A SharePoint AI Skill is the single highest-leverage thing your team can build inside Copilot in SharePoint right now. One Markdown file captures a multi-step process; the whole site can run it; the output is the same shape every time. The contract review your legal team did manually for the last decade is now a 60-line file anyone with site access can invoke from chat.
The pattern is simple. The depth comes from what you put in the file. This is the practitioner deep-dive, written from real Skills built in client tenants since the September 2025 preview opened. What a Skill actually is, where it lives, how to write one that works, how Skills differ from Copilot Studio agents, and the boundaries you need to know before you ship.
What a Skill is, in 60 words
A SharePoint AI Skill is a reusable multi-step workflow defined in a single Markdown file (SKILL.md) stored on a SharePoint site. The file captures the inputs, the steps, the rules, and the output format for a process your team does repeatedly. AI in SharePoint loads the Skill when relevant or when invoked by name, then runs the workflow inside the user's existing SharePoint permissions.
What changes when you ship a Skill
Three things change for the team. Skills are not a feature upgrade; they are a workflow primitive that lets one person do the design work and everyone share the output.
Consistency. Without a Skill, the same prompt run by five different team members returns five subtly different outputs. Different structure, different language, different level of detail. With a Skill, the same input returns the same output shape every time. The senior reviewer's standard is now the team's standard.
Reuse without rewriting. Skills live on the site, not in someone's head or in a shared document everyone forgets to update. The author writes the workflow once. New team members inherit it on day one. When the standard changes, you change the SKILL.md file once and every future run picks up the new version.
Permission-bound execution. A Skill runs with the executing user's permissions. It cannot reach data the user could not access manually. This is the boundary that makes Skills safe to publish broadly. Compare to a Copilot Studio agent with custom connectors, which can be configured to access content the end user does not normally see; Skills cannot do that.
Where Skills live in your site
Skills live in a special library called Agent Assets that gets created on the site when you activate the corresponding site collection feature. Each Skill is a folder inside an /Agent Assets/Skills/ subfolder, and each folder contains a SKILL.md file.
The exact path is /Agent Assets/Skills/<skill-name>/SKILL.md.
You can edit the Skill files directly in the SharePoint interface (open the file, edit the Markdown), or through chat by asking AI in SharePoint to update a Skill, or by uploading a new version of the file. The format is plain Markdown; you do not need any specialised tooling to write or maintain Skills.
Two other things live in Agent Assets at the same level:
SHAREPOINT.md(also at the root, optional) — the site-level context file that loads on every chat. The template is here./Plans/SitePlan.md(auto-generated if you build the site using AI in SharePoint) — the original site build plan.
These are siblings, not nested. A site can have Skills without a SHAREPOINT.md, and vice versa. Most useful tenants have both.
Anatomy of a SKILL.md file
A working Skill follows a consistent structure. Below is the anatomy of a contract review Skill I built for a financial services client. The full file is around 60 lines and runs as a contract gaps analysis on returned client contracts.
# Contract review skill
## When to use
When a user asks to review or validate one or more contract
documents in this site. Triggered by phrases like "review this
contract", "gaps analysis", "what changed".
## Inputs
- The base contract file at /Documents/base-contract.docx
- One or more returned client versions selected in chat
## Steps
1. Load the base contract from the path above.
2. Load each returned contract from the selection.
3. For each returned contract, compare clause by clause against
the base.
4. Flag every change in a table with three columns: clause,
change summary, business impact (low/medium/high).
5. Order the table by business impact descending.
6. Surface any missing mandatory clauses (force majeure,
termination, governing law) at the top of the output.
## Output
A Markdown table with the columns above, followed by a one-line
summary of total changes flagged and the count by impact band.
## Rules
- Use plain English in the change summary; no legalese.
- Never modify the contracts; this Skill is read-only.
- If a returned contract cannot be parsed, flag it and skip,
do not fail the whole batch.
Six sections. Name. When to use. Inputs. Steps. Output. Rules. That is the working pattern. You can add sections (References, Glossary, Examples) but those six cover the workflow.
The most important section is When to use. AI in SharePoint reads this when deciding whether to auto-load the Skill in response to a prompt. Write it like you are giving a new starter the trigger conditions for invoking the workflow. Be specific.
