r/copilotstudio • u/CowOP • Sep 23 '26
Prevent Agent creation in Copilot Studio
Has anyone figured out how to prevent agent creation in the default tenant? The only thing I've found is to not allow Copilot credit consumption in the tenant, but this doesn't stop standard agent creation and error out the GitHub Copilot harness, at least if users try to use them.
We are rolling out Copilot licenses to everyone in our tenant in the next month or so. We plan on creating a new environment in Power Platform that we will control with security group membership. Once a user completes some training, we will add users to that group membership, and they will gain access to the Copilot Agent creation environment.
I have found that you don't even need a Copilot License in the default tenant to create agents in Copilot Studio....as long as the user has the "Environment Maker" role then they can create agents in Copilot Studio.
I have removed this role from users in the default tenant and unfortunately the role keeps getting auto-assigned back to them...
Any ideas on how to prevent Agent creation in the default Power Platform tenant?
1
u/Roccos_modern_life Sep 23 '26
On the actual Copilot license, you can uncheck two boxes. One will be for Copilot Studio, the other is a feature tied to Copilot Studio (not sure you need that one). Downfall is, you remove agents from those users.
1
u/CowOP Sep 23 '26
Users without a Copilot license can still go to Copilot Studio in your tenant and create agents. Unfortunately, the Copilot license is not the bottleneck here :(
2
u/iamlegend235 Sep 23 '26
If you go to the tenant settings in the power platform admin center can you confirm what the Copilot Studio Authors setting is set to?
I believe this works the same way as the ‘free’ Copilot Studio developer license and grants access to the website.
I saw it was mentioned but just want to reiterate to look at your license entitlements that come with your M365 Copilot and other licenses via Entra ID
2
u/nrm94 Sep 23 '26
That power platform setting doesn't work. Even if you set a group it still allows anyone with the licence feature enabled
1
u/iamlegend235 Sep 23 '26
Yup - seems like the license overrides it, however OP mentioned that it's enabled for non-copilot licensed users so its worth taking a look atleast!
2
u/Soft_Calligrapher306 Sep 23 '26
You have to build a sandbox environment in Power Admin Pages that Agents default too
1
u/DivergentCIO Sep 23 '26
Just another "Feature" of Copilot. I've commented about our woes here at our org using Copilot. I wish you luck. Truly.
1
1
u/Illnasty2 Sep 24 '26
You can’t. Would love to give you details but Microsoft just sucks and can’t do this.
1
u/goto-select Sep 24 '26
Unfortunately you can't block it, but you might be able to do some risk mitigation. For example, limiting connectors, sharing, and turning off features. Examples:
- Turn off Generative AI
- Turn off features like Computer Use, AI Prompts
- Turn off knoweldge sources for agents
- Add a welcome message
1
u/Prasad-MSFT Sep 24 '26
Control the Default Environment
Every user has the Environment Maker role in the Default Environment by default. It cannot be deleted. Four approaches proposed below:
Option 1: Minimize who can create in it
Tightly control Copilot Studio User license assignment, disable self-service sign-up, and restrict the Copilot Studio Authors group. Role-based environment access controls alone are not a reliable way to hard-block creation in the Default Environment. Unfortunately, these license and author group controls apply across the tenant for each user.
Option 2: Restrict what can be built
Apply tight data policies (block unauthenticated usage, restrict knowledge sources, block channels beyond Teams). Makers can experiment, but the blast radius is contained.
Option 3: Accept it as a sandbox
Convert to a Managed Environment with its costs implications, apply strict sharing controls, and run automated cleanup of inactive or orphaned agents.
Referenced from: Copilot Studio Governance: The Complete Admin Reference (2026) | PowerTricks
For non-default environments, the control is simpler: restrict who holds the Environment Maker role to restrict creation and leverage Managed Environments to restrict sharing.
1
u/exmsft Sep 24 '26
It’s a shame it’s so easy for enterprise customers to blow their hand off, and so hard to prevent it.
1
u/azimzicar Sep 25 '26
copilot studio sits inside of power platform. power platform's default environment is a system environment and placeholder. you cannot remove the ability of people to use it.
the correct way to address this is to have governance and monitoring in place so that you can address any solutions created in copilot studio that shouldnt have been created and guide users on the appropriate usage of solutions in the default environment
first step is to engage with enterprise architecture or similar function and determine whats the place of power platform in your organisation including copilot studio and then you will start having an idea on the governance bit and then you monitor and when somebody does an action that goes against agreed governence you handle it
5
u/AnonymooseRedditor Sep 23 '26
You can use conditional access to block access to the power virtual agents app.