Microsoft Copilot Studio: Discover and use shared plugins in Copilot Studio

🚨 The Signal: Copilot Studio now accesses a shared plugin registry, enabling easier discovery and use of plugins. This expands agent capabilities but introduces new vectors for data access and potential misuse.

The Impact

Security teams and Copilot administrators face increased risk from unvetted plugins accessing sensitive data.

• Security Teams: Risk of unapproved data access by new plugins.
• Copilot Administrators: Challenge in vetting and managing plugin security.
• Data Owners: Potential for sensitive data exposure through plugin actions.
• Compliance Officers: Difficulty in maintaining regulatory compliance with expanded plugin use.

The Action

1. Review and update Copilot Studio governance policies for plugin usage and approval.
2. Implement a formal vetting process for all plugins accessed via the shared registry.
3. Configure data loss prevention (DLP) policies to monitor plugin interactions with sensitive data.
4. Regularly audit Copilot agent configurations and plugin assignments for compliance.
5. Educate Copilot makers on secure plugin development and usage best practices.

Domain: Agentic-AI · Impact: high · Workload: Other · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898