Govern the lifecycle of Copilot Studio agents

Description

Every published Copilot Studio agent is reviewed at least every {{ agent_dormant_days }} days and meets these conditions:

• its owner is an enabled account; agents whose owner left are reassigned or unpublished;
• it was modified or explicitly re-approved within the last {{ agent_dormant_days }} days; dormant agents are updated, unpublished or deleted;
• each MCP server it uses is owned by the organization or a trusted partner, reached over HTTPS with authentication, and recorded as reviewed;
• email-sending tools, if any, use fixed or restricted recipients, not addresses or bodies chosen by the model from user input;
• agents with generative orchestration have custom instructions that state their purpose, their limits and how to handle attempts to override them.

Rationale

Agents accumulate permissions, connections and knowledge sources. Without an owner nobody fixes their configuration or answers for an incident; dormant agents keep running with outdated settings. MCP servers are third-party code the agent trusts: a compromised or poisoned server can instruct the agent to exfiltrate data. An agent that lets the model decide the recipient of an email is a ready-made exfiltration channel for prompt injection, and an agent with generative orchestration and no instructions relies entirely on default model behavior.

Impact

Agent owners must answer periodic reviews and may have to republish agents with new instructions or restricted tools. Unpublishing dormant or orphaned agents can break workflows that still use them: notify their users first.

Applies when

Requires: Microsoft Copilot Studio

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. For each environment, sign in to Copilot Studio (https://copilotstudio.microsoft.com) as an environment admin or System Administrator and list the published agents with their owner and last modification date. Check each owner in the Microsoft Entra admin center (Entra ID > Users) as a Global Reader.
2. Open each agent and check: Tools for MCP servers (compare with the list of reviewed servers) and email tools (recipient fixed or restricted); Overview > Instructions when generative orchestration is on.
3. Alternative, read only: query the Dataverse bots and botcomponents tables, or run the Maester tests MT.1116, MT.1117, MT.1120, MT.1121 and MT.1122 (Connect-Maester -Service Dataverse,Graph).
4. Fail if an agent has a disabled or deleted owner, was not modified or re-approved for more than {{ agent_dormant_days }} days, uses an MCP server not recorded as reviewed, sends email with model-chosen recipients or content, or uses generative orchestration without instructions.

Remediation

1. Reassign orphaned agents to an active owner (agent sharing as Editor, or the agent owner field in Dataverse), or unpublish and delete them. Role: environment admin or System Administrator.
2. Ask owners of dormant agents to update or re-approve them; unpublish the others.
3. Review each MCP server (owner, hosting, authentication, HTTPS); remove unreviewed ones, or replace them with custom connectors covered by data policies.
4. Restrict email tools to fixed recipients, or remove them; block the Office 365 Outlook send actions with advanced connector policies where agents must not send email.
5. Add custom instructions to agents with generative orchestration and republish.
6. Schedule the review every {{ agent_dormant_days }} days.

Rollback

Republish an agent from its previous version if a change breaks a legitimate workflow.

References

• Security and governance in Copilot Studio Microsoft, vendor-doc, accessed 2026-10-24
• Extend your agent with Model Context Protocol Microsoft, vendor-doc, accessed 2026-10-24
• Maester test MT.1122 Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-022 Require user authentication for Copilot Studio agents and limit how widely they are shared
• related CB-M365-POWER-023 Keep maker credentials, hard-coded secrets and cleartext HTTP out of Copilot Studio agents
• related CB-M365-TENANT-020 Restrict Copilot web search, agents and third-party AI providers
• related CB-M365-APPS-019 Govern AI agent identities (ownership, sponsors, credentials and privileges)

People and lifecycle