Copilot Agents Security Checklist for Regulated Industries

Security reviews for Microsoft 365 Copilot and Copilot Studio agents keep stalling on the same question: “show me the control.” The platform now has the controls, but they are spread across five admin centers, three license tiers and a steady stream of previews. This guide is the checklist I hand to security and compliance teams in finance, healthcare, energy and the public sector before a Copilot or agent pilot gets a green light. Every item is one line of what to check, followed by why it matters and where to find it, and every setting, limit and license statement comes from Microsoft Learn pages I verified while writing this.

How to use this checklist

The 46 items below are grouped into seven domains. Work through them in order the first time; after that, the summary table and the regulatory mapping are what you will come back to. Three things to keep in mind:

• It is a technical checklist, not legal advice. The regulatory section maps controls to the concerns auditors typically raise and cites Microsoft’s own compliance documentation. Your counsel and compliance officer decide what is sufficient.
• Licensing matters. Microsoft 365 E3 unlocks the foundation, E5 adds the Purview and Entra depth, and agent-identity controls need Microsoft Agent 365 or Microsoft 365 E7. Each item names the tier it depends on where Microsoft documents it.
• Agents change the threat model. If you have not read it yet, start with our Microsoft Project Lobster and ClawPilot enterprise security guide, which explains why prompt injection becomes action injection once an agent can write to mail, calendars and files. This checklist is the control set for that risk.

Where the controls live: admin centers and licenses

Domain 1: Identity and access

1. Every Copilot user is behind MFA and a baseline Conditional Access policy before a license is assigned. Microsoft’s Zero Trust guidance for Copilot starts with the common policies: require MFA for administrators and all users and block legacy authentication (Entra ID P1, included in E3), then add sign-in-risk and user-risk policies with P2. Microsoft Entra admin center > Conditional Access.

2. You can list every agent identity in the tenant. Since May 2026 Copilot Studio creates a Microsoft Entra Agent ID for each new agent under a blueprint named Microsoft Copilot Studio agent identity blueprint, and the connectors an agent uses appear as API permissions on that identity. Agents created before May 2026 still use app registrations until migrated. Microsoft Entra admin center > Agent identities. For the architecture behind blueprints, agent identities and agent user accounts, see our Entra Agent ID GA deep dive.

3. Conditional Access targets agent identities, agent user accounts and blueprints, not only humans. Conditional Access for agents requires Microsoft 365 E7, or a Microsoft Agent 365 license paired with Entra ID P1 or Microsoft 365 E3. A policy scoped to users does not apply to agent user accounts, and a policy on an agent identity does not cover its agent user account, so build one policy per access pattern and start in report-only mode. Conditional Access > Assignments > Users, agents, or workload identities.

4. Each agent has a named human sponsor or owner, and sponsorship transfers when that person leaves. Entra ID Governance for agent identities moves sponsorship to the sponsor’s manager automatically and lets agents receive access packages with expiry dates. In the Microsoft 365 admin center > Agents > Overview, the Agents without owners card and the rule Reassign ownerless agents created with Agent Builder to manager close the same gap for low-code agents.

5. Admin roles for agent approval and Copilot DLP follow least privilege. Approving agent requests and assigning ownership can only be done by the AI Administrator or Global Administrator roles, according to the agent management overview. Purview’s Data Security AI Admin role can edit Copilot DLP policies without the ability to read prompts and responses. Keep Global Administrator out of day-to-day agent operations.

6. Copilot Studio agents cannot be published without authentication. Makers can select No authentication so anyone with the link can chat. A Power Platform data policy that blocks the connector Chat without Microsoft Entra ID authentication in Copilot Studio removes that option tenant-wide, per Configure data policies for agents. Power Platform admin center > Security > Data and privacy > Data policy.

7. Tools run with end-user credentials unless an exception is documented. Each Copilot Studio tool has an Authentication setting of End user or Maker-provided; the default is the user’s own credentials, which keeps every tool call inside the user’s existing permissions (Add tools to custom agents). Maker-provided credentials make the agent act with the maker’s access for every user, so treat each one as a service account with an owner and a review date.

