microsoft-copilot-studio
Microsoft Copilot Studio turns the idea of a custom AI assistant into a deployable agent. A maker can describe an agent in natural language, connect approved knowledge, add tools and workflows, test its behavior and publish it to Microsoft 365, Teams, a website or another supported channel.
That accessibility is useful, but “low-code” does not mean low-responsibility. An agent that only answers policy questions is different from one that updates a customer record, submits a refund or runs when an event occurs. The second needs identity, authorization, error handling, auditability and deliberate limits.
This guide explains how to design and operate those agents. For the complete family of consumer and business products, start with our Microsoft Copilot guide. For Copilot inside Word, Excel, Outlook, Teams and other work apps, read our separate Microsoft 365 Copilot guide.
What is Microsoft Copilot Studio?
Microsoft Copilot Studio is a graphical, low-code platform for creating AI agents and agent flows. It sits within Microsoft’s Power Platform ecosystem and combines conversational AI with knowledge retrieval, structured topics, connectors, workflows, analytics and governance.
Microsoft defines an agent as a system that coordinates:
- instructions;
- an AI model;
- conversational context;
- knowledge sources;
- topics;
- tools;
- inputs and variables;
- and triggers.
The result can be as simple as a grounded FAQ assistant or as consequential as an autonomous workflow that notices a business event and takes approved action.
Copilot Studio is not merely a place to change the personality of Microsoft Copilot. It is an authoring and runtime platform for purpose-built agents. A custom agent can stand alone or extend Microsoft 365 Copilot with organization-specific knowledge and actions.
Microsoft’s current Copilot Studio overview describes it as a graphical tool for agents and agent flows, with prebuilt and custom connectors for external systems.
Copilot Studio versus Microsoft 365 Copilot, Power Automate and Azure
The products overlap, but they solve different layers of a problem.
| Product | Primary job | Best fit |
| Microsoft 365 Copilot | Assist a person across work chat and Microsoft 365 apps | Drafting, analysis, meetings, email and work grounded in permitted Microsoft 365 data |
| Microsoft Copilot Studio | Build and govern a specialized agent | Departmental assistants, customer agents, actions, multistep workflows and multichannel deployment |
| Power Automate | Automate deterministic business processes | Rules, approvals, scheduled flows and integrations where the steps are known |
| Microsoft Foundry and Azure AI services | Build model-centric and code-first AI systems | Custom application architecture, model deployment, evaluation, engineering and infrastructure control |
| Azure Bot Service and Direct Line | Connect conversational systems to channels or custom clients | Advanced channel integrations and custom front ends |
Copilot Studio often uses the other layers. An agent can call an agent flow, use a Power Platform connector, surface inside Microsoft 365 Copilot and integrate with Azure services. The important design question is not which product “wins,” but where probabilistic AI should stop and deterministic application logic should begin.
Use the model to interpret intent, summarize information or draft a proposal. Use a flow, API or application rule to validate data, enforce permissions and execute a controlled transaction.
The building blocks of a Copilot Studio agent
Understanding the parts before opening the designer prevents a vague prompt from becoming an ungovernable agent.
| Building block | What it controls | Example |
| Instructions | Role, scope, priorities and behavioral boundaries | “Answer HR policy questions; never infer an employee’s eligibility” |
| Primary model | The model used for orchestration and generation | A production model selected for quality, latency, region and cost |
| Knowledge | Sources used to ground answers | SharePoint policies, Dataverse records, files or approved websites |
| Topics | Curated conversational paths and rules | A structured leave-request conversation |
| Tools | Capabilities the agent can invoke | Retrieve an order, create a ticket or call an API |
| Agent flows | Multistep automation callable by an agent or trigger | Validate a form, request approval and update a record |
| Triggers | Events that start work without a user prompt | A new service case or a scheduled check |
| Variables | Values gathered or passed through a conversation | Customer ID, order number or approval state |
| Channels | Places where the published agent is available | Teams, Microsoft 365 Copilot, a website or custom app |
| Analytics and activity | Evidence about usage, quality and execution | Resolution rate, failed actions and individual activity maps |
An effective agent usually has fewer capabilities than its first brainstorm. Narrow scope improves grounding, testing, permissions and cost estimation.
