Checklist

Microsoft Copilot exposure:
twelve checks worth doing.

Practical checks for a Copilot Studio and Microsoft 365 Agent Builder estate, in the order we run them. Each one includes what it typically turns up, measured from real assessments rather than imagined.

Book a free 30-minute session

You can run every one of these by hand through the Power Platform admin centre and Graph. It takes a competent administrator several days for a mid-sized tenant, and it goes stale the moment somebody builds another agent. The value of the checklist is knowing what to ask - whether you automate it is a separate decision.

The twelve

Count the agents in every environment, including drafts

Copilot Studio agents live per environment, and most tenants have environments nobody remembers creating. Drafts count: a draft with a live connector reaches production data exactly like a published one.

The first assessment we ran returned 625 agents across 16 environments at an organisation expecting a handful.

Establish which agents were built in-tenant versus shipped by Microsoft

Vendor templates and in-tenant builds carry different risk. A template you never customised is Microsoft's design decision; an agent someone built on a Friday afternoon is yours.

327 of 625 were built in-tenant. 298 were vendor templates or replicas.

Record who is accountable - business, technical and security - for each one

Not the creator. The creator changes team. Accountability means a named person who answers for the agent's behaviour today, and it is a different question from who clicked Create.

Every agent we have assessed had at least one of the three roles unfilled.

Write down what each agent is for, and have someone sign it

Without a recorded purpose, no behaviour can be judged out of scope. Drift becomes undetectable by construction, and every framework that asks about intended purpose - EU AI Act, ISO 42001 - assumes this field exists.

Zero of 625 had one. No platform asks for it.

List every connector operation each agent can invoke, not just the connectors

A connector tells you the agent touches Dataverse. The operation tells you whether it reads or writes. That distinction decides whether an agent is a data source or a data sink, and it is where most classification errors happen.

One agent read as high-risk until the evidence showed its only operation was CreateWorksheet - a write, not a read.

Check whether each operation runs as the caller or as the builder

An operation configured to run on the maker's connection acts with the builder's access for every caller. Nothing in the audit trail on the far side distinguishes them.

A demo agent reached a production content API on its builder's credentials, with no consent step and nobody accountable.

Identify which agents are published to programmatic channels

Teams is one thing. Direct Line is a programmatic channel - anything holding the secret can reach the agent without a Teams identity. Combined with an inbound mailbox, it means an attacker can put content in front of your agent directly.

294 of 625 agents were on Direct Line.

Find which agents have web search or public sites as knowledge

Both pull content nobody vetted into the agent's context. That is not dangerous alone. It becomes dangerous the moment the same agent can also read private data and send externally.

168 had web search enabled; 70 had a public site as a knowledge source.

Determine which agents hold a directory machine identity

An agent without one cannot have its access traced back to a credential. Anything it does appears in downstream logs as something else.

274 of 625 had no Entra machine identity.

Record the foundation model per agent, and whether its version can be pinned

"Copilot Studio default" is a platform name, not a version. The model behind it changes when Microsoft changes it, with nothing to compare against.

79% of one estate ran on a model with no pinnable version.

Separate deployment replicas from genuine duplicates before reporting a count

One agent promoted across four environments is four records and one governance decision. Reporting the raw count inflates the problem and sends people to fix a release pipeline.

298 replicas versus 33 genuine copies in the same estate.

Decide what happens to an agent whose owner leaves

Agents outlive their creators. Without a review trigger tied to the joiner-mover-leaver process, an agent keeps running under a service principal with nobody watching it.

The most common shape of a genuinely abandoned agent.

Three checks people skip, and shouldn't

Drafts

A draft agent with a live connector reads production data exactly like a published one. Most inventories filter drafts out on the assumption that unpublished means inert. It does not.

Environments nobody owns

Trial environments, old sandboxes, environments created for a project that finished. They keep their connectors, and the agents inside them keep running.

The combination, not the item

None of these findings is alarming on its own. An agent with web search is fine. An agent that can send mail is fine. The same agent with both, plus access to private data, is an exfiltration path - and no individual check catches it.

Figures are from connected tenants, used with permission and anonymised. Your estate will differ.

Have all twelve answered by tomorrow.