Domain 2: Data protection

8. Sensitivity labels are enabled for SharePoint and OneDrive files, and the encryption rules are understood. Copilot and agents return encrypted content only when the user holds both the VIEW and EXTRACT usage rights, and when labels are not enabled for SharePoint and OneDrive, encrypted files Copilot can reach are limited to data in use in Office on Windows (Purview protections for generative AI apps). Purview portal > Information Protection.

9. A DLP policy on the Microsoft 365 Copilot and Copilot Chat location keeps your top-tier labels out of Copilot responses. The Copilot DLP location is available only in the Custom template. Its Content contains > Sensitivity labels condition stops Copilot from processing the item, although the item may still appear in citations; it covers emails sent on or after January 1, 2025, is evaluated at file open in Word, Excel and PowerPoint, and updates take up to four hours to apply. The same policy restricts Copilot Studio agents in Teams, SharePoint and Microsoft 365 Copilot that use SharePoint as a knowledge source.

10. Prompts containing regulated identifiers are blocked, or at least kept off the web. In the same location, the Content contains > Sensitive information types condition can Prevent Copilot from processing content > Processing prompts (in preview) or > Performing Web Searches. Label and sensitive-information-type conditions cannot share one rule, DLP cannot inspect files uploaded into a prompt, and the location does not support admin units.

11. Oversharing has been measured, not assumed. Run the Content Management Assessment from SharePoint admin center > Advanced Management > Start assessment and rerun it every 30 days (Get ready for Copilot with SharePoint Advanced Management). DSPM for AI runs a default data risk assessment every week across the top 100 SharePoint sites by usage with no setup.

12. High-risk sites are hidden from Copilot with Restricted Content Discovery while permissions are fixed. Restricted Content Discovery is a site-level setting that removes a site from Copilot responses and organization-wide search without changing permissions. Turn it on from Active sites > site > Settings > Restrict content from Microsoft Copilot or with the cmdlet below. Sites with more than 500,000 items can take over a week to propagate, and changes are written to the Purview audit log.

Set-SPOSite -Identity https://contoso.sharepoint.com/sites/Finance -RestrictContentOrgWideSearch $true
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/Finance | Select RestrictContentOrgWideSearch
Start-SPORestrictedContentDiscoverabilityReport

13. Nobody is planning a new rollout on Restricted SharePoint Search. Microsoft is retiring Restricted SharePoint Search and blocks new enablement from July 31, 2026. It was always a 100-site allow list and, in Microsoft’s words, not a security boundary.

14. Business-critical sites use Restricted Access Control and tenant sharing defaults are tightened. Microsoft’s secure and governed foundation guide recommends enforcing Restricted Access Control for critical sites at provisioning, disabling Anyone links and company-wide sharing groups, and requiring site sensitivity labels. SharePoint admin center > Policies > Access control > Enable site access restriction.

15. Risky AI usage is detected, not just logged (E5). The Insider Risk Management Risky AI usage template detects prompt-injection attempts and access to protected material, and Endpoint DLP can block users from pasting sensitive data into third-party AI sites in a browser. Both are one-click recommendations inside DSPM for AI.

Domain 3: Agent governance

16. Agent access is scoped to a pilot group before anyone else. Microsoft 365 admin center > Agents > Settings > User access offers All users (the default), No users or Specific users or groups (Agent settings).

17. External-publisher agents and plugins are off until each is vetted. Agents > Settings > Agent and plugin access has three switches: built by Microsoft, built by your organization and built by external publishers. Plugins here include MCP servers, connectors and skills.

18. Org-wide publishing goes through the approval queue. Agents that makers submit for the organization go through admin approval before users see them, and you review them under Agents > All agents > Requests (Manage agents in the Microsoft 365 admin center). An agent management rule can reject publish requests older than a number of days you choose.

19. Agent Builder sharing is restricted. Agents > Settings > Sharing limits broad sharing to All users, No users or Specific users; the control applies only to agents built with Copilot Agent Builder, so Copilot Studio sharing is governed separately (item 22).

