Microsoft Copilot Studio

Connect Agent Identity Security to Microsoft Copilot Studio to discover copilot agents, monitor their configurations, and track agent interactions across Power Platform environments.

This integration requires several setup steps across multiple Microsoft portals. Read this entire topic before you begin.

Agent Identity Security uses ROPC (Resource Owner Password Credentials) OAuth to authenticate. This requires a dedicated service account and an Azure AD app registration.

Prerequisites

  • A Microsoft 365 administrator who can create users and configure Azure app registrations.
  • Access to the Azure Portal (portal.azure.com).
  • Access to the Power Platform Admin Center (admin.powerplatform.microsoft.com).
  • Disable MFA for this account, or configure a Conditional Access exclusion to allow non-interactive sign-in.

Creating the Integration User

Agent Identity Security signs in as a dedicated service account using the ROPC flow. This account must have MFA disabled.

  1. In Microsoft 365 Admin Center (admin.microsoft.com), go to Users > Active users > Add a user.
  2. Create a dedicated account. Example: [email protected].
  3. Assign a license that includes Power Apps access. Examples: Power Apps Per User Plan, or Microsoft 365 E3/E5.
  4. Disable MFA for this account, or configure a Conditional Access exclusion to allow non-interactive sign-in.
  5. Note the username and password. You will need them when you configure the integration in Agent Identity Security.
Important: MFA must be disabled for this service account. If MFA is active when Agent Identity Security attempts to sign in, the authentication will fail.

Assigning Power Platform Roles

  1. Go to Power Platform Admin Center > Environments and select your target environment.
  2. Go to Settings > Users + permissions > Users.
  3. Find the service account you created, then select Manage security roles.
  4. Assign the System Administrator role, then select Save.

Registering the Application

  1. In Azure Portal, go to Azure Active Directory > App Registrations and select New registration.
  2. Enter a name such as Agent Identity Security-CopilotStudio. Set Supported account types to Accounts in this organizational directory only. Select Register.
  3. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.
  4. Go to Certificates & secrets > New client secret. Set a description and expiry, then select Add.
  5. Copy the Value immediately. It is shown only once.
  6. Go to Authentication, then enable Allow public client flows.

Adding MS API Permissions

  1. In the app registration, go to API permissions > Add a permission.
  2. Add the following application/delegated permissions:
    API Permission
    Microsoft Graph User.Read.All (Applications)
    Power Platform API EnvironmentManagement.Environments.Read (Delegated)

    EnvironmentManagement.Groups.Read (Delegated)
  3. Select Grant admin consent for [your organization] and confirm.

Enabling Business App Platform Access

  1. Go to Power Platform Admin Center > Settings > User management > Application users.
  2. Select + New app user.
  3. Select + Add an app and search for the registered application by name or client ID.
  4. Select the target Business unit and select Create.

Configuring the Application User

  1. Go to Power Platform Admin Center > Environments > [Your Environment] > Settings > Users + permissions > Application users.
  2. Select + New app user.
  3. Select + Add an app, then choose the application you registered.
  4. Assign the System Administrator security role, then select Create.

Integrate Microsoft Copilot Studio

  1. On the Integrations page, select + Add Integration.
  2. In the Integration Catalog, select Microsoft Copilot Studio.
    The Microsoft Copilot Studio configuration page opens.
  3. Under Instance Details, enter the following information:
    Field Description
    *Instance Name A unique name for this integration. Example: Production Copilot Studio.
    Description An optional description to identify the purpose or environment of this integration.
  4. Under Credentials, enter the following information:
    Field Description
    *Client ID The Application (client) ID of the Azure AD app registration. Find this on the Overview page of your app registration.
    *Client Secret The client secret you created under Certificates & secrets in the Azure AD app registration.
    *Tenant ID The Directory (tenant) ID of your Azure AD tenant. Find this on the Overview page of your app registration.
    *Username The email address of the dedicated service account you created. Example: [email protected].
    *Password The password for the service account.
    *: Mandatory field
  5. Select Test Configuration.
    Agent Identity Security validates the credentials. A checkmark indicates success.
  6. Select Create Instance.
    Agent Identity Security creates the integration, runs an initial sync, and returns you to the Integrations list.
The Microsoft Copilot Studio integration is active. Go to Registry > Agents to view discovered copilot agents.