> For the complete documentation index, see [llms.txt](https://ai-security-docs.akto.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ai-security-docs.akto.io/akto-atlas-agentic-ai-security-for-employee-endpoints/endpoints-discovery-agents/microsoft-copilot-studio-multi-environment.md).

# Copilot Studio (Multi Environment)

## Overview

The Copilot Studio Multi Environment connector allows you to connect your entire Power Platform tenant to Akto Atlas once. Akto automatically discovers all Power Platform environments in your tenant and provisions application users in each environment, then ingests Copilot Studio conversation transcripts from all of them simultaneously.

Once connected, Akto Atlas automatically:

* **Discovers all Power Platform environments** in your tenant
* **Auto-provisions application users** in each environment with the required permissions
* **Ingests conversation transcripts** from Copilot Studio agents across all environments
* **Pairs user prompts with bot responses** to reconstruct full conversation flows
* **Builds an agent graph** for every agent — its connectors, MCP servers, knowledge sources and flows — from the Power Platform inventory API
* **Sends traffic to Akto** for prompt injection, PII, and policy-violation analysis

## Prerequisites

Before setting up the Multi Environment Copilot Studio connector, ensure the following requirements are met. **Most setup issues are caused by missing prerequisites - please review them carefully.**

### 1. Supported Power Platform Environments

Per the [Microsoft documentation on transcript controls](https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-transcript-controls), Microsoft does **not** persist Copilot Studio conversation transcripts to Dataverse for the following [environment types](https://learn.microsoft.com/en-us/power-platform/admin/environments-overview):

* Dataverse **developer** environments
* Microsoft Dataverse for Teams environments
* Microsoft 365 Copilot agents

Your agents must be deployed to **Sandbox** or **Production** environments with Dataverse database enabled. Verify environment types in the [Power Platform admin center](https://admin.powerplatform.microsoft.com).

### 2. Transcript Saving Enabled

The Power Platform environment setting **"Allow conversation transcripts and their associated metadata to be saved in Dataverse"** must be turned **on** for each environment. Full details are in the [Microsoft transcript-controls documentation](https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-transcript-controls#configure-transcript-recording-and-download).

To verify or enable it for each environment:

1. Open the [Power Platform admin center](https://admin.powerplatform.microsoft.com).
2. Go to **Manage** → **Environments** → select each environment → **Settings**.
3. Expand **Product** → **Features** → scroll to **Copilot Studio agents**.
4. Ensure **"Allow conversation transcripts and their associated metadata to be saved in Dataverse"** is enabled, then **Save**.

{% hint style="info" %}
Transcripts take **up to 30 minutes** to appear in Dataverse after a conversation ends. The default Dataverse retention for transcripts is 30 days; this can be extended (see [Change the default retention period](https://learn.microsoft.com/en-us/microsoft-copilot-studio/analytics-transcripts-powerapps#change-the-default-retention-period)).
{% endhint %}

#### 2.1 Enable via Environment Group (Recommended for Multiple Environments)

Instead of enabling transcript saving one environment at a time, you can create an environment group in the Power Platform admin center and publish the **Accessing transcripts from conversations in Copilot Studio agents** rule on that group. This enables transcript saving in Dataverse across every environment in the group at once.

1. Sign in to the [Power Platform admin center](https://admin.powerplatform.microsoft.com).
2. Select **Manage** in the navigation pane, then select **Environment groups**.
3. Select **New group**.
4. In the **Create group** pane, enter a **Name** and **Description**, then select **Create**.
5. Select the group you just created, then select **Add environments** in the command bar. Choose all the environments you want Akto to discover, then select **Add**.
6. Select the **Rules** tab for the group.
7. Select the **Accessing transcripts from conversations in Copilot Studio agents** rule to open its configuration panel.
8. Turn on the setting to allow conversation transcripts and their associated metadata to be saved in Dataverse, then select **Save**.
9. Select **Publish rules** in the command bar to apply the rule across every environment in the group.

{% hint style="warning" %}
Only published rules are enforced. If you configure the rule but skip **Publish rules**, none of the environments in the group will have transcript saving enabled.
{% endhint %}

For detailed steps, see Microsoft's [Create an environment group](https://learn.microsoft.com/en-us/power-platform/admin/environment-groups#create-an-environment-group) guide and the full list of [available rules](https://learn.microsoft.com/en-us/power-platform/admin/environment-groups-rules).

### 3. Copilot Studio License

A paid [Copilot Studio license](https://learn.microsoft.com/en-us/microsoft-copilot-studio/requirements-licensing) must be assigned to the account that owns the agents in each environment. Trial licenses do not always sync conversation transcripts to Dataverse.

### 4. Akto Data Ingestion Service

Your self-hosted Akto **Data Ingestion Service** must be deployed and reachable from the Akto Atlas connector. The connector forwards conversation pairs from all environments to this endpoint.

### 5. Required Permissions

Three distinct sets of permissions are involved in this integration. Note the differences: confusing them is the most common setup mistake.

#### 5a. Permissions for the person running the setup (one-time sign-in, used continuously afterward)

The user performing the setup needs to be a **Global Administrator** or **Power Platform Administrator** at the tenant level, because the setup auto-discovers environments and provisions users across all of them.

