Copilot Studio (Multi Environment)

Connect Akto Atlas to Microsoft Copilot Studio across multiple Power Platform environments

Overview

The Copilot Studio Multi Environment connector allows you to connect your entire Power Platform tenant to Akto Atlas once. Akto automatically discovers all Power Platform environments in your tenant and provisions application users in each environment, then ingests Copilot Studio conversation transcripts from all of them simultaneously.

Once connected, Akto Atlas automatically:

• Discovers all Power Platform environments in your tenant

• Auto-provisions application users in each environment with the required permissions

• Ingests conversation transcripts from Copilot Studio agents across all environments

• Pairs user prompts with bot responses to reconstruct full conversation flows

• Builds an agent graph for every agent — its connectors, MCP servers, knowledge sources and flows — from the Power Platform inventory API

• Sends traffic to Akto for prompt injection, PII, and policy-violation analysis

Prerequisites

Before setting up the Multi Environment Copilot Studio connector, ensure the following requirements are met. Most setup issues are caused by missing prerequisites - please review them carefully.

1. Supported Power Platform Environments

Per the Microsoft documentation on transcript controls, Microsoft does not persist Copilot Studio conversation transcripts to Dataverse for the following environment types:

• Dataverse developer environments

• Microsoft Dataverse for Teams environments

• Microsoft 365 Copilot agents

Your agents must be deployed to Sandbox or Production environments with Dataverse database enabled. Verify environment types in the Power Platform admin center.

2. Transcript Saving Enabled

The Power Platform environment setting "Allow conversation transcripts and their associated metadata to be saved in Dataverse" must be turned on for each environment. Full details are in the Microsoft transcript-controls documentation.

To verify or enable it for each environment:

1. Open the Power Platform admin center.

2. Go to Manage → Environments → select each environment → Settings.

3. Expand Product → Features → scroll to Copilot Studio agents.

4. Ensure "Allow conversation transcripts and their associated metadata to be saved in Dataverse" is enabled, then Save.

Transcripts take up to 30 minutes to appear in Dataverse after a conversation ends. The default Dataverse retention for transcripts is 30 days; this can be extended (see Change the default retention period).

2.1 Enable via Environment Group (Recommended for Multiple Environments)

Instead of enabling transcript saving one environment at a time, you can create an environment group in the Power Platform admin center and publish the Accessing transcripts from conversations in Copilot Studio agents rule on that group. This enables transcript saving in Dataverse across every environment in the group at once.

1. Sign in to the Power Platform admin center.

2. Select Manage in the navigation pane, then select Environment groups.

3. Select New group.

4. In the Create group pane, enter a Name and Description, then select Create.

5. Select the group you just created, then select Add environments in the command bar. Choose all the environments you want Akto to discover, then select Add.

6. Select the Rules tab for the group.

7. Select the Accessing transcripts from conversations in Copilot Studio agents rule to open its configuration panel.

8. Turn on the setting to allow conversation transcripts and their associated metadata to be saved in Dataverse, then select Save.

9. Select Publish rules in the command bar to apply the rule across every environment in the group.

Only published rules are enforced. If you configure the rule but skip Publish rules, none of the environments in the group will have transcript saving enabled.

For detailed steps, see Microsoft's Create an environment group guide and the full list of available rules.

3. Copilot Studio License

A paid Copilot Studio license must be assigned to the account that owns the agents in each environment. Trial licenses do not always sync conversation transcripts to Dataverse.

4. Akto Data Ingestion Service

Your self-hosted Akto Data Ingestion Service must be deployed and reachable from the Akto Atlas connector. The connector forwards conversation pairs from all environments to this endpoint.

5. Required Permissions

Three distinct sets of permissions are involved in this integration. Note the differences: confusing them is the most common setup mistake.

5a. Permissions for the person running the setup (one-time sign-in, used continuously afterward)

The user performing the setup needs to be a Global Administrator or Power Platform Administrator at the tenant level, because the setup auto-discovers environments and provisions users across all of them.

Signing in is a one-time action, but its result isn't: Akto stores a refresh token from this sign-in and silently renews it on every recurring job run to call the Power Platform inventory API for agent graphs (see 5c). You aren't prompted again, but this identity stays in continuous use — it's not a one-time-only credential.

5b. Permissions for the application user (used by Akto at runtime)

Akto automatically provisions the application user in each discovered environment, using the one-time Microsoft interactive login described in Part 2. This application user is created with default System Administrator access, since it is auto-provisioned across every environment in the tenant rather than configured manually per environment.

At runtime, the connector only reads two tables using this application user:

Privilege	Entity	Logical name	Used by
Read (Organization scope)	Bot	bot	Agent discovery
Read (Organization scope)	Conversation Transcript	conversationtranscript	Traffic ingestion

If you require least-privilege access instead of System Administrator for the auto-provisioned application user, contact Akto support to discuss a custom role setup.

5c. Permissions used for agent graphs (via the signed-in admin's delegated token, not the application user)

Separate from the application user above, Akto's recurring job also calls the Power Platform inventory API — tenant-wide, across every environment — to build each agent's graph of connectors, MCP servers, knowledge sources and flows. This call uses the delegated token from the Part 1/2 sign-in (the Power Platform API > ResourceQuery.Resources.Read permission), not the per-environment application user, since this API only accepts delegated (user) tokens.

Steps to Connect

Part 1 - Create an App Registration in Microsoft Entra

You only need to complete Part 1 once at the tenant level. This app registration allows Akto to authenticate with Microsoft Copilot Studio across all your Power Platform environments.

Register the App

1

Go to Microsoft Entra > App registrations > New registration.

