Copilot Studio Security Best Practices | Day 87

Day 87 of 365 Days of Copilot Studio turns governance into practical security checks. An agent can retrieve information and call tools, so its security depends on the identities, content, connections, and services around it.

Building on Day 86: Governance, this lesson follows the source PDF's layered approach to identity, knowledge, actions, data, and monitoring.

Understand the attack surface

An unsecured agent may expose sensitive information, perform unauthorized actions, encounter malicious instructions, or use a misconfigured integration. Map its users, channels, knowledge sources, tools, connection identities, and destinations before choosing controls. No single setting protects every layer.

Authenticate users and apply least privilege

Choose authentication appropriate to the audience and channel, using Microsoft Entra ID where supported. Restrict anonymous access when the scenario requires a known user. Test sign-in and access from the actual published channel.

Review maker and administrator roles separately from agent sharing and downstream access. Give each identity only the permissions needed for its work, remove unnecessary privileges, and periodically review connector and resource access.

Protect knowledge at its source

Inventory the sites, documents, and other sources an agent can use. Scope them to the intended audience, review source permissions, and remove sensitive or obsolete material that the agent does not need. For SharePoint, check both site and document permissions.

Authentication and retrieval behavior vary by source and configuration. Test the same question as an authorized user and a user without access; confirm the latter cannot receive restricted content. See the SharePoint security guide for a practical review.

Control data paths and authorize actions

Review applicable Power Platform data policies for the agent's supported connectors, connector combinations, endpoints, capabilities, and channels. The allowed and blocked services in the PDF are examples of organizational choices, not universal defaults. Verify policy coverage and limitations in your environment.

For each tool, identify who calls it, which identity the connection uses, and what the destination allows that identity to do. Enforce authorization and input validation in the protected service; a conversational instruction alone is not an access control. Use confirmation or human review for high-impact operations where appropriate, then verify the actual result of both allowed and denied requests.

Reduce prompt injection and protect secrets

Documents, websites, and user messages can contain instructions intended to redirect the agent. Treat retrieved material as untrusted data, validate tool inputs, restrict high-impact actions, and test malicious or misleading prompts. These measures reduce risk; they do not guarantee that every malicious instruction will be detected.

Keep API keys, passwords, and service credentials out of prompts, conversations, and knowledge documents. Use supported secure authentication and secret-management mechanisms for each integration, and restrict and rotate credentials according to your organization's policy.

Minimize sensitive data exposure

Identify personal information and confidential business documents that the agent may retrieve, process, or return. Review who can view, edit, and share that data, and apply the organization's retention and deletion requirements. Limit access to the minimum information needed for the task.

Monitor and test before release

Assign an owner to review available authentication failures, failed actions, suspicious activity, and security-relevant configuration changes. Logging and monitoring availability depend on the configuration, supported capabilities, and licensing. Define how incidents are reported and investigated.

Test with representative users and realistic permissions before each major release. Include unauthorized access, prompt injection, connector boundaries, sensitive data exposure, and unexpected action execution. Record the evidence, fix failures, and repeat affected tests.

Production security checklist

• Authentication and intended channel access are verified.
• Maker, administrator, source, and connection permissions follow least privilege.
• Knowledge access is tested with allowed and denied accounts.
• Relevant data policies and integration boundaries are reviewed.
• Actions validate permissions and inputs before execution.
• Credentials are protected and absent from agent content.
• Adversarial and data exposure tests are completed.
• Monitoring, ownership, and incident response are in place.

Security continues after publication: review changes to knowledge, connections, permissions, and channels as the agent evolves. Pair this checklist with the Day 85 deployment checklist.