{
  "id": "CB-M365-POWER-023",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-023",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-023.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-023.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-023",
    "title": "Keep maker credentials, hard-coded secrets and cleartext HTTP out of Copilot Studio agents",
    "finding": {
      "title": "Copilot Studio agents use maker credentials, embedded secrets or insecure HTTP calls",
      "description": "Some agents call tools with the author's stored connection, contain API keys or passwords in their topics, or send HTTP requests in cleartext or to non-standard ports."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "copilot-studio",
      "ai-agents",
      "credentials",
      "secrets",
      "http",
      "prompt-injection"
    ],
    "applicability": {
      "requires": [
        "Microsoft Copilot Studio"
      ]
    },
    "description": "Copilot Studio agents follow three rules:\n\n- connector tools that reach organizational data use **User authentication**, not **Agent author\n  authentication**, except for low-risk public lookups that are documented;\n- topics, prompts and instructions contain no credential (API key, bearer token, connection\n  string, password); secrets live in environment variables backed by Azure Key Vault or in\n  connector connections;\n- HTTP request nodes use HTTPS on the standard port, and the tenant data policy blocks the **HTTP**\n  connector or limits it to approved endpoints with endpoint filtering.\n",
    "rationale": "With author authentication, every person who chats with the agent acts with the maker's\npermissions: a user can read or change data they could never reach themselves, and prompt\ninjection can turn the agent against the maker's mailbox or files. Secrets written in topics can\nbe extracted through prompt injection and outlive their rotation elsewhere. Cleartext or unusual\nHTTP endpoints may leak data and are typical of exfiltration or command-and-control channels.\n",
    "impact": "Users must create their own connection the first time an agent calls a tool with user\nauthentication; some channels (Demo website, Facebook, mobile app) do not support it. Agents that\nrely on blocked HTTP endpoints stop working until they move to connectors or approved HTTPS\nendpoints. Rotate every secret found in a topic.\n",
    "audit": {
      "manual": "1. In the Power Platform admin center (https://admin.powerplatform.microsoft.com), as at least a\n   Global Reader, browse to **Security** > **Data and privacy** > **Data policy** and check that\n   the policies covering agent environments block the **HTTP** connector, or allow only\n   approved HTTPS endpoints through **Configure connector** > **Connector endpoints**.\n2. In Copilot Studio (https://copilotstudio.microsoft.com), as an environment admin or System\n   Administrator, open each agent: under **Tools**, check that each connector tool uses **User\n   authentication**; in **Topics**, search HTTP request nodes and text for `http://`, explicit\n   ports, `Bearer`, `apikey`, `password` or connection strings.\n3. Alternative, read only: export the agent definitions from Dataverse (`bots` and\n   `botcomponents` tables) and search them, or run the Maester tests MT.1115, MT.1118 and MT.1119\n   (`Connect-Maester -Service Dataverse,Graph`).\n4. Fail if an agent uses author authentication for a tool reaching non-public data without a\n   documented exception, contains a credential, or calls HTTP in cleartext or on a non-standard\n   port.\n"
    },
    "remediation": {
      "manual": "1. Rotate every credential found in an agent, then replace it with an environment variable of\n   type secret (Azure Key Vault) or a connector connection.\n2. Ask agent owners to switch connector tools to **User authentication** and republish.\n3. Replace HTTP request nodes with connectors where possible; otherwise use HTTPS on port 443.\n4. In the data policy covering agent environments, block the **HTTP** connector, or configure\n   endpoint filtering to allow only approved `https://` endpoints. Role: Power Platform\n   Administrator.\n",
      "rollback": "Move the **HTTP** connector back to its previous group or remove the endpoint rules; restore the\nprevious tool authentication if a channel does not support user authentication.\n"
    },
    "references": [
      {
        "title": "Configure user authentication for tools",
        "url": "https://learn.microsoft.com/microsoft-copilot-studio/configure-enduser-authentication",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Configure data policies for agents",
        "url": "https://learn.microsoft.com/microsoft-copilot-studio/admin-data-loss-prevention",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester test MT.1118",
        "url": "https://maester.dev/docs/tests/MT.1118",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5(7)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-8",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1552.001"
      },
      {
        "framework": "mitre-attack",
        "id": "T1567"
      },
      {
        "framework": "mitre-attack",
        "id": "T1071.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-003",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-022",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-024",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}