Before you launch a Copilot Studio agent — five security checks for Australian SMBs

You’re about to hit Publish on your first Copilot Studio agent. It answers FAQs, pulls from SharePoint, maybe chats on your website. Useful — and easy to leave wide open if you skip the boring bits.

I help Australian SMBs get secure and put AI to work without the big-firm theatre. Here’s the pre-launch checklist I actually run before anything customer-facing goes live. Not legal advice. UI labels move; verify against Microsoft Learn on the day you publish.

What is a Copilot Studio agent?

Copilot Studio is Microsoft’s low-code studio for AI agents: instructions, knowledge, tools, and channels. Power Virtual Agents was folded into it in late 2023. Same family as Power Platform — which means the same admin levers (environments, DLP, Entra) decide whether that helpful bot becomes a quiet data leak.

Why pause before Publish

Out of the box, an agent can chat without sign-in, read whatever knowledge you pointed it at, call connectors, and sit on a public channel. Microsoft will warn you. Most teams still hit Publish first and read the banner later. Don’t.

Check 1 — Require sign-in

Why it matters: “No authentication” means anyone with the link can talk to the agent. If knowledge or tools sit behind that chat, you’ve published an open door.

Do this: Settings → Security → Authentication — not “No authentication”. Prefer Microsoft / Entra ID. Save, then republish. In Power Platform DLP, block Chat without Microsoft Entra ID authentication in Copilot Studio where you can.

Fail mode: A demo left anonymous, still pointed at internal SharePoint.

Check 2 — Power Platform data policies before you publish

Why it matters: DLP is the main guardrail. It classifies and blocks connectors, knowledge sources, HTTP, channels, and triggers. Exemptions for Copilot Studio DLP are gone — plan for that.

Do this: Put a data policy on the agent’s environment. Block unauthenticated chat, unused channels, open HTTP, and skills/triggers you don’t need. Try a publish and fix any violation banner before go-live.

Fail mode: No Copilot Studio–aware policy on the Default environment; risky connectors sitting in Business.

Check 3 — Least privilege on knowledge and tool credentials

Why it matters: The agent only knows what you feed it — and it will cheerfully surface overshared SharePoint. Tools that run as the maker inherit the maker’s access.

Do this: Inventory knowledge sources. Fix ACLs and sensitivity labels first. Prefer user / on-behalf-of connections over maker-identity tools. Keep Entra scopes tight.

Fail mode: Company-wide SharePoint read, or prod tools running as the builder’s account.

Check 4 — Don’t build production in the shared Default environment

Why it matters: Default is shared across the tenant. Your first “quick” agent becomes de-facto prod with loose connectors and no promotion path.

Do this: Dev → Test → Prod (or at least a dedicated env). Gate Environment Maker via Entra groups. For Australian tenants, review data residency and generative AI cross-region settings before you turn things on.

Fail mode: Customer-facing agent living in Default forever.

Check 5 — Logging and clear the security warnings

Why it matters: When something goes wrong, you need who published, who changed auth, and what the maker scan already flagged.

Do this: Confirm Purview Audit covers Copilot Studio activities. Know the difference between transcript text and metadata. Remediating security warnings before Publish is not optional theatre — clear the banner.

Fail mode: Publish with unresolved warnings; no audit trail after an incident.

Australian privacy overlay (light)

The OAIC’s guidance on commercially available AI products (updated January 2025) pushes due diligence, clear AI identification for chatbots, and APP-aligned handling where the Privacy Act applies. Not every SMB is an APP entity — check your coverage. This is framing, not a config checklist and not legal advice.

Quick pre-launch checklist

• Authentication required (not anonymous)
• DLP policy on the agent’s environment; publish test clean
• Knowledge ACLs reviewed; tools not on maker identity in prod
• Not shipping from shared Default
• Purview audit reachable; security warnings cleared
• Privacy / AI disclosure decided for your channel

What this doesn’t cover

Essential Eight is not a 1:1 Copilot Studio launch list — don’t force-fit it. Licensing cliffs (managed environments, DSPM for AI, and similar) vary by tenant. Agent 365 and related control-plane features are moving fast; re-check docs if you’re governing agents at scale.

If you want a second pair of eyes before Publish, that’s exactly the kind of fixed-scope review I do for Australian SMBs — plain English, prioritised actions, no 60-page report.