What can you build with Copilot Studio?
Strong first use cases have a clear audience, bounded data and an observable outcome.
Employee knowledge agent
An internal agent can answer questions about benefits, travel policy or IT procedures using approved SharePoint content. It should retrieve only material the signed-in user may access and send uncertain cases to a human owner.
Customer-support agent
A public or authenticated agent can answer product questions, gather troubleshooting information and create a support ticket. It should not expose internal knowledge or make irreversible account changes without identity and confirmation.
Sales or account assistant
An agent can retrieve CRM context, prepare a meeting brief and draft follow-up tasks. Record changes should pass through permission checks and a defined system of record.
Operations agent
An agent can react to an event, collect information from multiple systems and route an exception. This can be valuable for repetitive coordination, but autonomous triggers and write actions need stronger controls than ordinary chat.
Process intake agent
Instead of presenting a long form, an agent can collect required fields conversationally, validate them and submit a structured request. The authoritative validation belongs in the action or flow, not solely in the model’s interpretation.
Avoid starting with “an agent that can help everyone with anything.” It is difficult to test, expensive to ground and almost impossible to assign to one accountable owner.
Plan the agent before building it
Write a one-page specification with these fields:
- Outcome: What measurable result should the agent improve?
- Audience: Who may use it?
- Scope: Which questions and actions are included?
- Exclusions: What must it refuse, redirect or escalate?
- Knowledge: Which sources are authoritative, and who maintains them?
- Actions: What can it read, propose, create, update or delete?
- Identity: Must the user sign in, and whose credentials execute each tool?
- Risk: What is the impact of a wrong answer or action?
- Human control: Where is confirmation, approval or escalation required?
- Success: Which quality, business, safety and cost metrics determine whether it should remain live?
A support agent, for example, might be allowed to explain a return policy and create a draft return request, but forbidden from approving an exception or issuing money.
How to build an AI agent in Copilot Studio
The interface changes frequently, but the implementation sequence remains useful.
Step 1: Choose the correct Power Platform environment
Do not build a production agent in an arbitrary default environment.
Choose or create an environment with:
- an owner;
- a data classification;
- approved connectors;
- appropriate region and data-movement settings;
- separate development, test and production stages where risk warrants it;
- deployment and rollback ownership;
- and a capacity plan.
Power Platform environments are security and lifecycle boundaries. They help separate departments, data, connectors and administrative policies.
Step 2: Create the agent with a narrow description
Open the Copilot Studio web app and describe the intended agent. Include the audience, task and main boundary.
For example:
Create an internal travel-policy agent for employees. Answer only from approved travel and expense sources, cite the source, ask a clarifying question when the country or expense type is missing, and send policy exceptions to the travel desk.
Treat generated configuration as a first draft. Check every inferred source, instruction and capability.
Step 3: Write operational instructions
Useful instructions say what to do when conditions are imperfect.
Include:
- the agent’s role;
- the authoritative sources;
- answer style;
- required citations;
- questions to ask before an action;
- prohibited decisions;
- escalation conditions;
- and how to handle missing or conflicting information.
Avoid instructions such as “always be accurate” or “never make mistakes.” They express a wish, not an enforceable behavior.
An instruction also cannot replace authorization. “Only show the user their own orders” must be enforced by identity and the backend query.
Step 4: Add and curate knowledge
Copilot Studio uses knowledge with generative answers to ground responses. Microsoft’s knowledge-source documentation currently includes sources such as public websites, uploaded documents, SharePoint, Dataverse and enterprise data through connectors.
| Source | Good use | Main control |
| Public website | Product documentation or public policy | Restrict to authoritative domains and monitor changes |
| Uploaded files | Small, stable reference set | Replace obsolete versions and control environment access |
| SharePoint | Internal documents with Microsoft 365 permissions | Repair oversharing and preserve user-level authorization |
| Dataverse | Structured business records | Apply table, row and role security |
| Enterprise connectors | Approved non-Microsoft or indexed sources | Review connector scope, indexing and data policy |
| Custom data | A source returned through a flow or HTTP integration | Authenticate, authorize and validate every request |
Quality depends on curation:
- remove duplicate and superseded policies;
- give documents clear titles and effective dates;
- separate public and confidential content;
- define which source wins when two disagree;
- keep pages easy to retrieve;
- and assign a human owner to every important source.
