Copilot Studio Security and Governance: Microsoft Copilot Studio Security Risks and Controls

This part deserves credit rather than fear-selling. Microsoft documents a substantial control set for Copilot Studio, and the security and governance page on Microsoft Learn was last updated on August 8, 2026, so it reflects the current product rather than a 2024 snapshot. If you are running agents only inside Microsoft 365 and Power Platform, a well-configured tenant covers more than most buyers assume.

Read the middle column and the right column together. The native controls are strong at deciding what a maker is allowed to wire up. They are thinner on what happens in the seconds after an agent reads a document containing instructions. That is the honest shape of the gap, and it is the same shape in every agent platform we have looked at, including n8n security and LangChain security.

Capsule Security researchers named it ShareLeak. The chain is worth walking because it contains no exotic step, and because the agent behaved exactly as designed at every stage.

An attacker submits an external SharePoint form and puts a payload in a free-text field, the Comments box in the published demonstration. The submission triggers a Copilot Studio agent, which concatenates that untrusted input with its own system instructions. The payload overrides the legitimate instructions. The agent, now following attacker text, reads connected SharePoint Lists and sends sensitive customer data to an attacker-controlled email address. Capsule reported it on November 24, 2025, Microsoft deployed a patch on January 15, 2026, and the finding was publicly disclosed on April 15, 2026. Microsoft assigned CVSS 7.5, classified it as information disclosure, and stated that the mitigation was carried out internally with no further action required from users.

Three things about that are worth holding onto.

The entry point was a form, not a prompt. Nobody chatted with the agent. The injection arrived through a normal business process that a company deliberately exposed to the public, which is what makes this pattern durable. Capsule found the same technique against Salesforce Agentforce through a lead form, where the vendor characterized it as configuration-specific and pointed at human-in-the-loop controls. The researchers pushed back that requiring manual approvals undermines the purpose of autonomous agents. Both positions are defensible, which tells you the industry has not settled this.

The exfiltration path was a sanctioned connector. The agent emailed data because emailing was something the agent was allowed to do. No permission was bypassed. If the agent had held no outbound email capability, or if outbound email to an external domain had required an approval, the injection would have succeeded and the exfiltration would not.

Patching the path does not retire the class. Microsoft closed this instance. The underlying condition, that a large language model cannot reliably distinguish data it was given from instructions it was given, is unchanged. That is why the durable control is not a better filter but a narrower blast radius. We cover the general case in prompt injection detection.

The same month tells a second story one layer down. In May 2026 Microsoft published research on remote code execution in AI agent frameworks, including CVE-2026-25592 in the Semantic Kernel .NET SDK, fixed in 1.71.0, where a file-write method had been accidentally marked with a KernelFunction attribute and was therefore advertised to the model as a callable tool. Microsoft wrote that prompt injection "draws a thin line between being just a content security problem and becoming a code execution primitive." A single prompt was enough. The lesson generalizes past Microsoft: whatever you expose to the model, the model may call.

In the order we would actually do them, and weighted toward the things that reduce blast radius rather than the things that produce a report.

1. Keep the three secure defaults that the security scan watches. Authentication mode stays Authenticate with Microsoft. Connectors and flows stay on End user credentials rather than Maker-provided credentials, so an agent inherits the caller identity instead of the maker service account. Agents are not shared with everyone in the organization unless someone senior has signed that off in writing. These are the only three settings the automatic scan warns on, which is a strong hint about which ones Microsoft has seen go wrong.

2. Decide connector policy before makers need it. Use Power Platform data policies to split connectors into business and non-business groups, and to govern HTTP requests and triggers explicitly. An agent that can make arbitrary HTTP calls has an exfiltration channel that no content filter will reliably close.

3. Route makers into a controlled environment. Default environment routing exists so that a new maker lands somewhere with a policy attached rather than in a shared tenant-wide space. Use it, and keep production agents in an environment with a named owner.

4. Treat every external-facing input as hostile. Any agent triggered by a form, an inbound email, a ticket, a scraped page or a shared document is processing text an attacker can author. That is the ShareLeak precondition. For these agents specifically, cut the tool list to the minimum and remove outbound send capability unless the agent genuinely needs it.

5. Put an approval gate on the irreversible actions. Sending mail outside the tenant, deleting or overwriting records, issuing refunds, changing permissions. The number of these per agent is usually small, and gating them costs a few seconds against an outcome you cannot undo. Our page on human in the loop AI agents covers how to pick the gate list without stalling the agent.

6. Build the inventory before you need it. Which agents exist, who owns each, what each can reach, and when it last acted. Purview maker audit logs and the Copilot Hub give you part of this natively, and Agent 365 gives you more if you have onboarded it. Whatever the source, someone should be able to answer those four questions in minutes.

7. Keep an audit record the agent cannot edit. After an incident the question is always what the agent did, in what order, and on whose authority. A record written by the same system that took the action is worth less than one written to a store that the action path cannot reach. See AI agent monitoring for what a usable action record contains.

We would rather you buy the right thing than buy ours. Copilot Studio is a case where a lot of what you need is already in your Microsoft license, so here is the honest split.

If your entire agent estate is Copilot Studio and it will stay that way, configure the native controls properly and you have covered most of your exposure. Add a runtime layer when either of two things is true: agents are acting on content that people outside your company can author, or your estate has stopped being one vendor. The second condition arrives sooner than most teams plan for, usually the first time a developer ships something on OpenAI agents or Claude agents next to the Copilot Studio fleet.

The clean tenant story holds while everything an agent touches is a first-party Microsoft service under one identity model. It stops holding the moment an agent calls a custom connector into a billing system, an HTTP endpoint at a partner, or an MCP server someone in engineering stood up. At that point three things change.

The identity gets fuzzier. Inside Microsoft 365, End user credentials mean the agent acts as the person. Across a custom connector, it usually acts as a shared service principal or an API key, and the audit trail on the far side records one caller for every user. Give agents their own scoped credentials rather than a shared one, and keep them short-lived, which is the argument we make in full on AI agent identity.

The policy gets split. Power Platform data policies decide whether a connector may be used. They do not decide which record an agent may write on the other side of it, or how many times, or at what hour. Those decisions have to live somewhere on the call path.

The evidence gets scattered. Purview holds the maker and agent activity Microsoft can see. The far system holds its own log under a service account name. Reconstructing what happened means correlating two records that were never designed to be joined. A single action record covering every call an agent makes, whichever side of the tenant boundary it lands on, is the difference between a one-hour answer and a one-week one.

None of this argues against Copilot Studio. It is a good product for the job it does, and for a lot of internal agents the native controls are genuinely enough. It argues for being clear about where the tenant boundary is, and putting the enforcement point where the actions actually happen. If you want the general version of that argument rather than the Microsoft-specific one, it is on AI runtime security, and the vendor landscape around it is mapped on our AI agent security alternatives hub.