Security Research in Copilot Studio

### Overview In this Microsoft Security Response Center (MSRC) virtual session, Security Program Manager Alyssa Str introduces Scott Gorick, Principal Security Architect for Power Platform and Dynamics. Gorick outlines the architecture of Microsoft Copilot Studio, details how it fits within the broader Power Platform and Microsoft Entra ecosystems, and provides guidance for external security researchers conducting vulnerability research and submitting high-efficacy bug reports to MSRC bounty programs.

### Key Topics - **Trust Boundaries and Identity Plane**: Gorick explains that Microsoft Entra ID forms the identity plane and the primary trust boundary. The highest-tier bounty targets involve cross-tenant information disclosure, followed by environment-level boundary escapes, resource permissions, and data loss prevention (DLP) bypasses. Dataverse also implements its own distinct authorization model. - **Copilot Studio and Power Platform Composition**: The platform enables low-code/no-code, pro-code, and agentic workflows. Copilot Studio integrates tightly with over 1,000 pre-built connectors, Power Automate flows, Power Apps, Power Pages, Azure OpenAI, Azure AI Builder, and Azure Bot Service. Gorick demonstrates dynamic chaining, generative answers over public or uploaded data, and tracing mode for inspecting model decision-making. - **Platform Vulnerability vs. Developer Misconfiguration**: A core message is distinguishing between developer misconfigurations (e.g., publishing an unauthenticated bot with SharePoint access or testing as a tenant Global Admin who has default break-glass access) and legitimate platform vulnerabilities (e.g., bypassing configured DLP policies, security feature bypasses, IDOR, or SSRF).

### Technical Details - **Vulnerability Surfaces**: Key areas for security testing include Server-Side Request Forgery (SSRF) when copilot fetches URLs for grounding, Insecure Direct Object References (IDOR) on admin/API endpoints, indirect prompt injection via conversational state stores or Dataverse, and file parsing/abuse from document uploads. - **Connector and Identity Abuse**: Referring to external research by Samsung regarding OAuth application consent abuse for zero-click phishing, Gorick highlights how connectors can be abused for identity risks, aligning with OWASP low-code/no-code top risks. - **Power Fx and Extensibility**: Power Fx acts as an expression language executing on nodes within agent flows or within Dataverse to concatenate strings and compose context. Pro-developer extensibility through Dataverse plugins and custom connectors provides critical attack surface often leveraged by top bug bounty researchers. - **Governance and Administration**: Central administration is performed via the Power Platform Admin Center (PPAC) and managed environments. Gorick notes that tools like the Center of Excellence (CoE) Starter Kit highlight the governance controls and milestones researchers should investigate when looking for bypasses.

### Takeaways Researchers should understand how Copilot Studio composes underlying infrastructure (Azure OpenAI, Azure Bot Service, Dataverse) and focus on platform-level boundary violations rather than standard configuration choices. Staying within the Bounty Rules of Engagement, testing with low-privilege accounts rather than Global Admins, and understanding what assumptions the application makes are crucial steps for identifying significant zero-day vulnerabilities.