Reference
Policies for Copilot Studio
See the Copilot Studio inventory reference for the objects these templates work on.
| Policy | Description | Severity | Category | Checks |
|---|---|---|---|---|
| AI Builder Consumption on Trial Credits ⭐ | Flags AI Builder consumption billed against trial credits, so workloads can be moved onto purchased capacity before the trial expires and breaks dependent apps and flows. AI Builder consumption running on trial credits will stop working the moment the trial expires, breaking any app or flow that depends on it. Identify the environments consuming trial credits, confirm whether the workload is meant to be permanent, and move it onto purchased AI Builder capacity before the trial lapses to avoid an unplanned outage. | Medium | Costs | AI Builder consumption |
| Autonomous Copilot Agent Risk ⭐ | Identifies agents operating without user interaction via email or scheduled triggers, requiring additional oversight Establish governance controls for agents operating via email triggers or scheduled tasks without direct user interaction, as these autonomous agents pose unique risks including uncontrolled cost generation, potential security vulnerabilities, and lack of human oversight for quality control. Set strict operational boundaries and cost limits, require periodic human review of agent performance, and establish clear procedures for anomalous behavior. | Medium | Costs | Copilot Agent |
| Autonomous Copilot Agent with Scheduled Trigger ⭐ | Flags agents with automated recurring execution that may generate uncontrolled costs without human oversight Review and control agents with automated scheduled execution to prevent uncontrolled cost accumulation and ensure predictable operations, as autonomous agents can generate significant expenses without human oversight or intervention capabilities. Implement execution limits, cost caps, and monitoring alerts for scheduled agents, establish clear approval workflows for autonomous operations, and regularly review executions to ensure agents perform as intended. | High | Costs | Copilot Agent |
| Billable Capacity Consumption - Last 7 Days ⭐ | Flags resources that billed Copilot Studio capacity in the last 7 days — the actively cost-driving agents and agent flows that should each have a monthly consumption limit configured. Resources that have billed capacity in the last 7 days are the ones actively driving cost right now. These are exactly the agents and agent flows that should have a monthly consumption limit configured in the Power Platform admin center (Manage Agents). Review each one, confirm a cap is set, and apply notifications and a hard stop so consumption stays within budget. | Medium | Costs | Copilot Studio capacity consumption |
| Billed Pay-as-you-go Copilot Studio Usage ⭐ | Flags Copilot Studio usage line items billed at the pay-as-you-go rate, so steady-state workloads can be moved onto cheaper prepaid capacity. Billed pay-as-you-go usage is consumption that has been charged at the pay-as-you-go rate rather than drawn from prepaid capacity. Recurring billed pay-as-you-go line items signal a workload that would be cheaper on a prepaid capacity plan; review the resources behind them and right-size capacity so steady-state consumption is prepaid and pay-as-you-go is reserved for genuine bursts. | Medium | Costs | Copilot Studio billed usage |
| Capacity Consumption Daily Spike ⭐ | Flags resources (agents or agent flows) that consumed an unusually high number of messages/credits in a single day, the typical runaway-agent signature, so a consumption limit can be applied before costs compound. A resource consuming an unusually large number of messages/credits in a single day is the classic runaway-agent signature — an unintended loop, a misconfigured autonomous trigger, or a sudden surge in traffic. Identify the agent or agent flow, confirm the spend is intended, and set a monthly consumption limit on it in the Power Platform admin center (Manage Agents) with notifications and an automatic hard stop so a single bad day can't compound into a large bill. | High | Costs | Copilot Studio capacity consumption |
| Confidential Site Referenced in Copilot Agent ⭐ | Detects agents connected to SharePoint sites labeled with sensitivity classifications, risking unauthorized data access Disconnect agents from SharePoint sites containing sensitive and classified data or ensure correct access permissions for agents are in place to prevent unauthorized information disclosure, as agents may inadvertently expose confidential content to users without proper clearance levels. Review the agent's knowledge sources and replace sensitive sites with appropriately classified alternatives, implement conditional access policies to ensure only authorized users can interact with agents that must access sensitive data, and audit existing agent responses for any leaked confidential information. | High | Security | Site Collection |
| Environment Consumption Cost Limit Exceeded - 7 Days ⭐ | Flags environments whose rolled-up Copilot Studio consumption cost over the last 7 days exceeds the configured limit, so spend can be reviewed before it compounds. An environment whose Copilot Studio consumption cost exceeds the expected weekly budget is usually a runaway agent, an unthrottled pay-as-you-go meter, or unexpected adoption. Review the environment's agents and meters, confirm the spend is intended, and either move it onto a capacity plan or apply spending limits before the monthly bill compounds. | High | Costs | Environment |
| Environment Consuming Pay-as-you-go Capacity ⭐ | Flags environment consumption rows that bill pay-as-you-go (overage) Copilot Studio capacity, the most expensive consumption mode, so capacity can be right-sized. Pay-as-you-go consumption means the environment has exhausted its prepaid Copilot Studio capacity and is now billing overage to Azure. Confirm the overage is expected; if not, increase prepaid capacity, redistribute load, or apply limits, because pay-as-you-go usage is the most expensive way to consume Copilot Studio messages. | Medium | Costs | Copilot Studio environment consumption |
| Excessive Draft Agent Creation Pattern ⭐ | Flags users creating 5+ unpublished agents, indicating potential training needs or cleanup requirements Address users creating 5 or more unpublished agents by providing targeted training and implementing creation governance, as excessive draft accumulation typically indicates either experimentation without clear objectives or lack of understanding about agent development best practices. Review existing drafts with users to identify which should be completed versus deleted, establish structured training on agent design and development workflows, and create templates or starter agents to reduce trial-and-error creation patterns. | Medium | Declutter | User |
