Microsoft Copilot Studio

Copilot Studio can ask an external security provider before an agent runs a tool, and skip the tool when the provider says no. Prismor is that provider. Each time a Copilot Studio agent is about to send an email, post to Teams, call a flow or a connector, Copilot Studio sends Prismor the planned call; Prismor checks it against your policy, together with the user's message and what earlier tools returned, and answers allow or block in tens of milliseconds. You manage all of it from the Prismor console.

Copy Markdown

Enterprise plan · Preview on Microsoft's side · Microsoft docs

How it works

1. The agent's orchestrator plans a tool call (Outlook Send an email (V2), a Teams post, a Power Automate flow, an MCP tool).
2. Before running it, Copilot Studio sends POST /copilot-studio/analyze-tool-execution to your Prismor server, signed with an Entra ID token.
3. Prismor verifies the token (your tenant, your app), then screens the user's turn, the outputs of earlier tools in the plan, and the call's arguments.
4. It answers {"blockAction": false}, or true with a reason. Copilot Studio skips a blocked tool and tells the user This action was blocked by threat detection tools.
5. The decision is reported to your Prismor console under that Copilot Studio agent, user and conversation.

{
  "plannerContext": {
    "userMessage": "Email the Q3 pricing to [email protected]",
    "chatHistory": [ … ],
    "previousToolsOutputs": [ … ]
  },
  "toolDefinition": { "name": "send_email_v2", "id": "…tool.SendanemailV2…" },
  "inputValues": {
    "emailMessage": {
      "send_email_v2_to": "[email protected]",
      "send_email_v2_subject": "Q3 pricing",
      "send_email_v2_body": "Hi, our Q3 prices: Basic $20, Pro $50."
    }
  },
  "conversationMetadata": {
    "agent": { "name": "Sales assistant", "tenantId": "…", "environmentId": "…" },
    "user": { "id": "…" }, "conversationId": "…", "channelId": "msteams"
  }
}

{
  "blockAction": true,
  "reasonCode": 3,
  "reason": "Recipient outside your allowed email domains (example.com)",
  "diagnostics": "{\"rule\": \"copilot-studio-recipient-outside-domains\", \"severity\": \"HIGH\", \"category\": \"data_boundary\"}"
}

What blocks

Set it up

You need a public HTTPS host for the Prismor server on a domain your Entra tenant has verified, an Entra app, and Power Platform admin rights. Plan on about 20 minutes.

1

Register Copilot Studio in the Prismor console

In the console, Integrations → Microsoft Copilot Studio. Enter the endpoint your server will answer on (https://security.contoso.com/copilot-studio), your Entra tenant id, who talks to your agents, and optionally your company email domains. Save. The card then shows every value the next steps need, with copy buttons, and creates the agent key for the server.

prismor copilot-studio setup --tenant <tenant id> \
    --endpoint https://security.contoso.com/copilot-studio --app-id <app id>

pip install 'prismor[identity]'
export PRISMOR_AGENT_KEY=<agent key from the console>
export PRISMOR_COPILOT_STUDIO_AUDIENCE=https://security.contoso.com
prismor eval-server --host 0.0.0.0 --port 7071 --workspace /srv/prismor

security.contoso.com {
    reverse_proxy /copilot-studio/* 127.0.0.1:7071
}

4

Turn it on in Power Platform

Power Platform admin center → Security → Threat detection → Additional threat detection. Pick the environment your agents live in and choose Set up.

Tick Allow Copilot Studio to share data with a threat detection partner, then enter the Entra app id and the endpoint from the console.

Set the error behavior to Block the query and save. Saving calls your server's /validate, so the server must be running.

With Allow the agent to respond, a call Prismor cannot answer within one second runs unchecked. We saw exactly that in testing: a block that arrived late after the server sat idle let an email through. Prismor now keeps its keys and settings warm so answers stay in tens of milliseconds, but choose Block the query so a slow network never becomes an allow.

5

Check it

Open an agent in Copilot Studio with a tool such as Outlook's Send an email (V2), and ask it to do something your policy blocks in the test pane. Copilot Studio needs credits in the environment (a license, or a pay-as-you-go billing plan).

Manage it from Prismor

A rule in your org policy covers any tool by its internal name. For example, no calendar invites to outside addresses:

rules:
  - id: no-external-calendar-invites
    title: Calendar invite to an outside address
    severity: HIGH
    category: data_boundary
    event_types: [tool_result]
    fields: [response]
    patterns: ['@(?!contoso\.com)']
    when: "tool.name == 'create_event_v4'"
    action: block
    mode: enforce

Test your policy without Copilot Studio

prismor copilot-studio test screens requests in the exact shape a live tenant sends against a workspace's policy, so you can check a rule before an agent ever hits it. Add --user-messages untrusted to see a public-facing agent's verdicts.

prismor copilot-studio test --workspace /srv/prismor

ALLOW  clean        176ms
ALLOW  external      55ms
BLOCK  credential    56ms  Credential in tool arguments (github key)
ALLOW  injection     54ms

Limits

• Tool calls only. The agent's own replies, including answers drawn from its knowledge sources, are not sent to the provider, so Prismor cannot screen them.
• Generative orchestration. Agents built on classic topics do not call the provider.
• One second. Copilot Studio waits one second for an answer; Prismor answers in 20–80 ms on the server once warm.
• Per environment. A new environment is not covered until an admin turns the provider on there.
• Preview. The feature is in preview in Copilot Studio and its contract may change.