Watch agent creation, publishing, sharing and authentication changes¶
Licence and role
Microsoft 365 audit (Standard). Users need an assigned Microsoft 365 licence for Copilot Studio events to be recorded.
Why it matters¶
Copilot Studio logs maker activity to the Microsoft Purview audit log by default. The events that matter most are an agent being published, shared, or having its authentication changed. Reviewing them catches an agent that went public overnight.
Steps¶
- Microsoft Purview portal > Solutions > Audit. Filter Activities for Copilot Studio activities and save the search.
- Review these operations weekly: BotCreate, BotUpdateOperation-BotPublish, BotUpdateOperation-BotShare, BotUpdateOperation-BotAuthUpdate, BotDelete.
- If you use Microsoft Sentinel, send the audit events there and alert on BotUpdateOperation-BotAuthUpdate and BotUpdateOperation-BotShare.
- For every unexpected event, confirm with the agent owner and record the outcome in the tracker.
Impact on users¶
None. Searching the audit log and saving a search change nothing. A Sentinel connector only adds ingestion cost for the events you send.
Rollback¶
Delete the saved search or disable the analytics rule.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Microsoft.Graph (Conditional Access + agent identities), ExchangeOnlineManagement (audit search), Microsoft.PowerApps.Administration.PowerShell (data policies).
Connect first:
Connect-MgGraph -Scopes AgentIdentity.Read.All,Policy.Read.All
Connect-ExchangeOnline
Add-PowerAppsAccount
Note: Microsoft retires Search-UnifiedAuditLog on 15 Oct 2027 (MC1505599). AG04 will move to the Graph AuditLogQuery API before then.
$ops = 'BotCreate','BotUpdateOperation-BotPublish','BotUpdateOperation-BotShare','BotUpdateOperation-BotAuthUpdate','BotDelete'
$e = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -Operations $ops -ResultSize 5000
if (-not $e) { 'No Copilot Studio create/publish/share/auth/delete events in the last 30 days' } else { $e | Group-Object Operations | ForEach-Object { "$($_.Name): $($_.Count)" }; $e | Group-Object UserIds | ForEach-Object { "by $($_.Name): $($_.Count)" } }
How to verify¶
A saved audit search (or SIEM rule) exists for the five operations, and last week's events were reviewed.
Sources¶
This control is in the M365 AI Agent Hardening Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 20 controls.