20. The agent registry is reviewed monthly for ownerless, unused and at-risk agents. The registry lists name, creator, creation date, host products and availability, and the Agents at risk card aggregates high-severity findings from Entra, Defender and Purview. The rule Block ownerless agents without usage handles the long tail. Inventory and usage data for third-party agents require Microsoft Agent 365, generally available since May 1, 2026 on a per-user basis and included in Microsoft 365 E7.

21. Copilot Studio makers build in Managed Environments with environment routing. Managed Environments are an entitlement of standalone Copilot Studio licenses and add sharing limits, usage insights, pipelines, IP firewall and customer-managed keys. Environment routing gives makers a personal developer environment instead of the default one. Because the Bot Transcript Viewer role is held only by admins by default and applies to every agent in an environment, use dedicated environments for agents that handle regulated data.

22. Agent sharing limits are set per environment. Power Platform admin center > Manage > Environments > Edit Managed Environments > Manage sharing controls whether makers can grant Editor or Viewer access, whether security groups are allowed, and the maximum number of viewers per agent (Limit sharing). Rules take up to an hour to enforce and do not revoke existing access.

23. One tenant-wide Power Platform data policy governs connectors, HTTP calls, channels and triggers. Classify connectors as Business, Non-business or Blocked; block the HTTP connector or use endpoint filtering; block publishing channels you do not support (Direct Line, WhatsApp, Facebook, Omnichannel, SharePoint, Teams and Microsoft 365); and block the Microsoft Copilot Studio connector to stop event triggers. Enforcement has applied to all tenants since early 2025 with no exemptions, and blocking a Power Platform connector also blocks tools from MCP servers that depend on it.

24. Policy templates are applied to agents in bulk. Agents > Settings > Agent management rules > Add rule > Apply template pushes a preset security template to every agent instance that has an agent identity. It is a one-time bulk operation, so schedule it after each review cycle.

Domain 4: Monitoring and audit

25. Purview Audit is on and you know your retention tier. Audit (Standard) is on by default and keeps records for 180 days; Audit (Premium) in E5 keeps Entra, Exchange, SharePoint and OneDrive records for one year and supports retention policies up to ten years with the add-on license. Copilot Studio agents are included in Audit (Standard); audit for non-Microsoft AI apps is pay-as-you-go.

26. You can find CopilotInteraction records and read the fields that matter. Per Audit logs for Copilot and AI applications, each record carries AccessedResources (with the sensitivity label ID and any DLP policy that blocked access), AgentId and AgentName, XPIADetected for cross-prompt injection, JailbreakDetected, AISystemPlugin.Id = BingWebSearch when the web was used, and ModelProvider and ModelName when a user picks a model. Purview portal > Audit.

27. Alerts fire on Copilot Studio maker events that change risk. Copilot Studio logs maker activities to Purview, including BotCreate, BotUpdateOperation-BotPublish, BotUpdateOperation-BotShare and BotUpdateOperation-BotAuthUpdate. The audit record holds the transcript thread ID, not the text; DSPM for AI retrieves the text. Microsoft lists “your tenant isn’t a FedRAMP tenant” as a prerequisite for this logging, so confirm coverage with your account team in GCC High.

28. DSPM for AI is the daily view, and prompt text is restricted to the right role. Activity explorer shows prompts, responses, sensitive information types, referenced files and the exact web queries Copilot sent; reading prompt text requires membership in the Content Explorer Content Viewer role group. Purview portal > Solutions > DSPM for AI.

29. Audit data reaches your SIEM. Export through the Office 365 Management Activity API for retention beyond 180 days, and connect Copilot Studio audit logs to Microsoft Sentinel for alerting, as described in Copilot Studio security and governance.

30. Communication Compliance covers AI interactions where conduct rules apply (E5). The DSPM one-click policy Unethical behavior in AI apps creates a Communication Compliance policy over prompts and responses, which is the review channel supervision teams already use.

31. Agent sign-ins are in the Entra sign-in logs and risky agents surface in Identity Protection. Authentication by agents with an Entra Agent ID is logged in Microsoft Entra ID, and Conditional Access can act on agent risk from Identity Protection.

