Product and intended use
Define the configuration, people, information and tasks being assessed.
Platform versus each published agent
Not confirmed
This profile is the Copilot Studio platform in a Power Platform environment. Licensing is tenant-wide capacity packs and/or Azure pay-as-you-go. Internal agents used by Microsoft 365 Copilot-licensed users may be included. Each published agent (channels, connectors, knowledge, authentication) needs its own assessment. Consumer Copilot and licensed Microsoft 365 Copilot are separate products.
Ask: Which environments, agents, channels and credit packs are in scope, and is PAYG overflow on?
AU storage; generative inference may leave AU
Public claim only
Customer data can be stored in Australia East/Southeast. Generative Copilot features for Australia-hosted environments process Azure OpenAI in-region or in the United States; Bing Search is stored and processed in the United States. Cross-region movement is on by default for GA generative features unless an admin does not consent. Regional storage does not prove regional inference.
Ask: Is our environment in Australia, is cross-region data movement off, and where does Azure OpenAI actually run?
Agents, knowledge, actions, channels, GenAI
Public claim only
Makers build agents with knowledge sources, actions/connectors/skills, HTTP requests, publication to channels, Application Insights and triggers. Generative AI is powered by Azure OpenAI and Bing Search. Tenant admins can disable publishing of GenAI-powered agents. Environment admins can disable GenAI features that require data movement outside the region.
Ask: Which generative features, channels and connectors will be allowed in the production environment?
AU datacentres; US Bing; possible US OpenAI
Public claim only
Australia is a listed Power Platform geography. EU Data Boundary applies only if the tenant billing address is in the EU/EFTA and all environments are created inside the EUDB. An Australian billing address does not create an EU-style boundary. Bing Search processing for Australian environments is in the United States.
Ask: Name the Azure OpenAI and Bing countries for our AU environment with cross-region movement off versus on.
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Published channels can talk to clients
Not confirmed
Agents can be published to channels, including unauthenticated web use unless blocked by data policy. That is a client-facing disclosure of whatever the agent retrieves. Unauthenticated agents and most channels can be blocked in a restrictive DLP policy.
Ask: Will any agent be client-facing or unauthenticated, and what will we tell clients it can see?
Azure OpenAI and Bing
Public claim only
Generative features are powered by Azure OpenAI Service and Bing Search. Microsoft states prompts/outputs are not used to train, retrain or improve Azure OpenAI foundation models. Other models can be configured; Anthropic in Microsoft Online Services is a separate admin path.
Ask: Which model endpoint and Bing setting does each production agent use?
Azure OpenAI, Bing, connectors
Public claim only
Azure OpenAI and Bing Search are named for generative features. Connector destinations are additional processors chosen by the maker. Optional Anthropic/OpenAI Copilot subprocessors may apply if those routes are enabled at tenant level. Microsoft Online Services DPA covers the platform; Bing has separate handling when used as search.
Ask: List Azure OpenAI region, Bing on/off, and every connector destination for production agents.
No training of Azure OpenAI foundation models
Public claim only
When cross-region movement is allowed, Microsoft says it does not use the data to train, retrain or improve Azure OpenAI Service foundation models. Fine-tuning would be a separate Azure Foundry/OpenAI feature, not this Studio default.
Ask: Confirm no fine-tune or customer-data training is enabled on the Studio-linked Azure OpenAI resource.
Application Insights and maker telemetry
Not confirmed
Azure Monitor Application Insights can be enabled per agent and is DLP-governable. That can send conversation telemetry outside the agent. In-product user feedback was not specified on the pages reviewed.
Ask: Is Application Insights on for production agents, and what does it collect?
Geography storage; Bing US; conversation logs unspecified
Not confirmed
Customer data storage follows the environment geography, with possible in-geo replication. Bing search data for generative features is stored in the United States. Default retention of agent transcripts was not numbered on the pages reviewed.
Ask: What is transcript/conversation retention in our environment, and can we set 30 days?
Environment offboarding via Power Platform / DPA
Not confirmed
Deletion follows Power Platform environment deletion and the Microsoft DPA. This review did not extract a Studio-specific certified-deletion period for transcripts, connector caches or Bing copies.
Ask: On agent or environment deletion, what is removed from Dataverse, Azure OpenAI, Insights and Bing, within how many days?
Microsoft support plus maker access
Public claim only
Makers and admins with environment rights can see agent configuration and, depending on logging, conversations. Microsoft support follows Power Platform practices. Customer Lockbox eligibility should be confirmed.
