Policies for Copilot Studio
AI summary
Copilot Studio includes policy templates organized into four categories to help you identify governance issues in your environment. Each template checks for specific violations like security risks, external access, unused agents, or licensing and budget matters, and displays severity levels. Policies marked as Recommended are suggested first.
These are the policy templatesPolicyA policy is a governance rule that Rencore Governance checks against your inventory, for example Teams without owners.Read more for Copilot StudioCopilot StudioCopilot Studio is the Microsoft tool for building your own AI agents. Rencore Governance covers it with the Copilot Studio connector, part of the AI & Agents module.Read more, grouped by what they look for. Each template checks one kind of object and flags every item that breaks the rule. The severity shows how serious a violation is; a Recommended pill marks the templates Rencore recommends you start with.
See the Copilot Studio inventory reference for the objects these templates work on.
Security 2
Risky settings, weak credentials and access that is wider than it should be.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Confidential site referenced in Copilot agent Recommended | Detects agents connected to SharePoint sites labeled with sensitivity classifications, risking unauthorized data access. | High | Site collection |
| Unauthenticated public agent security risk Recommended | Identifies agents exposed publicly without authentication requirements, creating security risks requiring remediation. | High | Copilot agent |
Guests and external access 1
Guests, external usersExternal userAn external user is an account whose home tenant belongs to another organization, invited into your tenant to work with you.Read more and content shared outside your organization.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| External web content dependency risk Recommended | Identifies agents relying on public websites as knowledge sourcesKnowledge sourceA knowledge source is data that a Copilot Studio agent uses to answer, such as public websites, SharePoint and OneDrive, Dataverse or uploaded files.Read more, creating reliability and content control risks. | Medium | Copilot agent |
Clean-up 4
Inactive, empty, ownerless or outdated objects you can archive or delete.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Excessive draft agent creation pattern Recommended | Flags users creating 5+ unpublished agents, indicating potential training needs or cleanup requirements. | Medium | User |
| Orphaned Copilot agent ownership gap Recommended | Detects agents without assigned owners or only disabled owners, creating accountability gaps for maintenance, costs… | Medium | Copilot agent |
| Stale unpublished Copilot agents - 30 days Recommended | Identifies agents created but unpublished for 30+ days, indicating abandoned development efforts consuming resources. | Medium | Copilot agent |
| Unused agent cleanup candidate - 90 days Recommended | Flags inactive agents with no usage for 90+ days as candidates for cleanup to reduce sprawl. | Medium | Copilot agent |
Licenses and costs 3
Licenses, spend and storage that cost money without being used.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Autonomous Copilot agent risk Recommended | Identifies agents operating without user interaction via email or scheduled triggers, requiring additional oversight. | Medium | Copilot agent |
| Autonomous Copilot agent with scheduled trigger Recommended | Flags agents with automated recurring execution that may generate uncontrolled costs without human oversight. | High | Copilot agent |
| PAYG Plan limit exceeded - 7 days Recommended | Flags pay-as-you-go plansPay-as-you-go planA pay-as-you-go plan links one or more Power Platform environments to an Azure subscription.Read more that exceed a billing amount of 250 within 7 days, requiring billing plan review. | High | Pay-as-you-go Plan |
Frequently asked questions
How many built-in policies does Rencore Governance provide for Copilot Studio?
How many built-in policies does Rencore Governance provide for Copilot Studio?10 built-in policies, such as Autonomous Copilot agent risk, Autonomous Copilot agent with scheduled trigger and 8 more.
How are the Copilot Studio policies grouped?
How are the Copilot Studio policies grouped?By category: Security, Guests and external access, Clean-up and Licenses and costs.
Which Copilot Studio policies are recommended?
Which Copilot Studio policies are recommended?Autonomous Copilot agent risk, Autonomous Copilot agent with scheduled trigger, Confidential site referenced in Copilot agent and 7 more.
Which module includes the Copilot Studio connector?
Which module includes the Copilot Studio connector?The Copilot Studio connector is part of the AI & Agents module of Rencore Governance, an add-on module on the Premium and Enterprise Plans. The connector is generally available.