More knowledge is not automatically better. A large collection of contradictory files can make the agent less dependable.
Step 5: Choose orchestration deliberately
With classic orchestration, topics and trigger phrases provide more explicit routing. With generative orchestration, the model can select knowledge, topics and tools dynamically from descriptions and context.
| Approach | Advantage | Trade-off |
| Classic orchestration | Predictable routes and easier control for known conversations | More manual authoring and weaker coverage of unexpected wording |
| Generative orchestration | Flexible intent handling and dynamic tool selection | Greater need for excellent descriptions, evaluation and safeguards |
| Hybrid design | Generative coverage with deterministic paths for sensitive work | More architecture and test cases |
Use structured topics for regulated disclosures, identity checks, required questions and high-consequence processes. Generative orchestration is well suited to selecting among safe read tools or answering from a curated knowledge base.
Step 6: Add topics where the conversation must be controlled
A topic is a conversation path made of nodes. It can:
- ask a question;
- store a value;
- evaluate a condition;
- display a response;
- call an action;
- redirect to another topic;
- or end and escalate.
Topics remain useful even in a generative agent. A model should not improvise an eligibility questionnaire if the organization requires five exact questions in a defined order.
Design alternate paths for missing input, rejected authentication, unavailable systems, invalid values, cancellation and human handoff.
Step 7: Add tools and actions
Tools let the agent interact with external systems. Microsoft’s tool documentation describes them as capabilities an agent can use in response to a request or trigger.
A tool needs:
- a precise name and description;
- typed inputs and outputs;
- authentication;
- authorization;
- validation;
- bounded permissions;
- predictable errors;
- and an idempotency strategy where retries could duplicate work.
Bad tool description:
Manage customer accounts.
Better tool description:
Retrieve the status and shipping estimate for one order after the authenticated customer ID has been matched. Read-only. Do not use for refunds, address changes or cancellation.
Give separate tools to materially different actions. A broad “manage everything” connector is difficult for the orchestrator and dangerous for administrators.
Step 8: Build an agent flow
An agent flow can automate a multistep process and return the result to the agent. Microsoft supports visual creation and natural-language creation; its agent-flow guide still tells makers to review the generated plan, confirm connections and test the completed flow.
For a purchase request, the flow might:
- accept a structured request;
- validate required fields;
- look up the cost center;
- write a pending record;
- request human approval;
- update the final status;
- return a reference number.
Do not make a model responsible for calculating whether the user has approval authority. Fetch that from an authoritative identity or finance system.
Use human approval for large payments, external messages, legal commitments, access changes and destructive operations.
Step 9: Configure authentication and execution identity
Copilot Studio supports no authentication, Microsoft authentication and manual authentication with an OAuth 2.0 identity provider. Microsoft warns in its authentication guide that an unauthenticated agent can be used by anyone with the link and should only reach public information.
Ask three separate questions:
- Who can open the agent?
- Whose identity is used to retrieve data?
- Whose connection executes an action?
An authenticated user does not automatically make every backend tool safe. A maker-owned connection can accidentally give every user the maker’s access. Prefer user credentials when the action should respect the user’s permissions, and use a service identity only with narrow scope and explicit business rules.
Authentication changes take effect after republishing, so test the published configuration.
Step 10: Test conversations, retrieval and actions
The test panel is useful for walking through topics, inspecting variables and viewing the activity map. It is not sufficient by itself.
Microsoft’s testing documentation supports reusable test sets and warns that the design-time panel does not reproduce every published-channel behavior, including some background or inactivity-triggered events.
Create test groups for:
- expected questions;
- paraphrases and misspellings;
- missing information;
- conflicting sources;
- permission boundaries;
- prompt injection inside a document or webpage;
- unavailable connectors;
- duplicate action requests;
- cancellation;
- multilingual input;
- unsafe requests;
- and escalation.
For every action, verify both the agent response and the state of the target system.
Copilot Studio now provides agent evaluations and multi-turn conversation testing. Treat a passing score as release evidence, not a permanent certificate. Models, sources, connectors and policies change.