Ask: Who in the firm can read production transcripts, and is Lockbox on?
DLP, environments, authentication
Public claim only
Data policies can restrict maker/user authentication, knowledge, actions, HTTP, channels, Insights and triggers, and can be applied to one environment, a group or the tenant. Unauthenticated web use can be blocked. Internal agents can be limited to groups. Connections should require strong authentication.
Ask: Show the production DLP policy, authentication requirement and who can publish.
Industry-standard encryption claimed
Public claim only
Geographic residency article: data encrypted at rest and in transit with industry-standard protocols. Customer-managed keys via Key Vault are documented for secrets, not clearly for all transcript stores.
Ask: Does CMK/Key Vault cover agent transcripts and knowledge indexes in the AU environment?
GDPR, EUDB optional, multiple certifications cited
Public claim only
Copilot Studio documents GDPR DSR/DPIA support, EU Data Boundary when billing and environments are in the EU, and 'multiple standards certifications'. Reports were not downloaded. Power Platform is an Azure/Online Service under Microsoft compliance offerings.
Ask: Provide current SOC 2 / ISO 27001 scope for Copilot Studio and our AU geography.
Microsoft Product Terms and DPA; Bing terms if search on
Public claim only
Platform use is under the Microsoft Customer Agreement / EA, Product Terms and DPA. Cross-region generative features require admin consent to terms of use in the Power Platform admin centre. Bing Search, if enabled, has US processing. Liability follows the Microsoft agreement.
Ask: Confirm Copilot Studio is on our DPA and whether Bing consent is recorded for the AU environment.
AU store; US Bing; OpenAI may be US
Public claim only
Table: Australia-hosted environments send Azure OpenAI traffic in-region or to the United States, and Bing Search data to the United States, when cross-region movement is allowed. Connector destinations add further countries. EUDB does not apply to a typical AU tenant.
Ask: With cross-region movement off, which generative features still work, and which countries remain?
Online Services / Power Platform process
Not confirmed
Incidents follow the Microsoft DPA for Online Services. No Studio-specific hour count was extracted. A credit-exhaustion outage of a client-facing agent is an availability incident as well as a security one.
Ask: Within how many hours are we notified of a Studio or connector incident affecting client data?
GA generative features on by default
Not confirmed
Generally available Copilots and generative AI features are turned on by default; cross-region movement may be required to use all of them. Makers can add connectors after go-live unless DLP blocks them. Capacity-pack enforcement can disable agents without a security change.
Ask: Who approves new connectors, channels or GenAI features, and what is the change window?
Export the agent and environment data
Not confirmed
Implementation guidance includes lifecycle monitoring and rollback. No public bulk-export format or certified deletion of transcripts, knowledge indexes and Bing copies was found.
Ask: How do we export agent definitions, transcripts and knowledge on exit, and when are remaining copies deleted?
Maker-chosen destinations; DLP is the control
Not confirmed
The agent maker is responsible for destination data flow. Admins can review connector dependencies before deployment and restrict individual connectors in a data policy. HTTP requests and skills are separate controls. VNet support can keep some traffic private.
Ask: Which connectors are allowed in production, and how do we block new ones without a ticket?
Bing Search; US processing; admin consent
Public claim only
Bing Search is a named generative-AI dependency. For Australia-hosted environments, Bing data is stored and processed in the United States. Admins consent to Bing (with cross-region movement and Microsoft 365 services) in the Power Platform admin centre. Turning off Bing does not disable all Copilot features.
Ask: Is Bing Search on for the production environment, and can agents still meet the use case with it off?
Actions, HTTP, triggers, unauthenticated channels
Not confirmed
Agents can call actions, connectors, skills, HTTP and triggers. Unauthenticated web channels and most connectors can be blocked by DLP. Publishing of GenAI-powered agents can be disabled tenant-wide. There is no described global kill-switch beyond unpublishing, disabling GenAI, or exhausting/removing credits.
Ask: Which actions can run without a named approver, and how do we unpublish all production agents immediately?
Maker and user; not a legal sign-off product
Not confirmed
Guidance is to evaluate and roll back agents, require authentication, and limit internal agents to groups. No clause requires a qualified lawyer to approve each agent response. Client-facing agents need a human-review design of the firm's own making.
Ask: What human review sits in front of any client-visible or file-writing action?
