Configure data loss prevention policies for agents

With Copilot Studio, you can rapidly build and roll out high-value agents for your users that can connect with many data sources and services. Some of these sources and services might be external, non-Microsoft services, and might even include social networks, alongside connections to your organizational data.

Organizational data is the most important asset administrators are responsible for safeguarding. The ability to use that data in a protected way, while still connecting and interacting with other services and systems, is a cornerstone of data security.

Data loss prevention (DLP) policies let you govern how agents connect and interact with data and services, within and outside your organization. Administrators can configure Copilot Studio and Power Platform DLP policies in the Power Platform admin center.

Prerequisites

• You should review concepts about DLP policies
• You must be a tenant admin or have the Environment Admin role

Copilot Studio connectors and data groups

Copilot Studio connectors can be classified within a DLP policy under the following data groups, which are presented in the Power Platform admin center when reviewing DLP policies:

• Business
• Non-business
• Blocked

You can use the connectors for DLP policies to protect your organization's data from any malicious or unintentional data exfiltration by your agent makers.

The default group in DLP policies is a category where connectors are automatically added when no explicit grouping is defined during their introduction. Connectors introduced after 2019, such as Chat without Microsoft Entra ID authentication or Direct Line Channels, are likely to have been added to the default "Non-business" group.

In many organizations, connectors in the "Non-business" group are automatically blocked. If a Copilot Studio DLP policy connector is blocked in your tenant, you should review which data group the connector has been added to.

Administrators can configure default groups at the DLP policy level, within the Power Platform admin center.

You can configure DLP policies in the Power Platform admin center to block any of the following Copilot Studio connectors.

Identify and troubleshoot the impact of DLP policies

To find agents that your organization's DLP policies might affect, you can:

• Use the Power BI dashboard of the Center of Excellence (CoE) Starter Kit to get a list of agents in your organization. Go to the Copilot Studio overview page on the CoE Dashboard to see the agents and environment names in your organization.

• Run a campaign with the agent makers in your organization to address DLP errors or updated DLP policies. You can download all agent DLP errors by selecting Details in the error notification banner and selecting Download from the error message details.

If DLP policies are affecting the functionality of your agents, see Troubleshoot data loss prevention policies for Copilot Studio.

Example DLP policy configurations

To get started with Copilot Studio agent governance, review the following example scenarios:

• Data loss prevention example - Require user authentication in agents
• Data loss prevention example - Block SharePoint knowledge source in agents
• Data loss prevention example - Block Power Platform Connectors in agents
• Data loss prevention example - Block HTTP requests in agents
• Data loss prevention example - Block skills in agents
• Data loss prevention example - Block event triggers in agents
• Data loss prevention example - Block channels to disable agent publish

Add and update the learn-more and admin contact email links

You can use the Set-PowerAppDlpErrorSettings PowerShell cmdlet to add an email address and a "Learn more" link to the DLP error messages.

To add the email address and learn-more link for the first time, run the following PowerShell script, replacing the values for the <email>, <URL>, and <tenant ID> parameters with your own.

$ContactDetails = [pscustomobject] @{
    Enabled=$true
    Email="<email>"
}
$ErrorMessageDetails = [pscustomobject] @{
    Enabled=$true
    Url="<URL>"
}
$ErrorSettingsObj = [pscustomobject] @{
    ErrorMessageDetails=$ErrorMessageDetails
    ContactDetails=$ContactDetails
}
New-PowerAppDlpErrorSettings -TenantId "<tenant ID>" -ErrorSettings $ErrorSettingsObj

To update an existing configuration, use the same PowerShell script, and replace New-PowerAppDlpErrorSettings with Set-PowerAppDlpErrorSettings.