Step 11: Publish to controlled channels
Publishing creates a version that users can access. A channel determines where they interact with it.
Microsoft’s publishing guide lists examples including websites, mobile apps, Microsoft 365 Copilot and Teams. Other deployments can use supported messaging channels or a custom client through Direct Line.
Important publication behavior:
- publishing updates the agent across its connected channels;
- a saved draft is not live until it is published;
- a newly connected channel still needs channel-specific configuration;
- authentication and cards may behave differently by channel;
- and a change should be tested in the actual target channel.
Begin with a limited group. Do not make an internal agent tenant-wide merely because the button permits it.
Step 12: Monitor and improve
Review:
- answer quality;
- source citations;
- failed or unexpected tool calls;
- escalations;
- unresolved sessions;
- latency;
- user feedback;
- safety events;
- capacity use;
- and business outcomes.
Activity records help diagnose what the agent selected and where it failed. Conversation transcripts can support improvement, but they may contain personal or confidential data and need their own access and retention controls.
Set a review cadence and an automatic retirement date for abandoned pilots.
Governance and security
The main Copilot Studio risk is not that a chatbot says something awkward. It is that a broadly connected agent retrieves, exposes or changes something it should not.
Microsoft’s Copilot Studio security overview describes controls for data policies, authentication, knowledge, connectors, HTTP requests, publishing, triggers, audit logs, environment routing and agent runtime protection.
Use them as a system:
Data policies
Power Platform data policies can block or separate connectors, require authentication and restrict capabilities or publication channels. Since 2025, Microsoft has enforced agent data policies tenant-wide rather than allowing agents to be exempted.
Least privilege
Limit maker, editor, viewer, service-account and connector rights. Separate the right to design an agent from the right to approve production data access.
Environment strategy
Route makers to governed development environments. Use solutions and controlled deployment for production rather than editing a live agent casually.
Transcript controls
Copilot Studio normally saves conversation transcripts and metadata to Dataverse. Microsoft’s transcript-control documentation lets administrators prevent saving, restrict who can view or download transcripts and apply settings to environment groups.
The default Dataverse cleanup job removes conversation transcripts older than 30 days, but administrators can change the retention schedule. Disabling saving can reduce analytics, and previously stored transcripts remain until deleted.
Regional processing
Some features or models can require processing outside an environment’s geography. Review regional availability, external models and cross-geo settings before enabling them. A preview model is not an appropriate production default merely because it scores better in a demonstration.
Prompt injection and tool safety
Treat retrieved pages, emails and files as untrusted data. A malicious instruction inside a document should not override the agent’s policy or authorize a tool.
Enforce critical controls outside the model:
- object-level authorization;
- domain allowlists;
- schema validation;
- transaction limits;
- confirmation;
- approval;
- audit logging;
- and safe retries.
Our Microsoft Copilot privacy and security guide compares these controls with the different rules for consumer Copilot and Microsoft 365.
Copilot Studio pricing and Copilot Credits
Copilot Studio is not priced like a normal per-user chatbot subscription. Runtime activity is measured in Copilot Credits. Capacity can come from prepaid packs, pay-as-you-go billing and other eligible entitlements.
Microsoft offers tenant capacity packs and pay-as-you-go billing. The live Copilot Studio pricing page and billing-rate table show why “one conversation” is not a stable unit. A classic or generative answer, action, graph-grounding call, flow, content-processing tool and voice interaction can consume different amounts. Advanced model and tool use can be token based.
Employee-facing use by an authenticated Microsoft 365 Copilot-licensed user can be included rather than charged in several listed scenarios, subject to Microsoft’s conditions and fair-use terms. Other users, triggers and channels can still consume capacity.
Unused monthly pack credits do not roll over. Capacity is pooled at tenant level but can be allocated and monitored by environment. Technical enforcement can affect service when purchased capacity is exceeded.
Build a cost model from activities, not chats:
- list the expected turns and actions in one completed task;
- map each step to its current credit rate;
- multiply by daily tasks;
- separate licensed employee use from other users;
- add retries, testing, seasonal peaks and voice;
- monitor actual activity by environment;
- set alerts and a response for overage.
