Copilot Studio Security Review
A Copilot Studio agent can go live with no sign-in, so anyone with the link reaches whatever it knows. We test its authentication, knowledge access, connectors and the actions it can trigger. CREST-certified testers, fixed price from £6,000 for a 5-day single-application scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
A Copilot Studio agent checks a different identity’s permissions at every layer it touches, sign-in, knowledge source, connector and flow, and none of those checks assume the layer before it already covered the gap.
Copilot Studio checks permissions at every layer, not just once at sign-in
An agent’s authentication setting decides who reaches it before any topic or knowledge source is even queried. Copilot Studio offers three options: No authentication, Authenticate with Microsoft, which sets up Microsoft Entra ID sign-in automatically for the Teams and Microsoft 365 channel with no configuration needed, and Authenticate manually against Microsoft Entra ID or any identity provider that supports the OAuth2 standard. The Teams and Microsoft 365 channel only accepts the first of those two signed-in options, and an admin control in the Power Platform admin centre can lock the manual option so a maker can’t turn it on or off from inside Copilot Studio at all.
Knowledge sources don’t all check the same thing. SharePoint, Dataverse and enterprise data reached through connectors run generative answers under what Microsoft documents as the agent user’s own Microsoft Entra ID authentication, so a query only surfaces what that specific signed-in user’s own permissions already allow; Documents uploaded straight to Dataverse and a named public website carry no such per-user check at all. That split matters most inside Teams, where group chats and channels block any knowledge source that needs end-user authentication, including SharePoint, by design. We test what each source type actually returns to a real signed-in user against what an unauthenticated one can pull from the sources that carry no check, the same way we test SharePoint site permissions directly.
What an agent can do once it’s talking to someone runs through the same connectors and flows we test on Power Automate. A connector added as a tool asks the person chatting with the agent for their own credentials by default, though a maker can switch it to run under the maker’s own sign-in instead once the agent is on an authenticated channel, and an agent flow added as a tool lets the orchestrator call it at runtime to fetch data or perform an action on the user’s behalf. A data policy governs which of those connectors an agent is even allowed to call, classifying each into a Business, Non-business or Blocked group and enforcing it in real time, so we map every connector and flow an agent’s prompts can actually reach against what that policy currently permits.
SCOPE
What we pen test on a Copilot Studio agent
Agent access: no authentication, Entra ID or manual sign-in
An agent can be configured with No authentication, Authenticate with Microsoft, which sets up Microsoft Entra ID sign-in automatically for the Teams and Microsoft 365 channel, or Authenticate manually against Microsoft Entra ID or any identity provider that supports the OAuth2 standard. The Teams and Microsoft 365 channel only accepts the Authenticate with Microsoft option, and an admin control in the Power Platform admin centre can lock the Authenticate manually option so makers can’t turn it on or off themselves. We test which option is actually live against which channels the agent is published to, and what a user reaches before any sign-in prompt appears.
SharePoint knowledge: answers run under the asking user’s own Entra ID
A SharePoint knowledge source connects to a site URL and returns results through Microsoft Graph search under what Microsoft documents as the agent user’s own Microsoft Entra ID authentication, rather than a single shared account. Generative answers can draw on up to 25 SharePoint URLs, and in Teams group chats and channels a knowledge source that needs this kind of end-user authentication is blocked from running at all, which Microsoft states is by design to prevent unintended data exposure. We test what a specific signed-in user’s SharePoint permissions actually let the agent surface, and confirm the Teams restriction holds across every channel the agent is published to.
Dataverse knowledge: retrieval runs inside your security role model
A Dataverse knowledge source uses a retrieval-augmented generative technique inside the configured Dataverse environment, authenticating, like SharePoint, as the agent user’s own Microsoft Entra ID identity, with up to 15 tables per knowledge source and two sources per agent in classic mode. Because the query runs as that user, whatever security roles and table-level privileges are assigned to them govern what the retrieval can return, the same model we test on Dataverse-backed Power Apps and Dynamics 365 environments. We test whether a lower-privileged user’s questions ever surface rows their assigned security role shouldn’t let them read.
