Require user authentication for Copilot Studio agents and limit how widely they are shared

Description

Copilot Studio agents only serve authenticated users and are shared with named audiences:

• a Power Platform data policy covering all environments blocks the connector Chat without Microsoft Entra ID authentication in Copilot Studio, so makers cannot publish agents with No authentication;
• each agent uses Authenticate with Microsoft, or Authenticate manually with Require users to sign in turned on;
• no agent is shared for use with any user (Any) or any tenant (Any (multitenant)); multi-tenant support is off unless the agent is designed for partners;
• on managed environments, sharing limits restrict who makers can share agents with (for example no Editor sharing, or security groups only).

Rationale

An agent answers from its knowledge sources and runs tools with stored or user credentials. An unauthenticated agent published on a website or Direct Line channel exposes that knowledge and those tools to anyone with the link, and its users cannot be identified in logs. Agents shared with every user or every tenant reach people who were never meant to use them. Requiring sign-in and scoped sharing keeps agent access under the same identity controls as other applications.

Impact

Agents built for anonymous public use (for example a public website assistant) cannot be published in environments covered by the data policy; host them in a dedicated environment with a reviewed exception policy. Agents that switch to authentication must be republished, and users of custom channels must sign in. Sharing limits apply to new sharing operations only.

Applies when

Requires: Microsoft Copilot Studio

Audit

1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at least a Global Reader and browse to Security > Data and privacy > Data policy. Check that a policy covering all environments places Chat without Microsoft Entra ID authentication in Copilot Studio in Blocked.
2. For each environment with agents, sign in to Copilot Studio (https://copilotstudio.microsoft.com) as an environment admin or System Administrator, open each published agent and check Settings > Security > Authentication: the option is Authenticate with Microsoft, or Authenticate manually with Require users to sign in on.
3. From the agents list, open Share for each agent and check that it is not shared with the whole organization without permission rules, and that multi-tenant support is off.
4. Alternative, read only: query the Dataverse bots table of each environment (GET https://<org>.crm.dynamics.com/api/data/v9.2/bots) and review the authentication and access control columns, or run the Maester tests MT.1113 and MT.1114 (Connect-Maester -Service Dataverse,Graph), which only read data.
5. Fail if the data policy is missing, or if a published agent allows anonymous use, does not require sign-in with manual authentication, or is shared with any user or tenant without an approved exception.

Remediation

1. In the Power Platform admin center, Security > Data and privacy > Data policy, edit the tenant baseline policy (or create one with scope Add all environments) and move Chat without Microsoft Entra ID authentication in Copilot Studio to Blocked. Role: Power Platform Administrator.
2. Ask each agent owner to set Settings > Security > Authentication to Authenticate with Microsoft (or Authenticate manually with Require users to sign in), then republish the agent.
3. In the agent's Share dialog, remove organization-wide or open access and share with security groups; turn off multi-tenant support in the authentication settings.
4. On managed environments, configure Sharing limits for agents (environment settings or environment group rules).

Rollback

Move the connector back to Non-business in the data policy, or exclude the environment that hosts an approved anonymous agent.

References

• Configure data policies for agents Microsoft, vendor-doc, accessed 2026-10-24
• Configure user authentication in Copilot Studio Microsoft, vendor-doc, accessed 2026-10-24
• Control how agents are shared Microsoft, vendor-doc, accessed 2026-10-24
• Maester test MT.1114 Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-003 Apply a restrictive data policy to the default Power Platform environment
• related CB-M365-POWER-023 Keep maker credentials, hard-coded secrets and cleartext HTTP out of Copilot Studio agents
• related CB-M365-POWER-024 Govern the lifecycle of Copilot Studio agents
• related CB-M365-TENANT-020 Restrict Copilot web search, agents and third-party AI providers

People and lifecycle