Domain 5: Data residency, retention and eDiscovery

32. You can state where prompts and responses are processed and stored. Microsoft’s Copilot data, privacy and security page says Copilot became a covered workload in the data residency commitments on March 1, 2024, that Advanced Data Residency and Multi-Geo include Copilot, that EU customers are inside the EU Data Boundary, and that customers outside the EU may have queries processed in the US, EU or other regions. LLM calls go to the closest region but can use other regions under high utilization, and Anthropic models are currently excluded from the EU Data Boundary. Copilot Studio stores agent data in the environment’s region, with an admin setting that controls data movement across geographies for generative AI features (Geographic data residency in Copilot Studio).

33. A retention policy exists for the Microsoft Copilot experiences location. Retention for Copilot and AI apps covers Microsoft 365 Copilot, Copilot Studio, Security Copilot and Copilot in Fabric. Data lives in a hidden folder of the user’s Exchange mailbox, the timer job runs every one to seven days, holds take precedence over deletion, and a departing user’s interactions move to an inactive mailbox. If policy says the text must not be kept, a zero-day delete policy is the documented approach. Purview portal > Data Lifecycle Management > Retention policies.

34. Legal can search, hold, export and, when needed, purge Copilot interactions. eDiscovery for AI application data uses the Copilot activity condition or item classes such as IPM.SkypeTeams.Message.Copilot.* and IPM.SkypeTeams.Message.Copilot.Studio.*. Spillage cleanup purges up to 10 items per mailbox through the Graph purgeData action and needs the Search And Purge role; GCC High and DoD use PowerShell because Graph Explorer is unavailable there.

35. Customer Lockbox is on (E5, G5). Customer Lockbox covers Exchange Online, SharePoint, OneDrive, Teams and Windows 365, and all Microsoft 365 Copilot interactions through Exchange. Requests expire after 12 hours, engineer access is capped at four hours, and approvals are logged as Set-AccessToCustomerDataRequest. Microsoft 365 admin center > Settings > Org settings > Security & privacy > Customer Lockbox > Require approval for all data access requests. Copilot Studio supports Lockbox for Power Platform, but its security audit telemetry and Agent 365 governance events are excluded.

36. Government cloud gaps are documented before a capability is promised. The Copilot service description shows Power Platform connectors unavailable in GCC High and DoD, GCC High limited to declarative agents built with Agent Builder or published through admin controls, Insider Risk Management unavailable in GCC High, and web grounding off by default in every government cloud.

Domain 6: Human-in-the-loop and change control

37. Tools that change data ask the user before running. Each Copilot Studio tool has an Ask the end user before running option, set to No by default. Turn it on for anything that sends, writes, deletes or pays.

38. Autonomous triggers are blocked until an owner, a runbook and monitoring exist. Blocking the Microsoft Copilot Studio connector in a data policy prevents makers from adding event triggers and from running automated evaluations with authenticated accounts. Lift it per environment once the agent has passed review.

39. Agents move from development to test to production through pipelines or Git, not by editing production. Managed Environments include pipelines, and Copilot Studio supports GitHub-backed source control and deploy-from-Git with auditable deployment history. The Agent viewer sharing role lets evaluators run test sets, and the Analytics viewer role gives stakeholders metrics, without either group being able to edit the agent (Share agents with other users).

40. Pre-publish security findings are resolved, not dismissed. Copilot Studio runs an automatic security scan with real-time risk findings while makers configure knowledge, tools and actions, and warns makers when default security settings have been modified before publishing.

41. Decommissioning is defined. Deleting an agent in Copilot Studio deletes its Entra Agent ID; agent management rules block ownerless unused agents and reject stale publish requests; and archived SharePoint sites are out of Copilot’s reach until reactivated.

Domain 7: Vendor, model and grounding governance

42. The web search decision is made in Cloud Policy, not left to defaults. The Allow web search in Copilot policy in the Cloud Policy service for Microsoft 365 has three options, including disabling web search in work mode only. Generated Bing queries are sent with user and tenant identifiers removed and are not used to train models, but Microsoft states that the DPA, HIPAA compliance and the EU Data Boundary do not apply to them. The web search terms Copilot used are logged for audit and eDiscovery.

