Key concepts - Copilot Studio security and governance
Copilot Studio follows a number of security and governance controls and processes, including geographic data residency, data loss prevention (DLP), multiple standards certifications, regulatory compliance, environment routing, and regional customization. See the Geographic data residency in Copilot Studio article for information and details on how data is handled in Copilot Studio.
This article provides an overview of the security practices followed by Copilot Studio, a list of security and governance controls and features, and examples and suggestions for employing safety and security within Copilot Studio for your agent makers and users.
Security and governance controls
| Control | Core scenario | Related content |
|---|---|---|
| DLP controls | Admins can use DLP policies in the Power Platform admin center to govern the use and availability of Copilot Studio features and agent capabilities, including:
|
Configure data loss prevention policies for copilots |
| Makers audit logs in Microsoft Purview for admins | Admins have full visibility into maker audit logs in Microsoft Purview. | View audit logs |
| Audit logs in Microsoft Sentinel for admins | Admins can monitor and receive alerts on agent activities through Microsoft Sentinel. | View audit logs |
| Run connectors and flows with user credentials | Agent makers can configure connectors and flows to use the user’s credentials by default. | Use actions with custom copilots (preview) |
| Sensitivity label for Knowledge with SharePoint | Agent makers and users can see the highest sensitivity label applied to sources used in the agent's response and individual reference labels in the chat. | View sensitivity labels for Sharepoint data sources |
| User authentication with certificates | Admins and makers can configure agents to use Entra ID manual authentication with certificate provider. | Configure user authentication |
| Maker security warning | Makers can see security alerts for their agent before publishing it when security and governance default configurations are modified. | Automatic security scan in Copilot Studio |
| Environment routing | Admins can configure environment routing to provide their makers a safe space to build agents. | Work with Power Platform environments |
| Maker welcome message | Admins can configure a maker welcome message to inform makers about important privacy and compliance requirements. | Work with Power Platform environments |
| Autonomous agents governance with DLP | Admins can manage agent capabilities with triggers using DLP policies, ensuring protection against data exfiltration and other risks. | Data loss prevention example - Block event triggers in agents |
Security Development Lifecycle
Copilot Studio follows the Security Development Lifecycle (SDL). The SDL is a set of strict practices that support security assurance and compliance requirements. Learn more at Microsoft Security Development Lifecycle Practices.
Data processing and license agreements
The Copilot Studio service is governed by your commercial license agreements, including the Microsoft Product Terms and the Data Protection Addendum. For the location of data processing, refer to the geographical availability documentation.
Compliance with standards and practices
The Microsoft Trust Center is the primary resource for Power Platform compliance information.
Learn more at Copilot Studio compliance offerings.
Data loss prevention and governance
Copilot Studio has an extensive set of Data Loss Prevention features to help you manage the security of your data, along with Power Platform policies.
Additionally, to further govern and secure Copilot Studio using generative AI features in your organization, you can:
Disable agent publishing:
- Your admin can use the Power Platform admin center to turn off the ability to publish agents that use generative AI features for your tenant.
- Your admin can use the Power Platform admin center to turn off the ability to publish agents that use generative AI features for your tenant.
Disable data movement across geographic locations for Copilot Studio generative AI features outside the United States.
Finally, Copilot Studio supports securely accessing customer data using Customer Lockbox.