2

Give the app a name (e.g. akto-copilot-studio-multi-env-connector) and set supported account types to Single tenant.

3

Configure the Redirect URI

• Select platform as Web and add the following as the URI:

  https://app.akto.io/copilot/oauth/callback

• Click Register.

You will be prompted to log in once with your Microsoft account when you connect from the Akto dashboard in Part 2.

4

Note down:

• Application (Client) ID

• Directory (Tenant) ID

Create a Client Secret

1

Go to Certificates & secrets > New client secret.

2

Set an expiry and click Add.

3

Copy the secret value immediately: it is not shown again.

Add API Permissions

1

Go to API Permissions > Add a permission.

2

Select the APIs my organization uses tab. Add the following delegated permissions:

• PowerApps Service > User

• Power Platform API > ResourceQuery.Resources.Read

3

Add the following application permission:

• Microsoft Graph > User.Read.All (requires admin consent)

Because User.Read.All requires admin consent, a non-admin user completing Part 2 will hit a "Need admin approval" screen — a tenant admin must sign in or grant consent instead.

Part 2 - Connect from the Akto Dashboard

Why does Akto ask for a Microsoft interactive login?

When you enter your details in the Akto dashboard, you'll be asked to log in to your Microsoft account once per tenant. This one-time login:

• Registers the app you created in Part 1 with the Power Platform admin center

• Lets Akto automate the creation of application users in each environment, so you don't have to create them manually

• Creates each application user with default access (System Administrator), used to fetch conversation transcripts

• Also stores a refresh token for your own sign-in, renewed silently on every recurring job run to fetch agent graph data (see 5c below)

1

Open the Copilot Studio (Multi Environment) Connector in Akto Atlas

1. Navigate to Akto Atlas in your Akto dashboard.

2. Open Connectors.

3. Under Platform Connector, locate the Copilot Studio (Multi Environment) connector card.

4. Select Connect to open the setup dialog.

2

Enter the Azure AD Tenant ID

Paste the Directory (tenant) ID you noted down in Part 1 into the Azure AD Tenant ID field.

• Format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

The multi-environment connector will use this tenant ID to auto-discover and connect to all Power Platform environments in your organization.

3

Enter the Azure AD App Client ID

Paste the Application (client) ID you noted down in Part 1 into the Azure AD App Client ID field.

• Format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

4

Enter the Azure AD App Client Secret

Paste the client secret value you saved in Part 1 into the Azure AD App Client Secret field.

If you did not save the value when it was created, return to the Azure portal, generate a new secret in your app registration, and use the new value.

5

Enter the Data Ingestion Service URL

In the URL for Data Ingestion Service field, enter the base URL of your self-hosted Akto Data Ingestion Service.

• Format: https://ingestion.your-domain.com

• The ingestion service must be deployed and reachable from the connector.

• The endpoint receives conversation pairs from all discovered environments.

6

Complete Microsoft Sign-In

After entering your credentials, you will be taken to the Microsoft login page. Complete the sign-in with an account that has permission to register the app in the Power Platform admin center.

This sign-in is required only once per tenant. See Why does Akto ask for a Microsoft interactive login? above for details.

7

Review Discovered Environments

After completing the sign-in, Akto will automatically discover all Power Platform environments in your tenant. A Review discovered environments section will appear showing:

• Environment name (e.g. "Production", "Default")

• Environment URL (e.g., https://org12345.crm.dynamics.com/)

Review the list to confirm all environments are present. Akto will provision an application user in each environment to read Copilot Studio transcripts.

If you don't see an expected environment, verify that:

• It is a Sandbox or Production environment (not Developer or Teams)

• Transcript saving is enabled in that environment

• You have the appropriate permissions to access it

8

Confirm & Connect

1. Review all entered values and the discovered environments list.

2. Select Confirm & Connect to finalize the integration.

Akto will now:

• Provision application users in each discovered environment

• Start polling Copilot Studio transcripts from all environments every 30 minutes

• Pull the tenant-wide agent inventory on the same schedule to build each agent's graph

• Begin importing conversation data and agent graphs to your Akto dashboard

Conversations should begin appearing in your Akto dashboard within one or two polling cycles, provided transcripts exist in Dataverse for the polling window. Agent graphs populate on the same cycle, independent of transcript availability.

Enabling Agent Graphs on an Existing Connection

Agent graphs shipped after this connector did, so if you connected before the feature existed, it stays off until you opt in — transcript ingestion keeps running unaffected either way.

1

Open the connector's setup guide

Go to Connectors → find the Copilot Studio (Multi Environment) card (already showing Connected) → open its setup guide.

2

Check "Enable agent graphs"

Checking the box alone isn't enough. Agent graphs need the Power Platform API > ResourceQuery.Resources.Read delegated permission (see Required Permissions above) — a scope your original sign-in never consented to if you connected before this feature existed. Until you reconnect, the recurring job silently skips agent-graph publishing; transcripts keep working normally in the meantime.

3

Select Reconnect

This re-runs the Microsoft sign-in from Part 2, forcing a fresh consent screen so the new permission is surfaced and granted. Akto stores the resulting refresh token — now carrying the new scope — replacing the old one.

4

Confirm status still shows Connected

Agent graphs begin populating on the same recurring schedule as transcripts, independent of transcript availability.

Troubleshooting

For common issues and solutions, refer to the single environment documentation. The troubleshooting guide covers most issues that also apply to the multi-environment setup.

Get Support

If you need assistance with the Multi Environment Copilot Studio connector:

• In-app Chat Use the chat widget in your Akto dashboard for instant support.

• Email Support Contact us at [e-mail].