TLDR:
Copilot Studio introduces new security risks across agent creation, OAuth permissions, user interactions, and sensitive data access. Effective threat detection should therefore correlate signals across Power Platform, Entra ID, Copilot interaction telemetry, Application Insights, and DLP/data-access logs.
Introduction:
As organizations rapidly adopt Microsoft Copilot Studio to build AI-powered agents, security teams are faced with a new challenge: how do we monitor and detect abuse of AI agents?
Unlike traditional applications, Copilot Studio automatically provisions Microsoft Entra applications and Identities, relies on delegated OAuth permissions to access Microsoft 365 resources, and generates telemetry across multiple Microsoft services. Understanding how these pieces fit together is essential for building effective detections.
This article summarizes the identity lifecycle of a Copilot Studio agent, explains where logs are generated, and outlines the most valuable threat detection opportunities.
Copilot Studio Architecture:
Copilot Studio is built on top of the Power Platform, but its security model extends well beyond it.
An agent interacts with several Microsoft services:
-
Power Platform – agent authoring and lifecycle management
-
Dataverse – stores agent metadata and conversation transcripts
-
Microsoft Entra ID – identity, OAuth, enterprise applications
-
Microsoft Graph – access to Microsoft 365 resources
-
Application Insights – runtime telemetry
-
Microsoft Purview – Copilot audit events
Unlike Microsoft Foundry or AWS Bedrock, Copilot Studio does not expose a native "model invocation log." Instead, the runtime is distributed across these services.
Identity Lifecycle of a Copilot Studio Agent:
One of the most interesting discoveries is that creating an agent automatically provision's identity objects in Microsoft Entra ID.
When an agent is created, Copilot Studio performs the following sequence:
-
BotCreate (Power Platform)
-
Add application (Entra App Registration)
-
Add service principal (Enterprise Application)
-
Add owner to service principal
-
Update service principal
The service behind these operations is Power Virtual Agents, not the user creating the agent.
Microsoft’s newer agent identity model can represent agents through agent blueprints and agentic identities. Depending on the agent’s configuration and enabled capabilities, traditional Entra application and service principal objects may also be provisioned. Therefore, security teams should not rely solely on App Registrations to discover Copilot Studio agents
For new Copilot Studio agents after the July 2026 Agent ID rollout, you should not expect a traditional App Registration for every agent.
Microsoft says:
Old Copilot Studio Identity model:
Copilot Agent → App Registration / Service Principal
New Identity model:
Microsoft global Blueprint → Blueprint Principal in your tenant → individual Entra Agent ID
Existing agents created before the rollout continue using app registrations until they're migrated.
OAuth and Permission Model:
A Copilot Studio agent does not automatically receive Microsoft Graph permissions.
Access to Microsoft 365 resources is only possible after OAuth consent is granted.
A normal delegated flow looks like this:
User → Consent to application → Add delegated permission grant → Access Token → Microsoft Graph
During this process, two audit events are commonly observed.
Consent to application
This event records that a user (or administrator) approved an application's requested permissions.
It captures:
-
who approved the request
-
which application requested access
-
requested scopes
-
consent context
This is an approval event, not the actual permission.
Add delegated permission grant
This event creates the underlying OAuth2PermissionGrant object.
This event enables the application to obtain delegated access tokens.
From a security perspective, this is the most important OAuth event.
Logging Architecture:
Telemetry is spread across several services.
Microsoft Purview
Workload = Copilot
Generates:
CopilotInteraction
These events capture runtime activity such as:
-
user
-
AI application
-
resources accessed
-
sensitivity labels
Purview does not record the actual prompt or response.
Workload = Power Platform
Generates:
-
BotCreate
-
Agent publish
-
Authentication changes
-
Knowledge source modifications
Both Copilot and Power Platform workload logs are under Audit.General content type, these logs can be fetched using the office365 connector to Securonix SIEM.
Integration Guide: https://documentation.securonix.com/r/content/active-deployment-guides/microsoft-office-o365-api.htm
Microsoft Entra ID
Entra remains the authoritative source for:
-
application creation
-
service principal creation
-
OAuth consent
-
delegated permission grants
-
app role assignments
Microsoft Entra ID (Azure Active Directory) audit logs are under Audit.AzureActiveDirectory content type, these logs can also be fetched using the office365 connector to Securonix SIEM.
Integration Guide: https://documentation.securonix.com/r/content/active-deployment-guides/microsoft-office-o365-api.htm
Threat Detection Strategy:
Rather than relying on a single event, detections should follow the lifecycle of the agent.
A typical attack sequence may resemble:
Agent Created → OAuth Consent → Delegated Permission Grant → Conversation/CopilotInteraction → Graph / SharePoint Access → Data Movement
This allows defenders to correlate:
-
identity changes
-
AI conversations
-
resource access
-
downstream exfiltration
Threat Detection Policies
-
Abnormal Number of Copilot Interactions
-
First Time Account Interaction with Copilot
-
Copilot Interaction from Malicious IP
-
Copilot Interaction from Rare Country
-
File Uploaded to AI Sites
-
Copilot Agent Created by Rare Identity
-
User Interacted with the Rare Copilot App
-
Copilot Studio Agent Sign-in Topic Modified
-
Rare Permissions Assigned to App - O365AzureAD
-
Landspeed Anomaly Detected for AI Assistant
-
AI Assistant Login from Unmanaged Device
-
Possible Illicit Consent Grant Attack - O365 Azure AD
-
Rare Entra ID App Consent Detected
-
High Scope Permission Assigned to EntraID Application