Copilot Studio Security Explained for agents

Key insights

• New Copilot Studio agents get a Microsoft Entra Agent ID automatically.
• The video contrasts end-user and maker credentials and warns against running agents as you.
• DLP policies and Advanced Connector Policies are both used to control connector access.
• The example architecture uses Logic Apps MCP to expose blocked connectors to only certain teams.

Sean Astrakhan of Untethered 365 recently published a video on Copilot Studio security that focuses on agent identities, connector controls, and the risk of letting an agent run under the wrong credentials. His main point is simple: if a Copilot Studio agent is not locked down, it can leak data or act with more access than it should. The walkthrough moves from basic identity choices to more advanced governance patterns.

What's new

The biggest change discussed in the material is Microsoft Entra Agent IDs for Copilot Studio agents. The notes say that since July 2026, Copilot Studio automatically creates a Microsoft Entra Agent ID for every new agent, and administrators can no longer disable that at the environment level. Microsoft describes these Agent IDs as service principals with an Agent subtype, which gives each agent a clearer identity in Microsoft Entra.

The video also covers Microsoft’s identity guidance for agents, including the idea that makers do not need to build a custom app registration flow or use long-lived secrets. Instead, Microsoft uses federated identity credentials for agent authentication. The material pairs that with Data Loss Prevention (DLP) and Advanced Connector Policies as the main tools for controlling what an agent can connect to.

Why it matters

This matters most for admins and makers who build or govern agents in Copilot Studio. If an agent runs under a person’s account, it can inherit access that is too broad, which is why the video warns against running agents as yourself. The material also distinguishes end-user credentials from maker credentials, which is important when you want the agent to act on behalf of a user without giving it full access to the maker’s data and permissions.

For organizations, the move from environment-level control to identity-based governance makes it easier to track individual agents and apply policies to them. The research notes say Agent IDs can support connector permission scoping, Conditional Access, role-based and attribute-based access control, access governance workflows, and centralized monitoring. Microsoft Agent 365 is also positioned as a control plane for observing and securing these agents.

For daily work, the practical value is tighter control over which connectors an agent can use and which teams can reach blocked services through a controlled path. That can reduce the risk of accidental exposure while still letting approved users work with the connections they need.

How it works

The material presents the security model in layers. At the identity layer, Copilot Studio provisions the agent identity needed to connect with services such as Teams, and the identity is tied to the agent rather than to the maker personally. At the policy layer, administrators use DLP to block or group connectors, then use Advanced Connector Policies for more specific allow-listing.

The video also describes a Logic Apps MCP architecture. Based on the source material, this pattern lets certain teams access connectors that have been blocked for everyone else. In other words, the connector is not opened broadly; instead, it is exposed through a controlled architecture that limits who can reach it.

• Copilot Studio creates an agent identity for new agents.
• Makers should not run agents under their own account.
• DLP can block or group connectors.
• Advanced Connector Policies can allow-list connectors more precisely.
• Logic Apps MCP can mediate access for specific teams.

The source also notes that Microsoft Agent 365 includes agent users for mailbox and Teams scenarios. Combined with the Copilot Studio and Power Platform documentation, the overall model is about authenticating the agent, then controlling where it can go and what it can touch.

Limitations and open questions

The material does not provide a full implementation walkthrough, so it is not clear exactly how each policy should be configured in a real tenant. It also does not say which licensing levels are required, whether these controls are available everywhere, or how they behave for older agents created before the Entra Agent ID change.

The video summary mentions pros and cons of service accounts versus agent identity, but the source material does not list those trade-offs in detail. The Logic Apps MCP pattern is also described at a high level, so readers would need the linked Microsoft documentation to verify the exact setup steps and prerequisites.

Finally, the source does not spell out the full boundary between Copilot Studio, Microsoft Entra, Microsoft Agent 365, and Power Platform admin controls. That makes the documentation especially important if you are planning a rollout or reviewing an existing agent estate.

Sources

• Sean Astrakhan video on Copilot Studio security
• Microsoft documentation on agent identities and authentication
• Microsoft documentation on Entra Agent IDs for Copilot Studio
• Microsoft Agent 365 identity documentation
• Microsoft documentation on Copilot Studio DLP
• Microsoft documentation on Advanced Connector Policies

Frequently asked questions

What is the main security message in the video?

Copilot Studio agents should not run with overly broad credentials. The video focuses on agent identities, DLP, and connector policies so agents do not leak data or inherit too much access.

What is a Microsoft Entra Agent ID?

The source material describes it as the identity Microsoft now gives to new Copilot Studio agents. The research notes say it is a service principal with an Agent subtype.

How are connectors controlled?

The material says admins can use DLP to block or group connectors, then use Advanced Connector Policies for more precise allow-listing. It also mentions a Logic Apps MCP pattern for limited access to blocked connectors.

Does the material explain licensing or rollout details?

No. It says new agents receive Entra Agent IDs automatically, but it does not explain licensing, tenant scope, or the full rollout behavior for older agents.