Copilot Studio agent security: Top 10 risks you can detect and prevent

This report highlights the most prevalent security misconfigurations in Microsoft Copilot Studio agents that expand identity and data-access risk, and pairs each with Microsoft Defender Advanced Hunting queries for detection. It explains how exposures like unauthenticated access, overbroad sharing, risky HTTP/email actions, maker-auth, hard-coded secrets, weak generative instructions, MCP tools, dormant assets, and orphaned ownership can be abused, and offers a concise mitigation checklist to reduce exposure, enforce strong authentication and least privilege, harden orchestration, and clean up unused or risky components.