting found that the average organization has roughly three million confidential records that Copilot can see, including financial data, HR records, and IP. When you point a Frontier-generated spreadsheet at "all sales data from the last quarter," Copilot is using the same permission scope. If the source data is overshared, the AI-generated workbook quietly inherits that exposure.

For a fifteen-person company without a dedicated security team, "Copilot can see what you can see" is a much bigger claim than it sounds.

When Frontier is actually a good fit

I want to be fair to the product. Frontier is genuinely useful in three places.

One, internal one-off analysis. The CFO needs to model a price change before Monday's call. The ops lead wants to slice last month's incidents by category. The marketing director needs a deck-friendly chart of campaign performance. These are exactly the workflows Excel was built for, and AI-assisted generation lets the right person produce the right artifact in the time they actually have.

Two, prototyping a process before you build it as software. Spinning up a spreadsheet to test whether a workflow even makes sense is cheaper than commissioning an app. If Frontier helps you get to "yes, this matters, here is what the data looks like" faster, that is a feature, not a bug. It also gives a prototype-to-production engagement something concrete to build against.

Three, personal productivity for individual contributors. A consultant building client decks, an accountant doing month-end, a sales rep prepping a QBR. The output ships, the file gets archived, the next one starts fresh. Spreadsheet hygiene is not really the issue when nobody else has to touch the file.

Notice what is missing from that list. Operations. Customer-facing data. Anything where multiple people need to update the same record at the same time. Anything you would be embarrassed to email a screenshot of to a prospective customer. Anything that absolutely must reconcile against an invoice or a payroll run. None of that gets safer just because the AI wrote the formulas.

When the spreadsheet is actually the problem

The honest test is not "can I get Copilot to build me this sheet faster." It is "if this sheet disappeared tomorrow, what would break."

If the answer is "I would just regenerate it next time I need it," Frontier is helping. If the answer is "we would not be able to take orders, route jobs, run payroll, or close the books," you are running a business on a spreadsheet, and you should be moving that workflow into custom software instead of investing in AI features that make the underlying problem less visible. Or, if the right pieces already exist in tools you own, into integrations that connect them properly so the data lives in the system designed to hold it.

That is not an anti-spreadsheet position. It is a "use the right tool for the job" position. The right place for AI in a small business workflow is on top of a system designed for that workflow, surfacing summaries, drafting outreach, flagging anomalies, automating handoffs. I covered the cases where AI automation is genuinely worth doing a few weeks ago, and almost none of them depend on a generated spreadsheet.

The actual decision

Frontier is shipping. You will end up using it. The question is what you let it sit on top of.

If your spreadsheets are reports and analysis, AI-generation is a productivity feature you should turn on, with a real conversation about what data Copilot is allowed to touch. If your spreadsheets are quietly doing the work of a business application, generating them faster does not buy you more time. It buys you a faster trip to the moment when the spreadsheet breaks at a worse time, in front of a customer, with no audit trail and no rollback.

We build the second category as actual software, because that is where the business actually is.