Reference

Copilot Studio Consent

Rencore Governance connects to Copilot Studio through an Entra ID application that you create in your own tenant. You enter the app details in Rencore Governance, then register the app as a Power Platform management application with a short PowerShell script. Rencore Governance then finds your Dataverse Environments and sets up read-only access in each one.

Note: Most Copilot Studio inventories are retrieved via the Copilot Studio scan. However, Daily Costs is the only exception. This data is retrieved via the Azure scan. To see Daily Costs data, Azure consent must also be granted, and the Reader role must be assigned to the relevant Azure Subscriptions.

Before you start

To give consent for Copilot Studio, you will need:

  • An Entra ID application with a client secret, created as described in Dataverse and Copilot Studio.
  • The app’s Directory (tenant) ID, Application (client) ID, and the client secret Value.
  • An account with the Power Platform Administrator role.
  • A Windows device with Windows PowerShell. The setup script uses the “Microsoft.PowerApps.Administration.PowerShell” module, which is supported only on Windows.
Tip: Copy the client secret Value when you create it, as it is only displayed once.

Turn on the service

To turn on Copilot Studio, you will need to:

  1. Click on “Settings” and then “Environment Settings”.
  2. Click on “Manage Services”.
  3. Toggle the selector for “Copilot Studio”.
  4. Click “Save”.

Copilot Studio uses the “Dataverse” consent. To give consent, you will need to:

  1. Click on “Settings” and then “Environment Settings”.

  2. On “General Settings”, click the ellipses menu (…) and select “Manage consent”.

  3. Click “Give Consent” on “Dataverse”.

    Give consent on the Dataverse tile

  4. In the “Bring your own keys” dialog, enter the following details:

    • Directory (Tenant) Id: Enter the tenant ID.

    • Client Id: Enter the application (client) ID.

    • Client Secret: Enter the Value that you copied when creating the client secret.

    • Environment Names (optional): Leave this empty to let Rencore Governance find and set up all of your Dataverse Environments. To scan only some Environments, enter their Environment URLs separated by commas.

      Tip: Use the Environment URL, not the Environment display name, for example "org12345.crm4.dynamics.com". You can find it in the Power Platform admin center on the Environment's details page.

  5. Click “Connect”. Rencore Governance checks the credentials with Entra ID.

  6. The dialog shows a PowerShell script with your tenant ID and client ID already filled in. Click “Copy” or “Download”.

  7. On a Windows device, run the script in Windows PowerShell and sign in with your Power Platform Administrator account.

  8. Return to Rencore Governance and click the button to confirm that you have run the script.

  9. When the dialog shows “Connection Successful!”, click “Save and Close”.

    Consent will be given
Note: Consent is only given once the dialog shows "Connection Successful!". If you close the dialog before then, the tile still shows "Give Consent" and no Copilot Studio data is collected.

What the setup script does

The script registers your Entra ID app as a Power Platform management application. This gives the app tenant-level admin access to the Power Platform. Rencore Governance uses it to find your Dataverse Environments, set up read-only access in each one, and read the “Tenant Settings” and “Billing policies” inventories.

You only need to run the script once per tenant. The dialog shows the script step every time you give consent. If the app is already registered, confirm the step without running the script again.

The script looks like this, with your own IDs filled in:

# Rencore Governance - Register Power Platform management app
# Run as a Power Platform Administrator
# Run this script on a Windows device using Windows PowerShell
# This script uses a module supported only on Windows

Install-Module -Name Microsoft.PowerApps.Administration.PowerShell
Import-Module Microsoft.PowerApps.Administration.PowerShell

$tenantId = "TENANT_ID"
$clientId = "CLIENT_ID"

Add-PowerAppsAccount -Endpoint prod -TenantID $tenantId
New-PowerAppManagementApp -ApplicationId $clientId

Rencore Governance sets up each Environment during the next Data Collection Job, not in the consent dialog. In each Environment, it creates a read-only “Rencore Governance” security role and an application user for your app. The first scan can take longer than usual while this happens.

To check the result, open “Manage consent” and click “See details” on “Dataverse”. The panel lists the Environments that connected and the ones that failed. Failed Environments are skipped, and the next Data Collection Job tries them again. Click “View all errors” to see the error for each one.

If an Environment keeps failing, you can set it up yourself, as described in Dataverse and Copilot Studio.

Troubleshooting

What you see

What to do

Connection failed

Rencore Governance could not sign in with the details you entered. Check that the tenant ID, client ID, and client secret all belong to the same app, and that the secret has not expired. Click "Review Configuration" to correct them.

Permissions not set

The app is not registered as a Power Platform management application yet. Check that the script ran against the same tenant ID, wait a few minutes, then click "Retry".

The tile still shows "Give Consent"

The dialog was closed before "Connection Successful!". Give consent again and complete every step.

The client secret has expired

Create a new client secret for the app, then give consent again with the new Value.

An Environment is connected but shows no Copilot Studio data

Copilot Studio may not be provisioned in that Environment. Check the security role permissions listed in Dataverse and Copilot Studio.

Last updated: 10/14/2026