---
name: SharePoint Agent Publishing and Data Source Audit
description: Discovers all Copilot Studio agents published to SharePoint sites as a channel, audits publisher identity, connected knowledge sources, licensing status, site owner approval, and whether agents inherit or override SharePoint sensitivity controls.
---

# SharePoint Agent Publishing and Data Source Audit

> **TL;DR:** This skill inventories every Copilot Studio agent published to a SharePoint site, audits who published it, what data it can access, whether the site owner approved it, and whether SharePoint sensitivity controls govern the agent's grounding content.

## What does the SharePoint agent publishing audit cover?

Copilot Studio agents can be published directly to SharePoint sites as a channel, surfacing as an interactive AI assistant on the site homepage or in a SharePoint page. This creates a governance challenge: agents can be built and published to SharePoint sites by makers in any business unit, connecting to knowledge sources — SharePoint libraries, external connectors, Dataverse tables — without a formal IT review. Each published agent represents a data access path that must be assessed for permission scope, knowledge source sensitivity, and licensing compliance. This skill uses the Copilot Studio admin portal, the PAC CLI, and the Microsoft Graph to produce a complete inventory of SharePoint-published agents and assess their governance posture.

## When should you run this skill?

- "Inventory all agents published on our SharePoint sites"
- "Find agents connecting to sensitive SharePoint libraries without IT approval"
- "Verify all SharePoint agents are properly licensed"
- "Audit agent knowledge sources for OFFICIAL:Sensitive content exposure"
- "Identify SharePoint agents with unlicensed or departed makers"
- "Produce agent publishing evidence for IRAP or PSPF review"

## How this skill works, step by step

1. Open the Copilot Studio admin portal at `admin.powerplatform.microsoft.com` → Copilot Studio → Agents
2. Filter the agent list by channel: SharePoint
3. Export the agent list to CSV: agent name, environment, maker (owner), last modified date, published channels
4. For each SharePoint-published agent, retrieve the SharePoint site URL(s) where the agent is published (visible in agent Properties → Channels → SharePoint)
5. Retrieve the agent's knowledge sources: navigate to the agent → Knowledge → list all connected sources (SharePoint libraries, URLs, Dataverse tables, external connectors)
6. For each knowledge source that references a SharePoint library: check the sensitivity classification of that library and its contents
7. Check the agent's authentication configuration: does it use the end-user's delegated permissions (user context) or a service account / managed identity (elevated context)?
8. Verify licensing: each agent published to SharePoint as a Microsoft 365 Copilot extension requires a Copilot licence for each user interacting with it; standalone Copilot Studio agents require message capacity
9. Identify whether the SharePoint site owner formally approved the agent deployment (check site admin communications or SharePoint site app catalogue)
10. Flag agents where the maker is a departed employee (cross-reference against Entra inactive accounts)
11. Produce the inventory and risk summary below

## Output format

### SharePoint agent inventory

| Agent name | SharePoint site | Maker | Knowledge sources | Auth model | Licence status | Site owner approved | Risk |
| --- | --- | --- | --- | --- | --- | --- | --- |
| HR Policy Assistant | /sites/HR-Policies | Jane Smith | HR-Policies (OFFICIAL:Sensitive), external URL | User delegated | Licensed | Unknown | Medium — sensitive source, no formal approval on record |
| Travel Booking v2 | /sites/Operations | [departed] | Operations library, Dataverse | Service account | No Copilot licence | No | High — departed maker, unlicensed, elevated auth |

### Summary

- Total SharePoint-published agents: N
- Agents connecting to Confidential or OFFICIAL:Sensitive knowledge sources: N
- Agents using service account / elevated authentication: N
- Agents with departed or inactive makers: N
- Unlicensed agents (no Copilot or Copilot Studio capacity): N
- Agents without documented site owner approval: N
- High-risk agents requiring immediate review: N

## Scope and safety

Read-only — this skill does NOT:

- Unpublish or disable agents
- Modify agent knowledge sources or permissions
- Change authentication configurations
- Alter SharePoint site settings

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Copilot Studio admin portal — agent inventory | Power Platform admin role (no additional licence required for admin view) |
| PAC CLI agent enumeration | Power Platform admin or Copilot Studio maker with environment admin rights |
| Graph API — SharePoint site metadata | Microsoft 365 E3 or SharePoint Online Plan 2 |
| Copilot Studio agents published as M365 Copilot extensions | Microsoft 365 Copilot licence per interacting user |

### Least-privilege roles

- Power Platform Administrator (enumerate all Copilot Studio agents across environments)
- SharePoint Administrator (enumerate SharePoint sites and confirm app/agent deployments)

### Microsoft Graph permissions (read-only)

- `Sites.Read.All` — read SharePoint site metadata to correlate agent deployment locations
- `Application.Read.All` — enumerate app registrations associated with Copilot Studio agent service principals
- `Directory.Read.All` — verify maker identity status (active vs departed) in Microsoft Entra

## Sources and compliance

- [Publish an agent to SharePoint (Microsoft Learn)](https://learn.microsoft.com/en-us/microsoft-copilot-studio/publication-add-bot-to-sharepoint)
- [Agents for Microsoft 365 Copilot Chat (Microsoft Learn)](https://learn.microsoft.com/en-us/copilot/agents)
- [Get started with agents in SharePoint (Microsoft Support)](https://support.microsoft.com/en-us/office/get-started-with-agents-in-sharepoint-69e2faf9-2c1e-4baa-8305-23e625021bcf)
- Supports PSPF Requirement 4 — AI access to OFFICIAL:Sensitive content must be authorised and auditable
- Aligns with Essential Eight ML2 Control 7 — AI application governance and approval workflows
- Pair with Copilot Studio Agent Inventory for a complete cross-environment agent governance view
- Output in Australian English