Question

A retail company has deployed several Copilot Studio agents across production. One agent uses a custom connector to call an external pricing API, and business users are building their own agents with connectors to social media and public file-sharing services. The security team is concerned that agents could combine business data from Dataverse with these external, unsanctioned connectors and exfiltrate sensitive pricing information. As the solution architect, what is the most effective governance control to prevent this specific risk across the environment?

Accepted Answer

Configure Power Platform data loss prevention (DLP) policies that classify connectors into Business and Non-Business groups so that connectors handling Dataverse data cannot be combined with public file-sharing or social media connectors in the same agent.

Answer

Enable content moderation and jailbreak detection in each agent's generative AI settings to block prompts that request sensitive pricing data.

Answer

Require all makers to add a fallback topic that logs any conversation mentioning pricing so the security team can review the transcripts after the fact.

Answer

Turn on customer-managed keys (CMK) for the environment to encrypt Dataverse data at rest so external connectors cannot read the pricing tables.