Microsoft Copilot (Microsoft 365): Use Dataverse Business Skills in Sales Agent

🚨 The Signal: Copilot for Sales can now use Dataverse Business Skills, allowing AI agents to follow organisation-specific sales processes and policies. This introduces new avenues for data exposure and requires careful governance of AI agent behaviour.

The Impact

Security teams and administrators are affected by new risks related to AI agent data access and instruction integrity.

• Security Teams: Risk of sensitive data exposure if Business Skills are not properly secured.
• Administrators: Need to manage and secure Dataverse Business Skills and control AI agent access.
• End Users: Potential for AI agents to access or process data beyond intended scope if not configured correctly.

The Action

1. Review Dataverse security roles and permissions for Business Skills to ensure least privilege.
2. Implement data loss prevention (DLP) policies for Dataverse to monitor and restrict sensitive data sharing by AI agents.
3. Establish a governance framework for authoring and managing Business Skills, including review and approval processes.
4. Regularly audit AI agent interactions and data access logs to detect anomalous behaviour.
5. Educate users and administrators on the responsible use and limitations of AI agents and Business Skills.

Domain: Agentic-AI · Impact: high · Workload: Other