How to create a Skill
Two methods, both supported.
Method 1: natural language in chat
The faster path for most Skills. Open Copilot in SharePoint chat on the site. Tell it what the Skill should do:
"Create a Skill called 'contract review' that loads the base contract from /Documents/base-contract.docx, compares it against any selected returned contracts, and flags changes in a priority-ordered table by business impact."
AI in SharePoint generates the SKILL.md file, shows you the draft, asks clarifying questions if needed, and saves on your confirmation. The Skill is immediately available to invoke from any chat on the site.
Use this method when you are starting from a clean idea and want to iterate quickly. The Skill it generates is usually 80% right; you tune the When to use and Rules sections, then ship.
Method 2: write the SKILL.md directly
Better for porting a Skill from another tool (Claude Skills, Cowork) or for codifying an existing detailed SOP your team already has in writing.
Create the folder structure manually in the Agent Assets library: /Agent Assets/Skills/contract-review/. Upload your SKILL.md file into that folder. AI in SharePoint discovers it automatically and the Skill is available to invoke.
Use this method when you have a precise workflow you want to control exactly, or when you are bringing a working Skill across from another platform.
A worked example: contract review in production
The contract review Skill above is one I run with a financial services client. The setup, the use, and the outcome.
The starting state. A four-person legal team. Every returned contract was reviewed manually against the base template, with one senior reviewer holding the institutional knowledge of which clauses mattered most. Reviews took 45-90 minutes each. Throughput was the bottleneck on closing deals.
The Skill. Sixty lines of Markdown. The base contract path, the comparison logic, the impact bands, the mandatory-clause checks. Two hours to write the first version, an hour to refine over the first three live runs.
The outcome. A returned contract now produces a priority-ordered table of every change in about 90 seconds. The traffic-light impact bands let the team triage what needs senior review (high-impact changes) versus what can be approved by any team member (low-impact). The senior reviewer's standard, which used to walk out of the building when she did, is now in the file.
The video walkthrough of building this Skill is at SharePoint AI Skills That Replace Hours of Work — 24 changes flagged in the demo run, ordered by business impact.
Chaining Skills with the SharePoint.md context file
The two pieces work together. The Skill tells AI in SharePoint how to do a specific job. The SharePoint.md context file tells AI in SharePoint everything else about the site: the library map, the naming conventions, the voice rules, the glossary.
Without the SharePoint.md file, every Skill has to repeat the site context inside its own Steps and Rules sections. The file paths, the naming convention, the voice standards. The Skills get longer, more brittle, and harder to maintain.
With the SharePoint.md file, the Skill stays focused on the workflow. The site context loads automatically into every chat. When the contract review Skill runs, AI in SharePoint already knows the site uses Australian English, follows specific naming conventions for returned documents, and stores precedents in a particular library. The Skill does not have to specify any of that.
For sites that run more than two or three Skills, the SharePoint.md file pays back on the first new Skill you write that does not need to re-specify any of the site basics.
Skills vs Copilot Studio agents — the comparison that matters
Skills and Copilot Studio agents both extend Microsoft 365 Copilot. They are different shapes of work. The wrong choice between them is the most common pattern I see in client tenants.
| Dimension | Skills | Copilot Studio agents |
|---|---|---|
| Where they live | The SharePoint site, inside Agent Assets | Copilot Studio (Lite or full) |
| Authoring approach | Plain Markdown, written by site users | Low-code drag-and-drop or pro-code |
| Who builds them | Anyone with Edit permission on the site | Makers using Copilot Studio, or developers |
| What they can do | In-SharePoint actions only (read, generate, organise, summarise) | External API calls, custom connectors, complex multi-turn logic |
| External integration | Not supported | Supported via Power Platform connectors |
| Custom code | Not supported | Supported in the full Copilot Studio tier |
| Permissions model | Inherits the running user's site permissions | Configurable; can be configured to access content the end user cannot see |
| Best for | Repeatable team processes inside SharePoint | Customer service bots, line-of-business workflows, agents that span Microsoft 365 and external systems |
| Licensing | Included with Microsoft 365 Copilot | Copilot Studio licence required for full tier; capacity-based pricing |
A simple rule. If the workflow happens entirely inside SharePoint and uses content the team already has access to, use a Skill. If the workflow needs to call external systems, integrate with a CRM, or do anything that crosses the Microsoft 365 boundary, use a Copilot Studio agent.
