Copilot Studio Publish Warning 'Your agent runs tools that use the author's credentials'

(0) Share

Report

Posted on by CS-24032037-0

When attempting to publish an agent, I am getting a warning message stating that 'Your agent runs tools that use the author's credentials'. The confusing part is that the tools it references are agent flows that do not use any connectors. This started after adding the agent to a Solution.

One thing to note is that it shows five total tools with this warning. Two of them are the same tool, one links back to the agent tool and the other opens up the solution in Power Automate rather than Copilot studio. The tools are using an HTTP call to our ITSM to gather information and respond back to the chat with.

In the screenshot below you can see that the ID Verification - Using Username shows up twice (One linking to the tool and the other to Power Automate), and the ID Verification - Using Email shows up twice.

Inside the tools themselves, I do not have any option to set the Authentication method to End User Credentials, or Maker credentials:

Here is a screenshot of the ID Verification - Using Email agent flow to show that it does not have connectors being used:

Is this a warning for something that is automatically built into the agents? I am struggling to find what exactly is triggering it, and why it is only now triggering after adding it to a solution.

Categories:

Publish & channel management

I have the same question (0)

All responses (2)

Answers (0)

Sort by

Assisted by AI

Prasad-MSFT Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!

Why You See This Warning
Power Automate Flows as Tools:
When you add a flow as a tool in Copilot Studio, the flow runs under the credentials of the user who created or last edited the connection (often the author).
No Connectors ≠ No Credentials:
Even if your flow doesn’t use connectors (e.g., only HTTP actions), Power Platform still associates the flow with the author’s credentials for execution and auditing.
Solution Context:
Adding the agent and flows to a Solution can cause duplicate references or surface flows in both Copilot Studio and Power Automate, leading to the same tool appearing twice in the warning list.
HTTP Actions:
HTTP actions in flows still run under the context of the flow owner, and if authentication is required (e.g., for ITSM), it may use stored credentials or tokens.

Why Tools Appear Twice
Dual References:
When a flow is part of a Solution, it can be referenced both as a standalone flow and as a tool in Copilot Studio, causing it to show up twice.
UI Quirk:
The UI may list both the tool reference and the underlying flow, especially if the flow/tool is used in multiple places or imported from a Solution.

What Should You Do?
Review Flow Ownership:
Make sure the flows are owned by a service account or an account with appropriate permissions, not a personal account.
Reassign Connections (if needed):
If you want the flows to run under a different context, reassign the connections in Power Automate.
Acknowledge the Warning:
If your flows only use HTTP actions and do not expose sensitive credentials, the warning is informational. It’s safe to proceed if you understand the context.
Monitor for Duplicates:
Duplicates in the warning list are a UI artifact and do not affect functionality, but you can review your Solution to ensure there are no unnecessary duplicate flows/tools.

Was this reply helpful? Yes No
Suggested answer

Karan_Shewale_MSFT Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!
This is actually expected behavior, especially after adding your agent into a Solution, and yeah—it can definitely be confusing at first.

The warning “Your agent runs tools that use the author’s credentials” doesn’t necessarily mean your flows are using connectors. In Copilot Studio, any agent tool (Power Automate flow) runs under the author’s context by default, even if your flow only has HTTP actions and no visible connectors. Behind the scenes, Power Automate still executes those actions using a connection context (even if it’s implicit), which is why this warning shows up.

About the duplicate tools—you’re not actually seeing different flows. This usually happens because:

One entry is the agent tool inside Copilot Studio

The other is the same flow referenced from the Solution (Power Automate side)

So it looks like duplicates, but it’s really just two references to the same thing.

Also, this warning is just informational, not an error. It’s basically telling you that when the agent runs these tools, they’ll execute using the maker’s credentials, not the end user’s.

You only need to worry if your flow is calling something sensitive (like your ITSM APIs) and you specifically need user-level authentication. Otherwise, this is normal behavior.

So overall—nothing is broken here, this is just how Copilot Studio + Power Automate behave when solutions are involved.

Thanks Karan Shewale.

Was this reply helpful? Yes No