“Aether Workspace” in SharePoint Embedded: the Copilot Cowork container explained

Recently, I spotted a new, unknown SharePoint Embedded (SPE) container in the SharePoint admin center. The container is named “Aether Workspace - [Guid]” and linked to the Work IQ application. The GUID is the user object ID of the container owner, so it belongs to someone in your organization.

In the meantime, I know how to unpack these undocumented SharePoint Embedded containers. I did it for several new containers.
But Microsoft now restricts access to some containers, for example, those used by declarative agents. That's a bit strange: these restricted containers use your SharePoint storage, but as an admin, you can't access them.

A Sentinel search for Purview audit logs reveals the Aether Workspace container was created by Copilot Cowork.

• Filter for the operation SiteCollectionCreated, because a newly created container always creates the SharePoint site collection first.
• Filter for OfficeObjectId and the CSP_[Guid] information. You get just one result.
• The ClientAppName reveals who provisioned that container.

OfficeActivity
| where TimeGenerated > ago(10d)
| where OfficeObjectId contains "CSP_[Guid]"
| where Operation == "SiteCollectionCreated"
| project TimeGenerated,OfficeWorkload,Operation,OfficeObjectId,AppAccessContext.ClientAppName

For now, I haven't opened or used Copilot Cowork, since it’s usage-based only. So I wondered what triggered the container creation.
Then I remembered I used the Cowork service name at that time to test the Copilot Cost Management APIs via Microsoft Graph. I had prepared policies for the Cowork billing service.

The log entry is close to the time of the policy creation. During my test, I created three of these policies and deleted and recreated them. I created my first policy at the time of the Sentinel log.

It was still unclear why my policy creation triggered container provisioning.

• I added two of my test accounts to my Cowork Entra ID group to test whether this triggers container creation. The group is linked to my Cost Management policy, meaning group members can spend credits for Cowork. The system could pre-provision the container for eligible users, but nothing happened.
• Next, I assigned a Copilot license to one of these test accounts. Nothing happened again.
• I clicked on Cowork in Copilot. Cowork informed my test account about the Cowork access.

That triggered the container creation (in less than 30 minutes). Now there are two of these Aether Workspace containers.

One part is still missing: What is the application ID of Work IQ?
A SharePoint Embedded admin needs the ID to retrieve all SharePoint Embedded containers with PowerShell. It’s 6ab48b67-cd74-4ad4-81af-5932984589be, as confirmed in a Dynamics 365 documentation.

Add the Cowork Client App ID: 6ab48b67-cd74-4ad4-81af-5932984589be.

Good to know:
The Work IQ application also creates SPE containers for the new Memory in Teams feature, which is currently rolling out. You may also see additional containers named “Meeting Artifacts” under the Work IQ application.

Now you can list all these Work IQ containers. These containers are not restricted for SharePoint Embedded admins.
This also reveals a new container type: ApplicationOwned, also visible in the first screenshot. These Aether Workspace containers are owned and managed by Copilot Cowork.

Get-SPOContainer -OwningApplicationId "6ab48b67-cd74-4ad4-81af-5932984589be" | select ContainerName,OwnershipType,CreatedOn,ContainerId

Retrieve the container details.

And the name “Aether Workspace”?
I found no confirmed answer. Gemini in Google responds with a reference to Cowork CLI.

Aether Workspace refers to the underlying runtime and cloud container environment used by Microsoft 365 Copilot Cowork.

And hey, if you're still in Sentinel, it's worth checking what's happening inside this container. Purview audit logs reveal what happens inside it, including site settings like the quota configuration, the file structure, and more. Sometimes it’s good to know what is going on inside.

OfficeActivity
| where TimeGenerated > ago(10d)
| where OfficeWorkload == "SharePoint"
| where OfficeObjectId contains "CSP_[Guid]"