Microsoft Copilot Agents Bypass Access Policy Putting Data at Risk

Key Takeaways:

• The "NoUsersCanAccessAgent" policy is bypassed, leaving some Copilot Agents installable.
• Manual per-agent PowerShell revocations add overhead and risk.
• Mitigate by auditing inventories, enforcing Conditional Access, and monitoring.

Shortly after the May 2025 rollout of 107 Copilot Agents in Microsoft 365 tenants, security specialists discovered that the "Data Access" restriction meant to block agent availability is being ignored.

Despite administrators configuring the Copilot Agent Access Policy to disable user access, certain Microsoft-published and third-party agents remain readily installable, potentially exposing sensitive corporate data and workflows to unauthorized use.

Policy Bypass Details

Testing by cybersecurity researcher Steven Lim shows that agents such as "ExpenseTrackerBot" and "HRQueryAgent" continue to appear in the Copilot panel despite the global policy restriction.

Risks of Unauthorized Access

• Data exfiltration via agents like "ExportDataAgent" or "SearchFileAgent" that query SharePoint or OneDrive content beyond intended scope.
• Execution of custom RPA workflows through agents like "AutoInvoiceProcessor" without formal change control.
• Compliance violations if unapproved AI models process sensitive PII or regulated data.

Recommended Mitigations

1. Run weekly discovery scripts to detect policy-bypassing agents:
   
2. Integrate Azure AD Conditional Access to require MFA for agent installation.
3. Monitor agent invocation logs via compliance tools.