A second rule. If you are not sure, start with a Skill. They are faster to write, easier to maintain, and the boundary they impose (no external calls, no custom code) is a feature not a limitation for most team workflows.
What Skills cannot do
Worth being explicit about, because this is where most overpromising happens.
No external API calls. A Skill cannot reach the public web, call a REST API, hit a database, or query a system outside Microsoft 365. The boundary is enforced by Microsoft and is not configurable per Skill or per tenant.
No custom code execution. A Skill cannot run Python, JavaScript, PowerShell, or any custom scripting. The Skill is a Markdown definition; AI in SharePoint runs the steps using its own built-in capabilities.
No new permissions. A Skill cannot do anything the running user could not do manually in SharePoint. It cannot escalate privileges, override sensitivity labels, or expose content the user does not have access to.
No fully autonomous execution. A Skill runs in response to a user invocation or an auto-load triggered by a chat prompt. There is no scheduled or background execution of Skills (that is the territory of Power Automate or Copilot Studio agent flows).
If your use case needs any of these things, you are looking at Power Platform, Copilot Studio, or Logic Apps rather than Skills.
Permissions and governance
Skills follow SharePoint permissions, which makes them safer to publish broadly than most AI extensions.
Who can create. A user with Edit permission on the site and a Microsoft 365 Copilot licence can create a Skill (or ask AI in SharePoint to create one for them).
Who can run. Any user with at least View permission on the site, plus a Copilot licence, can invoke any published Skill on that site. The running user's permissions apply to the Skill's data access.
Who can audit. Skills are files. They appear in the site's audit log and version history like any other Markdown file. Microsoft Purview audit logs include Skill invocations alongside other AI in SharePoint activity.
Who controls visibility. The site owner can choose which agents (and by extension which Skills) are surfaced to site users. Site-level AI settings in SharePoint provide per-site control.
If your governance team needs detailed insights on Skill usage across the tenant, the SharePoint Advanced Management agent reports and the Purview audit log are the two places to look.
Common Skill patterns to start with
The most useful first Skills wrap a process the team already does manually and repeatedly. Five patterns I see work across client tenants.
Document review. Contract gaps analysis, policy compliance checks, format validation. Trigger: a document is shared into chat. Output: a structured review table.
Reporting. Cross-week status reports, project health summaries, library audits. Trigger: a request like "give me the Q2 status across all my project libraries". Output: a structured report in Markdown or generated as a Word document.
Metadata enrichment. Auto-tagging documents based on content, fixing inconsistent column values, applying corporate taxonomy. Trigger: a request to organise or tag a library. Output: applied metadata and a summary of what was changed.
Structured document generation. Letters, contracts, proposals built from a base template plus form input. Trigger: a user filling out a form linked to a Word template. Output: a generated document.
Library housekeeping. Folder restructures, naming convention enforcement, ROT (redundant, outdated, trivial) flagging. Trigger: an audit request from a site owner. Output: a list of recommended actions or applied changes.
If you want to see one of these patterns built end to end in a real tenant, the video SharePoint AI Skills That Replace Hours of Work walks through the contract review Skill in detail.
What to do this week
If you have a SharePoint site with active users and a few processes the team does repeatedly, three actions.
- Activate the Agent Assets feature on the site (Site settings, Site collection features). The library appears. Inside it, the Skills folder is ready.
- Drop in the SharePoint.md context file at the root of Agent Assets. The template is here. Fill in the placeholders. This is the site context that every Skill will inherit.
- Write your first Skill. Pick a process your team does at least twice a month, ideally weekly. Open Copilot in SharePoint chat. Ask it to create a Skill that does that process. Iterate the file over the first few runs.
The payback on a working Skill is on the first invocation by a team member who is not the author. The institutional knowledge is no longer locked to one person.
For organisations rolling Skills out across multiple teams in parallel, the Copilot in SharePoint Immersive is a one-day session where we build three Skills in your tenant together. That is the fast way to go from zero to working Skills your team uses on Monday morning.
