Governing Copilot Studio: the risk is in the connectors

En bref. Copilot Studio arrive avec vos licences, et vos équipes vont bâtir des agents, avec ou sans processus. L'essentiel du risque est dans les connecteurs : ce qu'un agent peut lire, où il envoie les données, et sous quelle identité. Réglez quatre choses avant le premier agent : un environnement dédié, une page de gouvernance des connecteurs, une revue avant la production et une surveillance après la mise en service.

The situation

• Copilot Studio came with your Microsoft 365 or Power Platform licences.
• Teams want agents now: an HR assistant, a quote helper, a ticket summariser.
• Your approval process handles a few applications a year. It was not built for dozens of agents.

Blocking does not stop it. In Microsoft's 2024 Work Trend Index, 78% of AI users brought their own AI tools to work. Agents get built anyway, somewhere you cannot see them.

Where the risk actually is

An agent is only as dangerous as what it can reach. In Copilot Studio, that means four things:

• Connectors. How an agent reads data and acts on other systems. An HTTP request or an email action can move data out of your tenant.
• Knowledge sources. A SharePoint site with loose permissions becomes an agent that answers anyone's question about it.
• Authentication. An agent that does not require sign-in, or runs on the maker's credentials, hands its users the maker's access.
• Sharing. An agent shared with the whole organisation reaches everyone the day it is published.

These are not theoretical. In February 2026, Microsoft's Defender research team published the ten most common Copilot Studio agent misconfigurations it sees in real environments. Broad sharing, missing authentication, risky HTTP requests, email-based exfiltration and maker credentials are all on the list.

The consequences:

• Breach. In IBM's 2025 Cost of a Data Breach report, 97% of organisations that had an AI-related breach lacked proper AI access controls.
• Regulatory. In Québec, communicating personal information outside the province requires an assessment first under Loi 25. A connector that quietly sends it elsewhere is a compliance problem, not only a security one.

What to do, in this order

1. Give makers a place to build that is not the default environment

• Lock the default environment. Otherwise every licensed user can build and publish there.
• Create a dedicated set of environments: Dev, Test, Prod.
• Move agents between them with Power Platform pipelines, so nobody edits production by hand.

This is a few days of admin work. Skipping it means auditing agents you did not know existed.

2. Write a governance page for connectors

Make every connector request answer six questions:

• Why does the business need it?
• What data does it touch, and what is that data's sensitivity label?
• Does data leave the tenant, or leave Canada?
• Does it authenticate as the user or as a service account?
• Who owns it?
• Which environment is it allowed in?

Then:

• Review the answers before allowing the connector.
• Start with a manual review. Encode the result in DLP policies once your categories are stable.

The side effect is the real benefit. Makers start thinking about data and authentication while they build, before anyone asks them to.

3. Review before production, not before building

Let everyone build. Gate production instead. Check five things:

• Authentication: Entra ID, nothing anonymous
• Knowledge sources
• Sharing scope
• Connectors used
• Data sensitivity

Who reviews:

• At 100+ makers: the Copilot admin and a security admin, together.
• In a smaller organisation: one reviewer and a checklist.

4. Watch it after go-live

A review covers the day an agent launches, not the months after.

• Send Purview audit logs to your SIEM, Sentinel or whatever you already run.
• Use Defender for Cloud Apps to watch agent activity and prompts.
• Keep an inventory with a named owner for every agent, and review it when people leave.

What waiting costs

• At ten agents: a week of review.
• At a hundred: a project, with agents in production that nobody reviewed and owners who have since left.

The controls are the same either way. Only the cleanup grows.

How we did it

We set this up for an energy company opening Copilot Studio to 120+ makers: dedicated environments, the connector governance page, a review committee, and monitoring through Defender for Cloud Apps and Sentinel. Dozens of agents went through it into production.

Read the customer story