A Copilot Studio agent configured with no authentication

Copilot Studio agent lets anyone who reaches it start a conversation.

An agent with no authentication asks nothing of the people who reach it, so anyone who can get to a channel it is published on can use whatever it was given. Legitimate for a public FAQ assistant; serious for an agent holding tools or knowledge drawn from your data.

The finding is the authentication setting itself, not a statement that specific data is exposed. Pathix reads the agent's tools, the flows and agents it can call, and the Dataverse knowledge it is grounded on, and the agent's own page lists them, but that page is a floor rather than a complete reach: a tool whose table the model chooses at run time is recorded as a capability rather than a write, and topics are not read for what they touch. It fires on draft agents too, because an unauthenticated draft is one publish away from serving.

Query the bot table and read the authentication mode on every row, drafts included: publish state is a separate column, and Microsoft's own agent inventory in the admin center shows the published version only. In Copilot Studio it is Settings, then Security, one agent at a time. There is no separate open-access value to look for: no authentication is the open state.

In Copilot Studio, under Settings and then Security, require sign-in with Microsoft Entra ID unless the agent is meant to be open; if it is, give it no tools that write records and no knowledge drawn from data you would not publish.

This is a security finding that carries no SOC 2, ISO 27001, NIST 800-53 or CMMC reference. That is a decision rather than an omission. Pathix maps a finding to a control only where the mapping is defensible to an assessor, and a stretched one would undermine every mapping that is real.

• A column-secured or sensitive column indexed for AI retrieval
• A Copilot Studio agent tool running on its maker's connection