Copilot Studio Agent Security misconfigurations — part II
In my previous blog I explain different security misconfigurations in Microsoft Copilot Studio agents including⚠️risk and ✅mitigations.
This blog continues with the following contents:
1️⃣ MCP Server
2️⃣ Orchestration
MCP Server
MCP (Model Context Protocol) is an open standard created by Anthropic (Claude) that allows AI models or agents to securely access external resources (e.g. https://learn.microsoft.com/api/mcp), tools (e.g. query database) and prompts.
Copilot Studio agents can use MCP server(s) with user-credentials (preferred) or maker-credentials (⚠️risk #1, see the previous blog).
The example above uses the Microsoft Learn MCP server, allowing the model to retrieve real-time information from Microsoft Learn to answer the question instead of relying solely on the model’s training data (which is limited to knowledge up to a specific date).
⚠️Risk
Besides the risk of maker-credentials (described in the previous blog).
The use of MCP server can introduce additional risks:
1️⃣ [In]Direct Prompt injection via MCP Tools
A Copilot agent can call MCP tools (APIs, scripts, databases). A prompt injection attack can manipulate the model into executing unintended actions through these tools.
2️⃣ Data exfiltration
If sensitive resources are connected, a compromised or over-privileged user can retrieve them through the agent.
3️⃣ Privilege escalation
An agent typically runs under a service identity with broad permissions. An attacker who manipulates the agent can perform actions that exceed their own access level, effectively inheriting the agent’s elevated privileges.
The example below, I created a custom MCP server via FastMCP (Python) and published the local MCP server (port:8000) to the internet via Ngrok to be used by Copilot Studio Tools | MCP Server to demo the leaking credentials via MCP Server Tool abuse.
To demo yourself here’s the guide.
✅Mitigation
To lower the risk of MCP Servers, here are a few recommendations:
- Use MCP servers from trusted and official sources (e.g. Microsoft Sentinel MCP Server)
- MCP Server Governance (remove unused MCP Servers from agents)
- Use strong authentication and secure secret handling.
- Treat MCP-provided content as untrusted input.
For the technical readers: you can use the MCP Inspector for testing and debugging MCP (Model Context Protocol) servers by connecting to a server and interactively explore and test everything it exposes.
To find MCP Servers used in agents, you can use the Microsoft 365 E7 (Agent 365) licensed feature Defender for Cloud Apps | AI Agent Inventory described in this blog.
Orchestration
Copilot Studio agents can use generative orchestration, where an LLM dynamically decides which topics, actions, or plugins to invoke based on user input rather than following a fixed, deterministic flow.
This makes agents more flexible and conversational, but introduces new risk and attack surfaces.
⚠️Risk
1️⃣ Prompt Injection
A malicious user (or content the agent retrieves) crafts input that hijacks the agent’s behavior, for example, instructing it to ignore its role and exfiltrate data, impersonate someone, or call unintended actions/connectors.
2️⃣ Scope Creep
The agent may answer questions or perform actions well outside its intended use case, potentially exposing sensitive business data or APIs it has access to.
3️⃣ Unpredictable Tool Invocation
With generative orchestration, the LLM picks which tools/plugins to call. Without instructions constraining this, it may call connectors or Power Automate flows in unintended sequences.
4️⃣ Data Leakage
Agents often have access to SharePoint, Dataverse, or other enterprise data. An unconstrained agent may surface data to users who shouldn’t see it.
✅Mitigation
Ensure all generative orchestration components have well-defined instructions that specify the agent`s purpose, boundaries, and allowed actions.
Well defined instructions behave as guardrails
Regularly review and update instructions to maintain security and prevent misuse.
🔎Detection
To find Orchestration used in agents, you can use the Microsoft 365 E7 (Agent 365) licensed feature Defender for Cloud Apps | AI Agent Inventory described in this blog.
The official detection KQL query AI Agents — Published Orchestration without instructions from Microsoft has the following code at the bottom.
| where isempty(Instructions)Copilot Studio stores instructions with newline characters or spaces, which means the that even though the instructions look empty in the UI, there results is always No results found in the specified time frame.. Advise is to replace the line with the code below.
| where strlen(trim(@"[\s\r\n]", Instructions)) == 0Prompt Injection
If you want to play with prompt injection yourself, try HackTHeAgent
I hope this blog help people to learn and understand Security in Microsoft Copilot Studio AI Agents and gives some guidance.