Public website and Documents knowledge: no per-user permission check
A public website knowledge source searches Bing and returns only results from websites you’ve named, and a Documents knowledge source searches files uploaded directly to Dataverse; Microsoft lists the authentication for both as None, meaning neither checks who is asking before returning a result. Anything uploaded as a Documents source or named as a public website is available to every user the agent serves, regardless of the authentication option configured on the agent itself. We test what’s actually been uploaded or listed under these two source types against what the business intended every user of the agent to be able to read.
Connector actions: maker-provided credentials or the end user’s own
By default, a connector added as a tool asks the person chatting with the agent to sign in with their own credentials for that service before it runs, the same maker-versus-end-user split we test on Power Apps connections built on the same Power Platform connector model. A maker can instead set the connector tool’s Credentials to use option to Maker-provided credentials, which requires the agent to be on an authenticated channel and then runs every user’s request through the maker’s own sign-in instead. We test which mode is set on every connector tool in scope, and what an end user can reach through the maker’s credentials if that option is turned on.
Agent flows and Power Automate actions triggered by a prompt
An agent flow, built in Copilot Studio or Power Automate and added as a tool, lets the agent’s own orchestrator call the flow at runtime to retrieve data or perform an action on the user’s behalf, the same flow-execution model we test in depth on Power Automate. Whatever that flow’s trigger and connections are authorised to do, a create, an update, an approval or an email, becomes something a conversational prompt can now set in motion rather than a person clicking a button. We test what each agent flow actually does once called, under whose connection it runs, and whether a user can talk the agent into calling it in a context it wasn’t scoped for.
Prompt injection carried inside the knowledge the agent reads
A generative answers response is built from the instructions in the agent’s topics plus whatever the configured knowledge sources return for that query, so text sitting inside an indexed SharePoint page, uploaded document or public website is read by the model alongside the user’s own message. We test whether content planted in a knowledge source, rather than typed by the user, can redirect the agent’s behaviour, pull it into calling a connector or flow it shouldn’t, or override the instructions its topics set. This sits alongside the direct prompt injection and jailbreak testing we run on any LLM-backed system under our AI penetration testing service.
Teams and website channels don’t carry the same restrictions
Teams and Microsoft 365 is one of several publishing channels alongside a demo website, a custom website embed and Direct Line-based integrations, and each channel connects differently: Teams forces the Authenticate with Microsoft option and blocks any knowledge source needing end-user authentication in group chats and channels, while a custom website or Direct Line channel carries whatever authentication and knowledge configuration the agent was built with. We test the same agent across every channel it’s published to, since a restriction that holds inside Teams doesn’t automatically apply once the same agent is embedded on a public page.
Data policies: which connectors an agent is even allowed to call
A data policy in the Power Platform admin centre classifies every connector a Copilot Studio agent can use, including the platform’s own Chat without Microsoft Entra ID authentication and Direct Line channel connectors, into a Business, Non-business or Blocked group, and Microsoft notes that connectors introduced after 2019 are likely to default into the Non-business group, which many organisations block outright. Copilot Studio enforces a policy in real time, so a connector a maker relied on can stop working the moment a policy changes, and blocking a Power Platform connector also blocks any tool a connected MCP server was using through it. We test what the current policy actually blocks and classifies against every connector and MCP-backed tool the agent is still calling.
Environment separation: which tenant, region or team an agent sits in
Copilot Studio agents live inside Power Platform environments, and every tenant also gets one default environment created automatically, where every new user is added to its Maker role and no one is added to its Environment Admin role by default; Microsoft’s own guidance is to use a non-default production environment for any agent you deploy to production instead. Environments are commonly split by team, department, region or data residency requirement, and each one can only reach the connections, flows and Dataverse database deployed in that same environment. We test which environment an agent in scope is actually built in, and whether a test or default-environment agent has ended up handling production conversations or data.