| Expensive Copilot Studio Agent ⭐ | Flags agents whose total Copilot Studio consumption cost exceeds the configured threshold, so high-cost agents can be reviewed for efficiency. An agent accounting for a large share of credit spend deserves scrutiny: confirm the business value justifies the cost, check for inefficient flows or oversized models, and consider throttling, caching, or a cheaper model where appropriate to keep agent costs proportionate to value. | Medium | Costs | Copilot Agent |
| External Web Content Dependency Risk ⭐ | Identifies agents relying on public websites as knowledge sources, creating reliability and content control risks Evaluate and mitigate risks from agents dependent on external websites as knowledge sources, since public web content can change without notice, become unavailable, or contain inaccurate information that compromises agent reliability. Assess the criticality of external sources and consider caching essential content internally, implement validation mechanisms to verify content accuracy, establish fallback knowledge sources for business-critical information. | Medium | ExternalAccess | Copilot Agent |
| High Copilot Studio Credit Consumer ⭐ | Flags users consuming a high number of Copilot Studio credits across agents, so heavy consumers can be reviewed for efficiency and appropriate capacity coverage. A user consuming a large number of Copilot Studio credits across agents is a top contributor to the bill. Confirm the consumption matches a genuine business need, check whether prompts or agent flows can be made more efficient, and make sure the user is covered by an appropriate capacity plan so a single heavy consumer does not exhaust shared capacity. | Medium | Costs | Copilot Studio user consumption |
| Orphaned Copilot Agent Ownership Gap ⭐ | Detects agents without assigned owners or only disabled owners, creating accountability gaps for maintenance, costs, and compliance Assign clear ownership to all agents lacking designated responsible parties, as orphaned agents create accountability gaps that lead to unmanaged costs, security vulnerabilities, and compliance failures. Identify appropriate owners based on agent purpose and departmental usage, establish succession planning procedures to prevent future orphaning when employees leave. Leverage automations and approvals to request new owners to step up and take ownership. | Medium | Declutter | Copilot Agent |
| Pay-as-you-go Meter in Overage ⭐ | Flags pay-as-you-go meters that billed overage above their entitled quantity — the most expensive consumption mode — so entitlements or limits can be adjusted. An overage on a pay-as-you-go meter means the consumed quantity exceeded the entitled quantity, so every unit above the entitlement is billed at the pay-as-you-go rate — the most expensive way to consume Copilot Studio capacity. Review the billing policy behind the meter and either raise the entitlement, move the workload onto prepaid capacity, or apply a consumption limit so overage stays controlled. | Medium | Costs | Copilot Studio pay-as-you-go meter |
| PAYG Plan Limit Exceeded - 7 Days ⭐ | Flags pay-as-you-go plans that exceed a billing amount of 250 within 7 days, requiring billing plan review Transition from pay-as-you-go billing to a more suitable subscription plan when costs exceed a set limit within 7 days, as rapid spending on PAYG plans typically results in higher per-unit costs than committed usage plans. Analyze usage patterns to select an appropriate subscription tier that matches your organization's needs, implement spending alerts well below the threshold to enable proactive plan adjustments. | High | Costs | Pay-as-you-go Plan |
| Stale Unpublished Copilot Agents - 30 Days ⭐ | Identifies agents created but unpublished for 30+ days, indicating abandoned development efforts consuming resources Complete development or remove agents that remain unpublished for 30 days, as these stale drafts consume resources, create confusion, and indicate either abandoned projects or development bottlenecks requiring attention. Contact creators to determine whether development should continue or cease, establish development guidelines with clear milestones for agent publication, implement automatic notifications for aging drafts, and consider providing additional training or resources if delays stem from technical challenges. | Medium | Declutter | Copilot Agent |
| Unauthenticated Public Agent Security Risk ⭐ | Identifies agents exposed publicly without authentication requirements, creating security risks requiring remediation Secure publicly exposed agents by implementing authentication requirements immediately, as unauthenticated access creates vulnerabilities that could allow malicious actors to extract sensitive information, manipulate agent behavior, or generate unauthorized costs. Configure appropriate authentication methods, restrict access, and audit existing conversations to ensure no sensitive data has been exposed. | High | Security | Copilot Agent |
| Unused Agent Cleanup Candidate - 90 Days ⭐ | Flags inactive agents with no usage for 90+ days as candidates for cleanup to reduce sprawl Unpublish or remove agents showing no activity for 90 days to reduce environment clutter, minimize security attack surface, and eliminate unnecessary maintenance overhead. Review inactive agents with their original creators to confirm they are no longer needed, document any valuable configurations or prompts before removal, and establish a regular cleanup schedule to prevent accumulation of abandoned agents that could pose security risks or compliance issues. | Medium | Declutter | Copilot Agent |
| Windows 365 Agent Cloud PC High Daily Runtime ⭐ | Flags Windows 365 for Agents Cloud PC pools running a high number of hours in a single day, so near-continuous pay-as-you-go runtime cost can be reviewed. Windows 365 for Agents Cloud PCs are billed per runtime hour (~$0.40/hr pay-as-you-go), so a Cloud PC pool running close to around the clock is a continuous cost. Confirm the agent genuinely needs near-continuous availability; if it only runs scheduled or on-demand work, shut the Cloud PC down between runs or move it to a model that bills for active time so you are not paying for idle hours. | Medium | Costs | Windows 365 for Agents consumption |