Securing the Agent Factory: Security, Governance, and DLP for AI Agents in Power Platform
Session Overview: Your organization just deployed its first AI agent. Congratulations. Now answer these questions: Who can it talk to? What data can it access? Can it call external services? Can a user trick it into bypassing your DLP policies? If you are not confident in your answers, this session is for you.
AI agents in Copilot Studio are not just chatbots. They call connectors, invoke actions, query Dataverse, reach into D365 environments, and now connect to external systems through MCP servers. Every one of those capabilities is a governance surface that your existing Power Platform security model may not fully cover. The gap between “we have DLP policies” and “our agents are actually governed” is wider than most admins realize.
This session walks through the complete security and governance stack for AI agents in Power Platform, starting from tenant-level controls and working down to individual agent behavior. We will cover the Copilot Studio Center of Excellence (COE) Kit and how to use it for monitoring agent usage, credit consumption, and license allocation across your organization. You will see how DLP policies apply to agent connectors and actions, where the current gaps are, and what compensating controls to put in place.
We will get into the details that matter: how to control agent publishing through the Power Platform Admin Center, how to restrict generative AI features by geography, how to set up environment routing so agents land in the right security boundary, and how to audit what your agents are actually doing in production. We will also cover the emerging threat model for agent-based systems, including prompt injection attacks and how to design agent instructions that resist manipulation.
Whether you are a Power Platform admin trying to get ahead of the governance curve or an architect building agent solutions that need to pass enterprise security review, this session gives you the playbook.
Learning Objectives:
- Configure tenant-level and environment-level security controls for Copilot Studio agents, including DLP policies, publishing restrictions, and geographic data residency settings.
- Deploy and use the Copilot Studio COE Kit to monitor agent usage, track credit consumption, and enforce governance policies across the organization.
- Identify and mitigate security risks specific to AI agents, including prompt injection vulnerabilities, unauthorized connector access, and data exfiltration through agent conversations.
Speakers: Sahib Sawhney, Christopher Boose
Recorded at: Community Summit NA 2026
Type: Education Session
Ability Level: 201 – Intermediate
Primary Product: Agents & Copilot
Tracks: Technical (Systems Admin)
Terms: All rights reserved by the speaker, Community Summit NA, and Dynamic Communities and cannot be reproduced or distributed without express written consent by the speaker and Dynamic Communities.