43. Model-provider choices are deliberate and auditable. Admins decide whether Anthropic and OpenAI models power Copilot experiences, additional terms may apply, and audit records include the provider and model name when a user picks one rather than Auto. Prompts and responses are not used to train foundation models, and Copilot has opted out of Azure OpenAI abuse monitoring, which includes human review.

44. Third-party agents and connectors are reviewed like any SaaS vendor. The Integrated apps page shows each agent’s required permissions, terms of use and privacy statement, and Microsoft’s own warning is that data processed by non-Microsoft services is not subject to Microsoft agreements. Copilot connector data is only returned to users who already have access, and external connections are not enabled by default in government clouds.

45. Knowledge sources are allow-listed. Power Platform data policies support endpoint filtering for SharePoint sites and public websites configured as knowledge sources, connector dependency insights show what each agent touches, and agents display the highest sensitivity label of the SharePoint content they used in each response.

46. Compliance evidence comes from the Service Trust Portal and Compliance Manager. Microsoft publishes a Copilot and Copilot Chat Risk Assessment Quickstart on the Service Trust Portal, lists ISO 42001 among Copilot’s certifications, and ships Compliance Manager assessment templates for HIPAA, FedRAMP, SEC 17a-4 and AI regulations.

Mapping the checklist to US regulatory concerns

The table pairs the concern a reviewer usually raises with the checklist items that address it and the Microsoft documentation that supports the claim. It is a starting point for your own control mapping, not a determination of compliance.

First 30 days: a rollout sequence

Two scheduling notes from running this sequence: Restricted Content Discovery is the long pole, because Microsoft documents that sites with more than 500,000 items can take over a week to propagate, so turn it on in week one rather than week two if your assessment flags a large site. And keep Copilot DLP policies in simulation for at least 24 hours before enforcing, since DSPM for AI needs that long to show the first results.

What to do about it

1. Print this checklist, assign an owner to each of the seven domains, and record the license tier you hold for each row of the summary table.
2. Export the agent registry and the Entra agent identities list this week, and reconcile the two; anything in one list and not the other is your first finding.
3. Create the Copilot DLP policy in simulation mode with your top two sensitivity labels and your regulated identifier types, then review DSPM for AI after 24 hours before you enforce it.
4. Put every site flagged by the Content Management Assessment behind Restricted Content Discovery, and open site access reviews so owners fix permissions rather than relying on the interim control.
5. Publish one tenant-wide Power Platform data policy that requires authentication, blocks HTTP or filters endpoints, blocks unused channels and blocks triggers, and communicate it to makers before it bites.
6. Create the Microsoft Copilot experiences retention policy and run a test eDiscovery search for IPM.SkypeTeams.Message.Copilot.* so legal has seen the data before they need it.
7. Decide the web search policy and the model-provider setting in writing, with the HIPAA and EU Data Boundary caveats attached, and have compliance sign the decision.
8. If you hold Microsoft Agent 365 or E7, build the agent Conditional Access policies in report-only mode now so you have 30 days of impact data before enforcement.
9. Schedule the 30-day reassessment and the monthly registry review before the pilot starts, not after.

Want the 20 controls a security reviewer checks first on printable pages, each with its admin center location? Download the free PDF edition of this checklist.

Frequently asked questions

Does Microsoft 365 Copilot use our prompts to train AI models? No. Microsoft’s data, privacy and security documentation states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation LLMs. Prompts and responses are stored in the user’s Exchange mailbox under the same contractual commitments as other Microsoft 365 content, and Copilot has opted out of Azure OpenAI abuse monitoring human review. The exception to keep in mind is web search: generated Bing queries are sent with user and tenant identifiers removed, but they are not covered by the DPA, HIPAA or the EU Data Boundary.