Signing in is a one-time action, but its result isn't: Akto stores a refresh token from this sign-in and silently renews it on every recurring job run to call the Power Platform inventory API for agent graphs (see 5c). You aren't prompted again, but this identity stays in continuous use — it's not a one-time-only credential.

#### 5b. Permissions for the application user (used by Akto at runtime)

Akto automatically provisions the application user in each discovered environment, using the one-time Microsoft interactive login described in [Part 2](#part-2-connect-from-the-akto-dashboard). This application user is created with default **System Administrator** access, since it is auto-provisioned across every environment in the tenant rather than configured manually per environment.

At runtime, the connector only reads two tables using this application user:

| Privilege                     | Entity                  | Logical name             | Used by           |
| ----------------------------- | ----------------------- | ------------------------ | ----------------- |
| **Read** (Organization scope) | Bot                     | `bot`                    | Agent discovery   |
| **Read** (Organization scope) | Conversation Transcript | `conversationtranscript` | Traffic ingestion |

{% hint style="info" %}
If you require least-privilege access instead of System Administrator for the auto-provisioned application user, contact Akto support to discuss a custom role setup.
{% endhint %}

#### 5c. Permissions used for agent graphs (via the signed-in admin's delegated token, not the application user)

Separate from the application user above, Akto's recurring job also calls the Power Platform inventory API — tenant-wide, across every environment — to build each agent's graph of connectors, MCP servers, knowledge sources and flows. This call uses the **delegated token from the Part 1/2 sign-in** (the `Power Platform API` > `ResourceQuery.Resources.Read` permission), not the per-environment application user, since this API only accepts delegated (user) tokens.

## Steps to Connect

### Part 1 - Create an App Registration in Microsoft Entra

You only need to complete Part 1 once at the tenant level. This app registration allows Akto to authenticate with Microsoft Copilot Studio across all your Power Platform environments.

#### Register the App

{% stepper %}
{% step %}
Go to [Microsoft Entra](https://entra.microsoft.com) > **App registrations** > **New registration**.

<div data-with-frame="true"><figure><img src="/files/Sqg0ioEFIle6CTBY7p5T" alt="" width="563"><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}
Give the app a name (e.g. `akto-copilot-studio-multi-env-connector`) and set supported account types to **Single tenant**.
{% endstep %}

{% step %}
Configure the Redirect URI

* Select platform as **Web** and add the following as the URI:

  <pre data-overflow="wrap"><code>https://app.akto.io/copilot/oauth/callback
  </code></pre>
* Click **Register**.

{% hint style="info" %}
You will be prompted to log in once with your Microsoft account when you [connect from the Akto dashboard](#part-2-connect-from-the-akto-dashboard) in Part 2.
{% endhint %}
{% endstep %}

{% step %}
Note down:

* **Application (Client) ID**
* **Directory (Tenant) ID**

<div data-with-frame="true"><figure><img src="/files/FhmQvzwpZhUkoczQCE6N" alt="" width="563"><figcaption></figcaption></figure></div>
{% endstep %}
{% endstepper %}

#### Create a Client Secret

{% stepper %}
{% step %}
Go to **Certificates & secrets** > **New client secret**.
{% endstep %}

{% step %}
Set an expiry and click **Add**.
{% endstep %}

{% step %}
**Copy the secret value immediately**: it is not shown again.
{% endstep %}
{% endstepper %}

#### Add API Permissions

{% stepper %}
{% step %}
Go to **API Permissions** > **Add a permission**.
{% endstep %}

{% step %}
Select the **APIs my organization uses** tab. Add the following **delegated permissions**:

* **PowerApps Service** > `User`
* **Power Platform API** > `ResourceQuery.Resources.Read`
  {% endstep %}

{% step %}
Add the following **application permission**:

* **Microsoft Graph** > `User.Read.All` (requires admin consent)
  {% endstep %}
  {% endstepper %}

{% hint style="warning" %}
Because `User.Read.All` requires admin consent, a non-admin user completing [Part 2](#part-2-connect-from-the-akto-dashboard) will hit a **"Need admin approval"** screen — a tenant admin must sign in or grant consent instead.
{% endhint %}

### Part 2 - Connect from the Akto Dashboard

{% hint style="info" %}
**Why does Akto ask for a Microsoft interactive login?**

When you enter your details in the Akto dashboard, you'll be asked to log in to your Microsoft account **once per tenant**. This one-time login:

* Registers the app you created in Part 1 with the Power Platform admin center
* Lets Akto automate the creation of application users in each environment, so you don't have to create them manually
* Creates each application user with default access (**System Administrator**), used to fetch conversation transcripts
* Also stores a refresh token for your own sign-in, renewed silently on every recurring job run to fetch agent graph data (see 5c below)
  {% endhint %}

{% stepper %}
{% step %}
**Open the Copilot Studio (Multi Environment) Connector in Akto Atlas**

1. Navigate to **Akto Atlas** in your Akto dashboard.
2. Open **Connectors**.
3. Under **Platform Connector**, locate the **Copilot Studio (Multi Environment)** connector card.
4. Select **Connect** to open the setup dialog.
   {% endstep %}

{% step %}
**Enter the Azure AD Tenant ID**

Paste the **Directory (tenant) ID** you noted down in Part 1 into the **Azure AD Tenant ID** field.