See our broader Microsoft Copilot pricing guide for the current capacity-pack amount, exact activity rates and how Studio fits beside consumer and Microsoft 365 plans. Keeping those values on one owner page prevents a credit change from leaving conflicting tables across the cluster.
Limitations of Copilot Studio
Copilot Studio removes substantial plumbing, but it does not remove these constraints:
- generated answers can be wrong despite grounding;
- source permissions may be broader than intended;
- tool descriptions can produce unexpected selection;
- connectors and external services can fail;
- published channels behave differently;
- model and preview availability can vary by region;
- autonomous triggers increase consequence;
- transcripts can contain sensitive context;
- usage can be difficult to estimate before a realistic pilot;
- and advanced integrations still require developers and security specialists.
Low-code is best understood as faster composition. The underlying identity, data and operational risks remain real.
Production checklist
Before launch, confirm:
- one accountable business owner and one technical owner;
- documented purpose, users and exclusions;
- governed development and production environments;
- approved knowledge with named content owners;
- authenticated access where private data is involved;
- user-level authorization for every retrieval;
- narrowly scoped tools and connections;
- validation outside the model;
- confirmation or approval for consequential actions;
- data policies for connectors, channels, HTTP and triggers;
- test sets covering normal, adversarial and failure cases;
- testing inside each published channel;
- transcript access and retention settings;
- audit and incident-response procedures;
- usage estimates, capacity alerts and cost ownership;
- human escalation;
- versioning and rollback;
- and a scheduled quality review.
Frequently asked questions
Is Microsoft Copilot Studio the same as Microsoft 365 Copilot?
No. Microsoft 365 Copilot is an assistant across work chat and Microsoft 365 apps. Copilot Studio is the low-code platform used to build specialized agents, including agents that can appear inside Microsoft 365 Copilot.
Can I use Copilot Studio without coding?
Yes, many knowledge and conversation agents can be created with natural language and a visual designer. Custom APIs, complex authorization, advanced cards, application lifecycle management and production troubleshooting can still require technical expertise.
Is Copilot Studio free?
Microsoft offers a trial for authoring and testing, but the trial does not permit publishing. Production use requires eligible licensing or usage-based capacity. Some limited agent capabilities are also included with certain Microsoft 365 plans.
What are Copilot Credits?
Copilot Credits are the usage unit for Copilot Studio agent activities. Answers, grounding, actions, flows, AI tools, document processing and voice can consume different numbers of credits.
Can Copilot Studio connect to SharePoint?
Yes. SharePoint can be used as a knowledge source, with retrieval based on the agent user’s Microsoft Entra ID permissions in supported configurations. Existing SharePoint oversharing can therefore become visible more efficiently; fix permissions before rollout.
Can a Copilot Studio agent update business systems?
Yes. Tools, connectors, APIs and flows can perform actions. Use authentication, deterministic authorization, validation, narrow permissions, confirmation, approval and audit logs.
Where can I publish a Copilot Studio agent?
Supported destinations include Microsoft 365 Copilot, Teams, websites, mobile or custom applications and other supported channels. Exact availability and features depend on plan, region, authentication and channel.
Does Copilot Studio store conversations?
Copilot Studio normally saves agent transcripts and metadata to Dataverse, with a default cleanup job for records older than 30 days. Administrators can restrict access, change retention or disable saving, subject to feature and analytics consequences.
Does Microsoft train AI models on Copilot Studio data?
Microsoft says prompts and grounding data used by its Azure OpenAI-based prompt features are not used to train or improve the foundation models. External models, connected services, optional feedback and feature-specific terms still require review.
Is Copilot Studio suitable for autonomous agents?
It can build agents that react to triggers and complete multistep work. Suitability depends on consequence. Start with reversible, observable tasks and require approval for money, external communication, access, legal commitments and destructive actions.
Bottom line
Microsoft Copilot Studio is a practical bridge between conversational AI and real business processes. Its value comes from combining governed knowledge with tools, flows and multiple publication channels—not from creating another general chatbot.
Start with one bounded job. Curate the knowledge, enforce authorization outside the model, test actions and failures, govern transcripts and connectors, and measure cost per completed outcome. An agent should earn broader permissions through evidence, not receive them on its first day.
byDavid Porter
Loading