NLWeb from Microsoft Build 2025: Making Enterprise Websites AI-Native

Microsoft announced NLWeb at Build 2025 as an open framework that lets any website expose its content as a conversational endpoint agents can query directly. For enterprises, this reframes the corporate website from a passive brochure into a machine-readable knowledge surface that participates in the agentic web.

The implication is broader than a marketing update. NLWeb quietly redefines what a website is for once autonomous agents — not just human browsers — become primary consumers of enterprise content.

What NLWeb Actually Is

NLWeb pairs an existing website's structured data — typically schema.org markup — with a small runtime that speaks the Model Context Protocol (MCP). The result is an endpoint on your own domain that an agent can query in natural language and receive structured, sourced answers back.

The framework is intentionally open. It supports multiple model backends, does not require a specific hyperscaler, and runs alongside your existing CMS rather than replacing it. Microsoft positioned it as HTML for the agentic era: a common shape enterprises can adopt without ripping out their web stack.

Two architectural choices matter for CIOs evaluating this:

• Every NLWeb endpoint is also an MCP server, meaning agents that already speak MCP — including Microsoft 365 Copilot and third-party agents — can call it without custom integration.
• Answers are grounded in the site's own schema.org and content data, keeping the corporate voice and provenance intact instead of relying on whatever a public model happened to memorize.

Enterprise Use Cases That Justify the Work

Corporate marketing sites are the obvious first candidate, but the more interesting patterns are internal and transactional.

Corporate knowledge surfaces. Product documentation, HR policies, standards, and internal FAQs already carry schema.org markup on many enterprise sites. An NLWeb endpoint turns those pages into a queryable knowledge base that Copilot and internal agents can consult without a separate search index or vector store project.

Product and service catalogs. Manufacturers, distributors, and B2B service firms with large SKU catalogs benefit immediately. An agent can ask a natural question — "which of your controllers support the new safety spec?" — and get a grounded answer with links back to the canonical product pages.

Support and self-service. Public knowledge bases become directly consumable by customer-service agents, partner portals, and, increasingly, the buyer's own agent doing pre-purchase research on behalf of a procurement team.

For most of our engagements, the fastest win is exposing the existing customer-facing knowledge base first — it's already public, already indexed, and already carries schema. Internal endpoints follow once governance is settled.

Security Considerations You Cannot Skip

An NLWeb endpoint is a public API in every sense that matters, even when the underlying content is already public. Treat it accordingly.

• Rate limiting and abuse controls. Natural-language queries are cheaper for the caller than for you. Enforce per-IP and per-token rate limits and prepare for scraping patterns that look different from classic bot traffic.
• PII exposure surface. Any page that inadvertently contains personal data, internal contact details, or draft content becomes trivially queryable. Re-audit what's indexed before flipping the endpoint on.
• Authentication for non-public surfaces. Internal NLWeb endpoints must sit behind the same identity boundary as the underlying content. Do not assume "internal-only DNS" is enough; agents will call anything they can resolve.
• Prompt injection via content. Marketing pages, product descriptions, and user-generated content can carry instructions aimed at downstream agents. Sanitize content and monitor for injection patterns as part of the CMS workflow.
• Answer provenance and logging. Log every query, the retrieved chunks, and the returned answer. This is your only defense when a wrong or embarrassing answer surfaces later.

Enterprises in regulated sectors like healthcare and financial services should treat any NLWeb endpoint as an in-scope system for their existing data classification and DLP programs from day one.

CMS and Architecture Implications

NLWeb does not require rebuilding your CMS, but it does put pressure on how content is structured. Sites that already invested in clean schema.org markup, canonical URLs, and disciplined content models get an NLWeb endpoint almost for free. Sites that rely on unstructured pages with heavy JavaScript rendering will need remediation before the endpoint returns useful answers.

The pattern we recommend to CIOs is straightforward:

• Adopt or extend schema.org markup across the top 20% of pages that drive 80% of queries.
• Add an NLWeb runtime alongside the existing CMS — typically as a small container or serverless function fronted by the same CDN.
• Wire the endpoint into the same observability stack as the rest of the web tier, so latency, errors, and abuse show up in the same dashboards.
• Publish a /.well-known/mcp descriptor so trusted agents can discover the endpoint without out-of-band coordination.

Longer term, NLWeb pushes the CMS conversation toward structured content and away from page-centric authoring. Teams that have resisted headless-CMS moves will feel more pressure once agent traffic starts showing up in the logs.

How This Fits the Copilot Roadmap

For enterprises already deploying Microsoft 365 Copilot, NLWeb is a low-cost way to make external and internal websites first-class knowledge sources for Copilot agents without building a separate Graph connector for every content system. It complements rather than replaces the existing connector ecosystem.

We typically fold NLWeb planning into the same governance workstream as agent policy and data-loss prevention, and treat the endpoint stand-up as part of the broader Copilot deployment plan rather than a marketing project.

What to do next

If your enterprise is planning any refresh of the corporate site, product catalog, or knowledge base in the next twelve months, NLWeb belongs on the requirements list before scope is locked. Start with a small scoped assessment: which content is already schema-marked, which endpoints would benefit first, and which security and governance controls need to be in place before exposure.

Our consultants can run a two-week NLWeb readiness review that maps your current schema coverage, flags PII and injection risk, and produces a phased rollout plan. Book the review through the readiness assessment intake or contact us directly at /contact.