Power Platform Community Forum Thread Details

Hi,

Can someone please explain to me why the PG working on Copilot Studio is not capable of introducing/using new Security Roles for Copilot Studio?

Was already aware that we have to give users the "environment maker" role to allow them to create agents in a Dataverse environment. This is already strange as we can't prevent them from creating flows/apps. You guys can't imagine a scenario where IT only wants to give a user the permission to create an agent?

Now I'm learning that users that only need to use an agent also need the "environment maker" role. This means that we can't make an agent available to users in a Dataverse environment without giving them the option to create agents/flows/apps.

Please tell me I'm wrong or explain why Microsoft thinks it's OK to not allow IT to lock things down. To me this is an indication that a higher up made a decision to do whatever it takes to get usage of Copilot Studio to go up. How do you guys not realize that this could also be a reason why some companies simply refuse to adopt Copilot Studio? You're now forcing IT to continuously monitor an environment and delete agents created by users that are only supposed to use an agent. When a company decides to block certain "channels" for Copilot Studio and wants to facilitate an exception by using a separate Dataverse environment with a custom DLP policy, the set up Microsoft has created allows all users of agents to create agents and publish to the same channel.

We have done some testing and can confirm that "environment maker" is needed for users of agents. This is now why I'm going to push against using Copilot Studio when I'm advising my customers. They can use Copilot Studio, but only in the default environment and with the tenant DLP policy enforced. No exceptions... No more "allocating paid messages to facilitate an important agent" as you can't rule out that some random user creates an agent and starts consuming the same paid messages.

Categories:

General topics