Dataverse and Copilot Studio

Authentication for Copilot Studio in Rencore Governance operates differently from other services. Instead of an automated setup, the Entra ID application must be manually created within the specific tenant designated for scanning. This manual process ensures proper integration and allows Rencore Governance to access the necessary resources securely.

Create an Entra ID App

1. Go to the Microsoft Entra Admin Center.

2. In the left-hand navigation menu, go to “Identity”.

3. Then click on “Applications” and “App registrations”.

4. At the top of this page, click ”+ New registration”.

   

   1. In “Name” enter “Dataverse Access for Rencore Governance”.
   2. For “Supported account types”, select “Accounts in this organizational directory only”.
   3. Click “Register”.

Create a Client Secret

Once the app is created under “Manage”.

1. Click on “Certificates & secrets”.

2. Select “Client secrets” and then click ”+ New client secret”.

   

   1. In the Description enter something like “RencoreGovernance_Copilot2025”.
   2. Set “Expires” to “Recommended: 180 days (6 months)”.
   3. Click “Add”.
   Tip: Copy the Value key immediately, as it will only be displayed once and you will need this later.

Set API Permissions

Again under “Manage” in the “Dataverse Access for Rencore Governance”

1. Click on “API permission”.

2. Click ”+ Add a permission”.

   1. Select “Dynamics CRM”.

   2. Select “user_impersonation”.

      

   3. Click “Add permissions”.

Power Platform Admin Security Role

1. Go to the Power Platform Admin Center.

2. Click on an Environment that you want to include.

3. Make sure you are a “System Administrator” of the Environment.

   1. Click on “Membership” on the top Navbar.
   2. On the new Dialogue window, click ”+ Add me”.

4. Return to the Environment details page and click on “Settings” on the top Navbar.

   

5. Under the “Users + permissions” heading, click “Security roles”.

6. Click ”+ New role” at the top of the page.

   1. Enter “Rencore Governance” for the “Role Name”.
   2. Select the Environment for the “Business unit”.
   3. Enter “Permission Used for Rencore Governance Copilot Studio” in the “Description”.
   4. Enter “Dataverse Access for Rencore Governance” in “Applies To”.
   5. Enter “Read Access to AICOpilot, AIPlugin, Copilot, Copilot component, Copilot component collection, and Conversation Transcript” in “Summary of Core Table Privileges”.
   6. Leave the other settings alone and click “Save”.

Permissions for the Security Role

In the Security Role Details page of the newly created Role.

1. Use the search function in the top-right of the screen. Enable “Read” for the “Organization” for the following permissions:

   Table	Name
   AICopilot	aicopilot
   AIPlugin	aiplugin
   Agent	bot
   Agent component	botcomponent
   Agent component collection	botcomponentcollection
   ConversationTranscript	conversationtransaction

   1. Also, make sure that the following permissions are enabled for “Organization” under “Read”:
      

      Table	Name
      Organization	organization
      Team	team
      User	systemuser

Manually Create a Dataverse Application User

After creating the Security Role and enabling the desired Permissions, you will need to create a Dataverse application user.

In the Power Platform Admin Center.

1. On the Environment details page, click “See all” under the “S2S Apps” on the right.

2. Click ”+ New app user” above the Navbar.

   1. On the new dialogue window ”+ Add an app”

   2. In the search type “Dataverse Access for Rencore Governance”

      

   3. Select the app created in the previous steps and click “Add”.

   4. Select the desired Environment on the “Business unit”.

   5. Click the Pencil next to the “Security roles”.

      1. Select the role “Rencore Governance”.
      2. Click “Save”

   6. On the “Role assignment confirmation” click “Save”.

3. Click “Create”.

Copilot Tenant list settings and Billing policies scan

To be able to execute these API endpoints: https://api.bap.microsoft.com/providers/Microsoft.BusinessAppPlatform/listtenantsettings?api-version=2020-10-01, https://api.powerplatform.com/licensing/billingPolicies?api-version=2022-03-01-preview for the “Tenant Settings” and “Billing policies” inventories, you need to set your Azure AD app as an Admin Management app. This is done via PowerShell.

Here’s the PowerShell script that adds your app as an Admin Management app:

Install-Module -Name Microsoft.PowerApps.Administration.PowerShell

Import-Module Microsoft.PowerApps.Administration.PowerShell

$appId = "CLIENT_ID_FROM_AZURE_APP"

$tenantId = "TENANT_ID"

# Login interactively with a tenant administrator for Power Platform

Add-PowerAppsAccount -Endpoint prod -TenantID $tenantId

# Register a new application, this gives the SPN / client application same permissions as a tenant admin

New-PowerAppManagementApp -ApplicationId $appId