* Format: `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`

{% hint style="info" %}
The multi-environment connector will use this tenant ID to auto-discover and connect to all Power Platform environments in your organization.
{% endhint %}
{% endstep %}

{% step %}
**Enter the Azure AD App Client ID**

Paste the **Application (client) ID** you noted down in Part 1 into the **Azure AD App Client ID** field.

* Format: `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`
  {% endstep %}

{% step %}
**Enter the Azure AD App Client Secret**

Paste the client secret value you saved in Part 1 into the **Azure AD App Client Secret** field.

{% hint style="info" %}
If you did not save the value when it was created, return to the Azure portal, generate a new secret in your app registration, and use the new value.
{% endhint %}
{% endstep %}

{% step %}
**Enter the Data Ingestion Service URL**

In the **URL for Data Ingestion Service** field, enter the base URL of your self-hosted Akto Data Ingestion Service.

* Format: `https://ingestion.your-domain.com`

{% hint style="warning" %}

* The ingestion service must be deployed and reachable from the connector.
* The endpoint receives conversation pairs from all discovered environments.
  {% endhint %}
  {% endstep %}

{% step %}
**Complete Microsoft Sign-In**

After entering your credentials, you will be taken to the Microsoft login page. Complete the sign-in with an account that has permission to register the app in the Power Platform admin center.

{% hint style="info" %}
This sign-in is required only once per tenant. See [Why does Akto ask for a Microsoft interactive login?](#part-2-connect-from-the-akto-dashboard) above for details.
{% endhint %}
{% endstep %}

{% step %}
**Review Discovered Environments**

After completing the sign-in, Akto will automatically discover all Power Platform environments in your tenant. A **Review discovered environments** section will appear showing:

* **Environment name** (e.g. "Production", "Default")
* **Environment URL** (e.g., `https://org12345.crm.dynamics.com/`)

Review the list to confirm all environments are present. Akto will provision an application user in each environment to read Copilot Studio transcripts.

{% hint style="info" %}
If you don't see an expected environment, verify that:

* It is a **Sandbox** or **Production** environment (not Developer or Teams)
* Transcript saving is enabled in that environment
* You have the appropriate permissions to access it
  {% endhint %}
  {% endstep %}

{% step %}
**Confirm & Connect**

1. Review all entered values and the discovered environments list.
2. Select **Confirm & Connect** to finalize the integration.

Akto will now:

* Provision application users in each discovered environment
* Start polling Copilot Studio transcripts from all environments every 30 minutes
* Pull the tenant-wide agent inventory on the same schedule to build each agent's graph
* Begin importing conversation data and agent graphs to your Akto dashboard

Conversations should begin appearing in your Akto dashboard within one or two polling cycles, provided transcripts exist in Dataverse for the polling window. Agent graphs populate on the same cycle, independent of transcript availability.
{% endstep %}
{% endstepper %}

### Enabling Agent Graphs on an Existing Connection

Agent graphs shipped after this connector did, so if you connected before the feature existed, it stays off until you opt in — transcript ingestion keeps running unaffected either way.

<div data-with-frame="true"><figure><img src="/files/dCuvakQc8zcj0eoTVRKk" alt="" width="563"><figcaption></figcaption></figure></div>

{% stepper %}
{% step %}
**Open the connector's setup guide**

Go to **Connectors** → find the **Copilot Studio (Multi Environment)** card (already showing **Connected**) → open its setup guide.
{% endstep %}

{% step %}
**Check "Enable agent graphs"**

{% hint style="warning" %}
Checking the box alone isn't enough. Agent graphs need the `Power Platform API` > `ResourceQuery.Resources.Read` delegated permission (see **Required Permissions** above) — a scope your original sign-in never consented to if you connected before this feature existed. Until you reconnect, the recurring job silently skips agent-graph publishing; transcripts keep working normally in the meantime.
{% endhint %}
{% endstep %}

{% step %}
**Select Reconnect**

This re-runs the Microsoft sign-in from Part 2, forcing a fresh consent screen so the new permission is surfaced and granted. Akto stores the resulting refresh token — now carrying the new scope — replacing the old one.
{% endstep %}

{% step %}
**Confirm status still shows Connected**

Agent graphs begin populating on the same recurring schedule as transcripts, independent of transcript availability.
{% endstep %}
{% endstepper %}

## Troubleshooting

For common issues and solutions, refer to the [single environment documentation](/akto-atlas-agentic-ai-security-for-employee-endpoints/endpoints-discovery-agents/microsoft-copilot-studio.md#troubleshooting). The troubleshooting guide covers most issues that also apply to the multi-environment setup.

## Get Support

If you need assistance with the Multi Environment Copilot Studio connector:

* **In-app Chat** Use the chat widget in your Akto dashboard for instant support.
* **Email Support** Contact us at <support@akto.io>.