Updated 8 October 2026: Microsoft is retiring Restricted SharePoint Search, so this post now points to Restricted Content Discovery and SharePoint Advanced Management instead.
Why Copilot Studio agents are in scope
The ASD Essential Eight Maturity Model (Australian Signals Directorate, 2025 revision, cyber.gov.au) (Australian Cyber Security Centre — Essential Eight Maturity Model, accessed 16 June 2026) defines application control as the prevention of execution of unapproved or malicious programmes. The 2025 revision extended this control language to managed agents — software-as-a-service automation that can act inside a production tenant — bringing Copilot Studio agents directly into scope. A Copilot Studio agent can call connectors, traverse SharePoint sites, send Teams messages, write to Dataverse, and invoke external HTTP endpoints. Without administrative gating, every Copilot Studio licensed user is effectively a publisher of executable code into the production tenant.
This how-to covers the practitioner configuration path for Australian organisations targeting Maturity Level 2 alignment for the Copilot scope. It complements the broader 2026 Copilot Essential Eight Maturity Level 2 mapping and is a prerequisite for the IRAP-format evidence pack.
The four moving parts
Application control for Copilot Studio at Maturity Level 2 has four moving parts that must be configured and documented together: publishing gates in the Copilot Control System, approved-publisher scoping in the Power Platform admin centre, connector governance for the connectors agents can call, and the agent register that records the approval chain. Each part has a configuration path, an attestation requirement, and an evidence artefact.
Step 1 — Enable Copilot Control System publishing gates
The Copilot Control System (Microsoft, March 2026 update; documented at learn.microsoft.com under "Copilot Control System overview") consolidates Copilot governance into a single administrative surface in the Microsoft 365 admin centre.
Configuration path: Microsoft 365 admin centre → Copilot → Copilot Control System → Agent governance → Publishing gates. The recommended Maturity Level 2 settings are: require approval for all tenant-wide publishing; set the approver to a designated security group (not an individual); enable agent metadata capture (publisher, scope, connector list); require a business justification before approval; enable approval-event logging to Microsoft Purview Audit.
With publishing gates enabled, a Copilot Studio maker can develop and test an agent in a sandbox environment, but the action of publishing to production users triggers the gate. The approver receives an in-app notification, reviews the agent metadata, and either approves or rejects with a documented reason. Both decisions are written to the unified audit log — the artefact an IRAP assessor will request.
Step 2 — Scope approved publishers via the Power Platform admin centre
Copilot Studio is hosted on the Power Platform. Even with Copilot Control System publishing gates enabled, the underlying ability to author an agent is governed by Power Platform environment access. Maturity Level 2 alignment requires restricting agent authoring to a designated security group of approved makers — not every user with a Copilot Studio licence.
Configuration path: Power Platform admin centre (admin.powerplatform.microsoft.com) → Environments → select the production environment → Settings → Users and permissions → Security roles. Assign the Copilot Studio Maker role only to members of the approved-makers security group. For Maturity Level 2, the approved-makers group should be reviewed every ninety days against organisational role changes, with a named owner.
Create a separate development environment for makers who are not yet approved. The development environment should have no connections to production data sources, no production connector references, and a clear naming convention indicating non-production status. The ASD Blueprint for Secure Cloud language on segregating development and production environments applies directly here.
Step 3 — Curate the connector allow-list
Power Platform connectors are the mechanism by which a Copilot Studio agent reaches data outside Microsoft 365 — Salesforce, ServiceNow, SAP, custom REST endpoints, and the broader connector library. From an Essential Eight perspective, every approved connector is a potential data egress channel. Maturity Level 2 alignment requires that the connector library is curated, not open by default.
Configuration path: Power Platform admin centre → Policies → Data policies → New policy. The recommended Maturity Level 2 data loss prevention policy structure is: classify approved connectors into a Business group (allowed to share data with each other), classify connectors with weaker authentication into a Non-Business group (allowed but not allowed to share data with Business connectors), and block the entire Blocked group of connectors that are not approved for use. Custom connectors — connectors built in-house by makers — should default to Blocked until reviewed and approved.
Practitioner note: the HTTP with Azure AD connector and the HTTP connector deserve special attention. Both allow arbitrary outbound calls and are common sources of data egress in unmanaged tenants. They should be in the Blocked group by default, with exceptions granted only to named agents with documented business justification.
Step 4 — Maintain the agent register
The agent register is the operational artefact that holds the application control regime together. Practitioner experience across Australian tenants suggests a simple structure works best — a single document or list with one row per approved agent and the following fields per row.
| Field | Purpose |
|---|---|
| Agent name | The published name visible to users |
| Publisher | The approved maker who published the agent |
| Business owner | The named role responsible for the agent's continued operation |
| Data scope | Connectors used, SharePoint sites referenced, Dataverse tables read or written |
| Approval date | The date the Copilot Control System publishing gate approval was granted |
| Approver | The named approver (or security group) who approved |
| Last review date | The most recent ninety-day attestation date |
| Next review date | The scheduled next attestation |
| Status | Active · Deprecated · Retired |
The register should be reviewed every ninety days. A deprecated agent is marked deprecated in the register and disabled in the Copilot Control System within thirty days. A retired agent is removed from the tenant entirely and the register row is kept for the audit retention period (seven years for most Australian regulated industries; consult the Information Security Manual for sector-specific guidance).
What an IRAP assessor will want to see
When a qualified IRAP assessor reviews application control for the Copilot Studio scope under the ASD Blueprint for Secure Cloud, the expected evidence is: a screenshot of the Copilot Control System publishing gate configuration showing the approver group and the logging setting; a screenshot of the Power Platform data loss prevention policy showing connector classification; the current agent register with all fields populated; the unified audit log export for the most recent ninety days filtered for Copilot agent approval events; and the documented review cadence with the named owner.
The companion piece on the Essential Eight evidence pack IRAP-format checklist for Copilot scope walks through the full assembly process and the file structure expected by an assessor. The free EDUC4TE Copilot and Essential Eight Alignment audit will identify whether application control for your Copilot Studio scope is currently aligned, partially aligned, or non-aligned.
Summary
Application control for Copilot Studio agents at Essential Eight Maturity Level 2 is operationally simple but procedurally rigorous. Enable Copilot Control System publishing gates, scope agent authoring to a designated security group, curate the connector allow-list at the Power Platform policy layer, and maintain an agent register with a ninety-day review cadence. The configuration takes a competent administrator a single afternoon; the documentation and attestation rhythm is what carries the Maturity Level 2 alignment forward through each quarterly assessment.
Sources referenced in this article: ASD Essential Eight Maturity Model, Copilot Control System (Microsoft, March 2026 update), ASD Blueprint for Secure Cloud, Information Security Manual.
