{
  "id": "CB-M365-POWER-022",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-022",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-022.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-022.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-022",
    "title": "Require user authentication for Copilot Studio agents and limit how widely they are shared",
    "finding": {
      "title": "Copilot Studio agents can be used without authentication or are open to everyone",
      "description": "Some agents accept anonymous users, do not require sign-in, or are shared with any user or any tenant, so their knowledge and tools are reachable by people who should not use them."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "copilot-studio",
      "ai-agents",
      "authentication",
      "sharing",
      "data-policy"
    ],
    "applicability": {
      "requires": [
        "Microsoft Copilot Studio"
      ]
    },
    "description": "Copilot Studio agents only serve authenticated users and are shared with named audiences:\n\n- a Power Platform data policy covering all environments blocks the connector **Chat without\n  Microsoft Entra ID authentication in Copilot Studio**, so makers cannot publish agents with\n  **No authentication**;\n- each agent uses **Authenticate with Microsoft**, or **Authenticate manually** with **Require\n  users to sign in** turned on;\n- no agent is shared for use with any user (**Any**) or any tenant (**Any (multitenant)**);\n  multi-tenant support is off unless the agent is designed for partners;\n- on managed environments, sharing limits restrict who makers can share agents with (for example\n  no **Editor** sharing, or security groups only).\n",
    "rationale": "An agent answers from its knowledge sources and runs tools with stored or user credentials. An\nunauthenticated agent published on a website or Direct Line channel exposes that knowledge and\nthose tools to anyone with the link, and its users cannot be identified in logs. Agents shared with\nevery user or every tenant reach people who were never meant to use them. Requiring sign-in and\nscoped sharing keeps agent access under the same identity controls as other applications.\n",
    "impact": "Agents built for anonymous public use (for example a public website assistant) cannot be published\nin environments covered by the data policy; host them in a dedicated environment with a reviewed\nexception policy. Agents that switch to authentication must be republished, and users of custom\nchannels must sign in. Sharing limits apply to new sharing operations only.\n",
    "audit": {
      "manual": "1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at\n   least a Global Reader and browse to **Security** > **Data and privacy** > **Data policy**.\n   Check that a policy covering all environments places **Chat without Microsoft Entra ID\n   authentication in Copilot Studio** in **Blocked**.\n2. For each environment with agents, sign in to Copilot Studio (https://copilotstudio.microsoft.com)\n   as an environment admin or System Administrator, open each published agent and check\n   **Settings** > **Security** > **Authentication**: the option is **Authenticate with\n   Microsoft**, or **Authenticate manually** with **Require users to sign in** on.\n3. From the agents list, open **Share** for each agent and check that it is not shared with the\n   whole organization without permission rules, and that multi-tenant support is off.\n4. Alternative, read only: query the Dataverse `bots` table of each environment\n   (`GET https://<org>.crm.dynamics.com/api/data/v9.2/bots`) and review the authentication and\n   access control columns, or run the Maester tests MT.1113 and MT.1114\n   (`Connect-Maester -Service Dataverse,Graph`), which only read data.\n5. Fail if the data policy is missing, or if a published agent allows anonymous use, does not\n   require sign-in with manual authentication, or is shared with any user or tenant without an\n   approved exception.\n"
    },
    "remediation": {
      "manual": "1. In the Power Platform admin center, **Security** > **Data and privacy** > **Data policy**,\n   edit the tenant baseline policy (or create one with scope **Add all environments**) and move\n   **Chat without Microsoft Entra ID authentication in Copilot Studio** to **Blocked**. Role:\n   Power Platform Administrator.\n2. Ask each agent owner to set **Settings** > **Security** > **Authentication** to **Authenticate\n   with Microsoft** (or **Authenticate manually** with **Require users to sign in**), then\n   republish the agent.\n3. In the agent's **Share** dialog, remove organization-wide or open access and share with\n   security groups; turn off multi-tenant support in the authentication settings.\n4. On managed environments, configure **Sharing limits** for agents (environment settings or\n   environment group rules).\n",
      "rollback": "Move the connector back to **Non-business** in the data policy, or exclude the environment that\nhosts an approved anonymous agent.\n"
    },
    "references": [
      {
        "title": "Configure data policies for agents",
        "url": "https://learn.microsoft.com/microsoft-copilot-studio/admin-data-loss-prevention",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Configure user authentication in Copilot Studio",
        "url": "https://learn.microsoft.com/microsoft-copilot-studio/configuration-end-user-authentication",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Control how agents are shared",
        "url": "https://learn.microsoft.com/microsoft-copilot-studio/admin-sharing-controls-limits",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester test MT.1114",
        "url": "https://maester.dev/docs/tests/MT.1114",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1213"
      },
      {
        "framework": "mitre-attack",
        "id": "T1530"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-003",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-023",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-024",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-020",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}