Secure Copilot Studio agents with architecture and DLP
Diesen Beitrag auf Deutsch lesen
Use one-way agent flows, restrictive connector allowlists and repeatable attack tests to reduce Copilot Studio agent risk.
TL;DR
A Copilot Studio job application agent resisted most CV prompt injections, but a polite request exposed a tool-instruction summary in one of two runs and rapid requests still consumed credits. Send applicant data one way to Dataverse through an agent flow, limit tool calls in flows, use high moderation, and allowlist trusted connectors in DLP.
Original by Karl-Johan Spiik, on Karl-Johan Spiik, Microsoft MVP. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Makers: Keep secrets, keys and internal URLs out of agent instructions, then test prompt injection and instruction-summary attempts after model changes.
- Admins/CoE: Use DLP allowlists for agent connectors, especially where connectors can read or act on sensitive resources such as environments.
- Security/Compliance: Design one-way agent flows to Dataverse and restrict repeated tool calls, because prompts alone do not prevent abusive actions or costs.
- Leadership/Business: Make secure agent-building paths easy to use, because insecure solutions created in the tenant remain an organisational responsibility.
Frequently asked questions
How can a Copilot Studio agent prevent applicants from reading other Dataverse applications?
Use a one-way agent flow that writes applicant data to Dataverse without giving the agent a route to read it back. Avoid connecting the agent directly to the table.
Which Copilot Studio settings help defend against CV prompt injection?
Add rules in the generative answers node and agent generative AI settings, then set moderation to high. These controls help reject instructions embedded in submitted content.
Why should DLP allowlist connectors for Copilot Studio agents?
An allowlist limits agents to trusted connectors. A connector that can read or act, such as an environment deletion action, can create serious risk when exposed to an agent.