Microsoft Copilot Studio (beta)

Two parts, each optional: discovery reads your agents (read-only), and inline protection makes Intertrace the threat detection provider Copilot Studio asks before every tool call of an agent that uses generative orchestration. Classic (topic-only) agents never call a provider; Microsoft skips them.

Every Power Platform environment, every Copilot Studio agent in it, its tools (connector actions, flows, MCP servers), knowledge sources, owner, sign-in mode, whether it is published, and whose credentials each tool runs with. Each agent is a finding under Discovery with plain reasons:

• published with no sign-in (anyone with the link can chat with it);
• tools that run with the maker's saved connection, whoever is chatting;
• tools that send, change or delete (send email, delete item, update record);
• generative orchestration with no security provider check seen from that environment;
• knowledge sources that cover a whole SharePoint tenant or site collection;
• web search, MCP servers and no recorded owner.

Anything Copilot Studio does not report stays unknown and scores nothing. Microsoft's inventory API accepts only a signed-in admin, so the scheduled scan reads each environment's Dataverse tables (bots, botcomponents) with an app-only token. Channels other than Teams are not listed there; an agent with no sign-in is reported as reachable on the web.

1. 1

   Register an app

   Entra → App registrations → New registration, single tenant. Create a client secret. If you already connected Microsoft Entra ID discovery with your own app, you can reuse it.

2. 2

   Let it list environments

   Power Platform API takes no application permissions: in Power Platform admin center, assign the app the Reader role at tenant scope (Security → Role assignments). If your tenant has no service principal for Power Platform API yet, run az ad sp create --id 8578e004-a5c6-46e7-913e-12f58912df43 once.

3. 3

   Let it read agents in each environment

   Environment → Settings → Users + permissions → Application users → New app user. Give it a security role with organization-level read on Agent, Agent component and Connection Reference. Environments without the app user show as limited on the source card.

4. 4

   Connect in Intertrace

   Discovery → Copilot Studio → Connect: tenant ID, client ID, client secret. Intertrace signs in, lists environments and checks a few for agent access before it saves anything; the secret is encrypted at rest. A scan starts at once and repeats with every discovery scan.

1. 1

   Connect discovery first

   Its sign-in shows Intertrace that your organization administers the tenant. One tenant belongs to one Intertrace organization.

2. 2

   Consent to Intertrace's app

   Discovery → Copilot Studio → Inline protection shows the admin consent link (a Global or Privileged Role Administrator approves it). Copilot Studio gets its token for this app.

3. 3

   Create the Copilot Studio app

   Run Microsoft's script with the endpoint Intertrace shows under Inline protection (it ends in /integrations/copilot-studio; Power Platform admin center needs it exactly):

   Save-Script -Name Create-CopilotWebhookApp -Path .
   .\Create-CopilotWebhookApp.ps1 `
     -TenantId "<your tenant id>" `
     -Endpoint "<endpoint shown in Intertrace>" `
     -DisplayName "Copilot Studio - Intertrace" `
     -FICName "IntertraceFIC"

   Or by hand: a single-tenant app with a federated credential (Other issuer, https://login.microsoftonline.com/<tenant>/v2.0, the subject Microsoft's page describes). No client secret. The script prints the App ID.

4. 4

   Register the App ID in Intertrace

   Paste it under Inline protection and turn it on. Intertrace accepts calls only from this tenant and this App ID. With automatic agents on, each Copilot Studio agent becomes a protected Intertrace agent on its first call (it counts toward your plan's protected agents); with it off, import agents from Discovery first.

5. 5

   Set up each environment

   Power Platform admin center → Security → Threat detection → Additional threat detection → pick the environment → Set up. Tick sharing with a threat detection provider, enter the App ID and the endpoint, and set the error behavior to Block the query. Save runs Intertrace's check. There is no tenant-wide switch: repeat for each environment, including new ones.

Each tool call of a generative agent is decided by Intertrace's enforcer exactly like any agent's call: its tool lists, approval rules, roles, guardrails and data checks apply, and the decision is recorded under the agent (Agents, Activity, Approvals). Copilot Studio sends the proposed inputs, the user's message and the agent's reason; Intertrace answers allow or block.

• Allowed or recorded: the tool runs.
• Needs approval: Copilot Studio cannot wait, so the call is blocked with the approval link. Once a person approves, asking again with the same request runs it (remembered per conversation on the gateway machine that answered).
• Would run only with changed inputs (masking): blocked, since Copilot Studio cannot change inputs.
• Blocked: the user sees Copilot Studio's blocked message; Intertrace's reason is in the decision record.