Can we stop Copilot and agents from reading specific SharePoint sites or labeled files? Yes, with two different controls. Restricted Content Discovery is a site-level setting in the SharePoint admin center that keeps a site out of Copilot responses and organization-wide search without changing permissions; it needs a Copilot license and SharePoint Advanced Management. A Purview DLP policy on the Microsoft 365 Copilot and Copilot Chat location can prevent Copilot from processing files and emails that carry a sensitivity label you choose. Microsoft positions both as interim protections while you fix the underlying permissions.

Is Microsoft 365 Copilot available for US public sector tenants in GCC and GCC High? Yes. Microsoft’s service description lists Copilot features for GCC, GCC High and DoD with some gaps, such as Power Platform connectors being unavailable in GCC High and DoD, and web grounding being turned off by default in all government clouds. Microsoft’s FedRAMP page lists Microsoft Copilot as an in-scope service for GCC, GCC High and DoD under the Office 365 US Government authorizations. Check the service description for the exact feature list before committing to a capability.

Do Copilot Studio agents get their own identity in Microsoft Entra? Yes. Since May 2026 Copilot Studio automatically creates a Microsoft Entra Agent ID for each new agent, and the agent’s connector permissions appear as API permissions on that identity. You can view the identities and their sign-in activity in the Microsoft Entra admin center. Applying Conditional Access to agent identities requires either Microsoft 365 E7 or a Microsoft Agent 365 license paired with Entra ID P1 or Microsoft 365 E3.

How long are Copilot interactions kept, and can legal put them on hold? By default there is no deletion schedule; you set one with a Purview retention policy on the Microsoft Copilot experiences location, which covers Microsoft 365 Copilot, Copilot Studio, Security Copilot and Copilot in Fabric. Because the data lives in a hidden folder of the user’s Exchange mailbox, eDiscovery can search it with the Copilot activity condition, hold it, export it, and purge up to 10 items per mailbox in a spillage event. Audit records of the interactions are kept for 180 days with Audit (Standard) and up to one year, or ten with an add-on, with Audit (Premium).

If Copilot Studio is one of several agent platforms on your shortlist, our AI agent platform comparison puts its governance model next to Microsoft Foundry Agent Service, OpenClaw and custom-built agents.

Need a second pair of hands? Big Hat Group provides AI automation consulting for organizations in the United States and Canada, from a two-week Copilot and agent security review against this checklist to a governed Copilot Studio rollout. Book a discovery call to talk through your environment.

Sources

• Data, Privacy, and Security for Microsoft Copilot
• Data, privacy, and security for web search in Microsoft Copilot
• Microsoft Purview DLP for Microsoft 365 Copilot and Cowork
• Microsoft Purview data security and compliance protections for generative AI apps
• Use Microsoft Purview to manage data security and compliance for Microsoft Copilot Studio
• Data Security Posture Management for AI
• Restrict discovery of SharePoint sites and content
• Restricted SharePoint Search
• Get ready for Microsoft Copilot with SharePoint Advanced Management
• Configure a secure and governed foundation for Microsoft Copilot
• How do I apply Zero Trust principles to Microsoft Copilot?
• Copilot controls overview
• Manage agents in the Microsoft 365 admin center
• Agent settings in Microsoft 365 admin center
• Agent overview in Microsoft 365 admin center
• Microsoft Agent 365 overview
• What are agent identities? (Microsoft Entra Agent ID)
• Conditional Access for agents in Microsoft Entra
• Governing agent identities with Microsoft Entra ID Governance
• Manage Entra Agent IDs in Copilot Studio
• Copilot Studio security and governance
• Configure data policies for agents in Copilot Studio
• Share agents with other users in Copilot Studio
• Add tools to custom agents in Copilot Studio
• View Copilot Studio audit logs in Purview
• Geographic data residency in Copilot Studio
• Managed Environments overview
• Limit sharing in Managed Environments
• Audit logs for Copilot and AI applications
• Learn about auditing solutions in Microsoft Purview
• Learn about retention for Copilot and AI apps
• Search for and delete AI application data in eDiscovery
• Customer Lockbox requests
• Microsoft Copilot service description
• HIPAA and HITECH Act compliance offering
• SEC Rule 17a-4, FINRA 4511 and CFTC 1.31 compliance offering
• NERC compliance offering for Azure
• FedRAMP compliance offering