OUR PROCESS
Microsoft Copilot Studio Security Review: From Scope to Attestation
Agent, Channel and Knowledge Mapping
We list every agent in scope, its authentication setting, published channels, knowledge sources and connector tools.
Authentication, Knowledge and Connector Testing
We test every authentication option and channel combination, query knowledge sources as different users, and confirm which credential each connector tool actually runs under.
Action, DLP and Environment Testing
We test what agent flows and connector actions can execute on a prompt, review the data policy against every connector and MCP-backed tool in use, and check environment separation.
Reporting and Retest
Executive summary, technical report with CVSS scores and reproduction steps, a walkthrough call, free retest after remediation and an attestation letter.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Copilot Studio pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Microsoft Copilot Studio Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
Depends on AI system complexity
Single LLM-powered chatbot, basic RAG (≤100 documents), no agent tools. Around 5 to 7 working days from kickoff to report.
Get a fixed quoteDepends on AI system complexity
Multi-tool agent system, complex RAG pipeline, fine-tuned model, multi-tenant. Around 8 to 12 working days from kickoff to report.
Get a fixed quoteDepends on AI system complexity
Production AI platform, multi-agent orchestration, regulated AI use case (FCA, NHS), custom-trained models. Around 12 to 18 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Copilot Studio For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Microsoft Copilot Studio Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need?
Maker or admin access to the agent, or agents, in scope, plus a login for each authentication tier, channel and knowledge source permission level you want tested. Read access to the environment’s data policy and connector list isn’t required to start, but it speeds up confirming what we find.
Will you touch our live data?
We test read-only against production by default. Where proving a connector action, an agent flow or a write to Dataverse needs real records, we agree a sandbox environment or specific test data with you first, and anything we create during testing is documented and removed afterwards.
Is this hosted on our infrastructure or Microsoft’s?
Copilot Studio, its environments, and the connectors and knowledge sources behind it run entirely on Microsoft’s infrastructure, so there’s nothing for you to host. The test is scoped to your agent’s authentication, knowledge sources, connectors, flows, publishing channels and data policy, not to Microsoft’s platform itself.
Does this cover Power Automate flows or Power Apps too?
Partly. Where an agent calls an agent flow or a Power Automate flow as a tool, we test what that call can do and under whose credentials, but the deeper flow ownership, sharing and connection review sits on our Power Automate page. Where an agent’s environment is shared with a Power App built on the same Dataverse tables, the app-level sharing and security roles sit on our Power Apps page; this page is scoped to the Copilot Studio agent itself.
What is out of scope?
Other tenants’ agents and environments, Microsoft’s own infrastructure, denial-of-service testing, and the deeper Power Automate or Power Apps configuration behind a connected flow or app, which we cover on their own pages, are all out of scope here.
Is penetration testing our own Copilot Studio agent allowed under Microsoft’s rules?
Yes. Microsoft’s penetration testing rules of engagement for its cloud services permit testing your own tenant and the assets you’re authorised for, provided you don’t access data or systems you don’t own, don’t use credentials that aren’t yours, and don’t disrupt the service for other tenants, and we test inside those rules.
How long does a Copilot Studio test take?
A single-application engagement covering one agent’s authentication, knowledge sources, connectors and flows typically runs to a 5-day scope. More channels, connector tools or a wider agent estate extend it, and we confirm the exact day count once we’ve seen the agent.
Do you need the source of any custom topic or connector?
No, though if the agent uses a custom connector or a generative answers topic built on complex logic, having its definition available speeds up root-causing anything we find. A source code review is a separate service that pairs well with this one.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Copilot Studio agent
A Copilot Studio agent can go live with no sign-in, so anyone with the link reaches whatever it knows. We test its authentication, knowledge access, connectors and the actions it can trigger. CREST-certified testers, fixed price from £6,000 for a 5-day single-application scope, quoted within 24 hours.
