Secure unauthenticated Dataverse search in Copilot Studio
Diesen Beitrag auf Deutsch lesen
Use Dataverse searchQuery with maker credentials, tightly scoped tables and columns, and a read-only application user for public-facing agents.
TL;DR
Copilot Studio can call the Dataverse searchQuery unbound action with maker-provided service principal credentials, so users need no sign-in. The application user's Dataverse security role defines every result visible to all users. Enable Dataverse Search, index the table, configure Quick Find, and expose only selected searchable and returned columns.
Original by Karima Kanji-Tajdin, on The Custom Engine. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Makers: Configure searchQuery with maker-provided credentials, explicit SearchColumns and SelectColumns, because omitted or incorrect logical names can return no results silently.
- Admins/CoE: Enable Dataverse Search, add tables to the environment search index, and publish Quick Find settings before testing agent results.
- Security/Compliance: Assign the service principal only read permissions to tables and columns safe for public exposure, because every unauthenticated user receives the same view.
Frequently asked questions
How does Copilot Studio searchQuery work without a user sign-in?
It uses maker-provided Dataverse connector credentials backed by a service principal. The agent calls searchQuery under that identity rather than the end user's identity.
Which Dataverse permissions control unauthenticated searchQuery results?
The application user's Dataverse security role controls accessible data. It should have read permissions only for tables and columns that are safe to expose publicly.
Why does a Copilot Studio searchQuery tool return zero Dataverse results?
Dataverse Search or table indexing may be missing, or the entities JSON can contain wrong logical names. These configuration failures can produce no results without an error message.