Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
You can control and limit how agents are shared in your tenant by applying the Editor and Viewer permission assignments to individuals who need to access Copilot Studio, and then configuring the permissions for who can share with whom.
You configure the sharing limits for agents as a Managed Environments control in the Power Platform admin center. You can configure these controls for an individual Managed Environment, or you can apply the sharing controls at scale using Environment Groups and Rules in the Power Platform admin center.
Note
Sharing rules are enforced when users try to share an app, flow, or agent. This enforcement doesn't affect users who already have access to the app, flow, or agent before you apply the rules. However, if an app, flow, or agent becomes out of compliance after rules are set, it's only possible to stop sharing it. Sharing becomes possible again when the app, flow, or agent complies with the new rules.
After sharing rules are set in the Power Platform admin center, it might take up to an hour for them to start being enforced.
Sharing limits only apply to agents that require authentication. Learn more in Configure user authentication.
Sharing rules in Dataverse for Teams environments don't affect sharing to a Teams team when you publish an agent to Teams. However, when a user attempts to share an agent with individuals or groups in a team other than the one bound to the environment, the sharing limits are enforced.
Learn more about setting sharing limits for canvas apps, flows, and agents in Limit sharing in the Power Platform admin documentation.
Use the Editor and Viewer roles to control sharing
When you set sharing controls in the Power Platform admin center, you can enforce how makers share Editor or Viewer assignments with other individuals for their agents in Copilot Studio. Learn more about setting assignments in Limit sharing in the Power Platform admin documentation.
The remainder of this article describes how the assignments affect who can share and how.
Important
Editor permissions can only be given to individual users.
You can't grant Editor permissions to security groups.
The Editor assignment allows makers to edit, configure, share, and publish their content, while makers with the Viewer assignment can only chat with the agent.
| Sharing rules | System behavior when selected | When not selected |
|---|---|---|
| Let people grant Editor permissions when agents are shared | Can share with any individual assigned as an Editor. | Can't share with an individual assigned as an Editor. This control doesn't affect the ability to share with viewers by owners or editors. |
| Let people grant Viewer permissions when agents are shared | Can share with any individual assigned as a Viewer, and any security groups. | Can't share with an individual assigned as a Viewer. The owner or any other editors can't share with a security group. This control doesn't prevent owners/editors from sharing their agents with individuals as editors. |
| Only share with individuals (no security groups) | Owners/editors can only share with individuals assigned as a Viewer. They can't share with a security group. | Editors and owners can share with individuals (assigned as a Viewer) and security groups. |
| Limit number of viewers who can access each agent | If Only share with individuals (no security groups) is selected, you can control the maximum number of viewers with whom an agent can be shared with. | There's no limit on the number of individuals you can share with. |
Control sharing of agents that use maker-provided credentials
When makers add tools to an agent, they can configure connections to use their own credentials at runtime. When an agent uses such a connection, other users of the agent can perform operations by using the permissions associated with the maker's credentials.
Administrators can use the Sharing agents with embedded maker credentials setting in the Power Platform admin center to prevent agents from being shared when they contain connections configured to use maker credentials that other users aren't permitted to reuse. The underlying connection determines whether the agent can be shared or reused.
When you enforce this setting, Copilot Studio evaluates the connections used by an agent and can prevent the agent from being shared or published when a connection violates the organization's connection-sharing policy.
Important
This setting affects connections that use maker-provided credentials. Connections configured to use end-user credentials aren't subject to this connection-sharing restriction because each user authenticates by using their own connection at runtime.
Learn more in Control sharing agents with embedded maker credentials and Sharing agent with embedded maker credentials (preview).
What happens when the policy is enforced
Copilot Studio checks whether an agent uses a maker connection that you can't share. The behavior depends on how the agent and its connections are configured.
Agent behavior when sharing
You can't share an agent that violates a connection-sharing security policy with a user who has viewer or end-user access.
Similarly, you can't share the agent with everyone in your organization for end-user access.
The sharing experience displays an error message and identifies the affected target.
Agent behavior when publishing
Publishing is also blocked when an agent contains a connection that violates the connection-sharing policy. For authenticated agents, an agent that you didn't share can publish successfully, while an agent you already shared with another user is blocked from publishing when enforcement applies.
When Copilot Studio detects a blocking condition before publishing, the Publish option is unavailable and makers are directed to review the agent's status.
Agent status
Copilot Studio surfaces connection-sharing violations in Agent status. For an authenticated agent that you didn't share, a warning appears indicating how many connections violate the administrator's connection-sharing policy.
For an agent that you already shared, the validation reports the violation as a critical error.
Tools that violate the policy
Makers can see which tools are affected. These tools are marked as Blocked with a Sharing policy violation message explaining that a connection violates the administrator's connection-sharing policy.
If a tool is also restricted by a data policy, Copilot Studio surfaces the Data policy violation message instead.
Resolve a connection-sharing violation
If Copilot Studio identifies a violating tool or connection, the maker must change the agent configuration before it can be shared.
For tools that support it, configuring the connection to use end-user credentials avoids reusing the maker's credentials. Each end user instead signs in with their own credentials at runtime.
Related information
- Managed environments overview in the Power Platform admin documentation
- Limit sharing in the Power Platform admin documentation