Copilot Studio Agent Security: An SME Baseline

Stop anonymous agents, limit channels and connectors, and enforce it at environment level before makers publish their first Copilot Studio agent.

What the 2026 wave 1 feature adds

The Power Platform 2026 release wave 1 plan lists "Manage agent security with enhanced admin controls". Public preview was 31 May 2026 and general availability is listed for September 2026. The plan page carries Microsoft's usual caveat that some functionality may not yet be released, so confirm what your tenant shows.

According to the plan, administrators can centrally define authentication and access policies for agents at the environment or environment group level in the Power Platform admin center. Examples given are:

• Require Microsoft Entra ID authentication.
• Allow authentication only from approved external providers.
• Prohibit anonymous access entirely.
• Define policies that govern agent sharing and restrict unsupported configurations.

These policies are evaluated when an agent is deployed and at runtime, so only compliant agents can be published and accessed. Microsoft also notes that release plans stop being published from September 2026, with new capabilities moving to the AI at Work roadmap.

Start with environments

Controls apply per environment or environment group, so the structure matters.

1. Keep the default environment for personal productivity only, and do not let business agents live there.
2. Create a production environment for agents that serve staff or customers, and a separate development environment for makers to experiment.
3. Group them if you use environment groups, so one set of rules covers the lot.
4. Limit who holds the Environment Admin role. Our guide to reducing admin sprawl applies here too.

Authentication baseline

Anonymous agents are the biggest avoidable risk. Copilot Studio documentation says new agents default to Authenticate with Microsoft, but makers can choose No authentication, which lets anyone with the link chat with the agent.

1. Use the new environment-level authentication policy to require Entra ID and prohibit anonymous access where your tenant offers it.
2. Also block the connector Chat without Microsoft Entra ID authentication in Copilot Studio in a data policy. Microsoft documents this as the way to stop makers publishing agents without authentication, and it works regardless of how the new controls roll out.
3. Only allow external identity providers for a genuine customer-facing agent, and put that agent in its own environment.
4. Test the result by publishing a throwaway agent set to No authentication in each environment. If it publishes, the policy is not doing its job.

Data policy baseline

Microsoft states data policy enforcement for Copilot Studio has applied to all tenants since early 2025, and exemptions are no longer supported. Build the policy in the Power Platform admin center under Security, then Data and privacy, then Data policy.

For a typical SME, block by default and allow on request:

• HTTP: block, or use endpoint filtering to allow named endpoints only.
• Knowledge source with public websites and data in Copilot Studio: block, or filter to your own domains.
• Knowledge source with SharePoint and OneDrive in Copilot Studio: allow, with endpoint filtering to approved sites.
• Skills with Copilot Studio: block unless needed.
• Microsoft Copilot Studio connector: block in environments where agents should not run event triggers without a person.
• Channels: keep Microsoft Teams + Microsoft 365 Channel in Copilot Studio, and block Direct Line channels, Facebook, WhatsApp and others unless there is a business case. Microsoft notes Direct Line is allowed by default.

Blocking a Power Platform connector also blocks tools in connected MCP servers that rely on it, which is useful when you want to stop unreviewed tools. Remember that connectors must sit in the same data group to share data.

Sharing and publishing rules

1. Use the sharing policies in the new controls to stop makers sharing agents with the whole organisation by default.
2. Require a named business owner and a short description of data used for each production agent.
3. Add an admin contact and a Learn more link to data policy errors with the Set-PowerAppDlpErrorSettings cmdlet, so makers know who to ask.
4. Review what an agent can do, not only what it can read. Our agentic AI security checklist covers approval steps for actions.

Verify and review

• Open an agent in each environment and try a blocked action. Copilot Studio shows an error banner, and the Publish button becomes unavailable on a violation.
• Download the violation details from the Channels page and keep them as evidence.
• Use the Center of Excellence Starter Kit dashboard, or a Dataverse list flow, to find agents affected by policy changes.
• Revisit the baseline each quarter and whenever Microsoft adds a new channel or connector.

Source basis

• Microsoft Learn: Manage agent security with enhanced admin controls (2026 wave 1)
• Microsoft Learn: Configure data policies for agents in Copilot Studio
• Microsoft Learn: Managing AI experiences enabled by usage-based billing