Configure users and teams in Copilot Agent Kit

After installing Copilot Agent Kit, assign security roles in the Power Platform admin center to users so they can configure new agents and tests. To streamline role assignments, use Microsoft Entra ID group and team memberships. Alternatively, you can assign roles manually to individual users. You can also set up column security profiles and restrict access to the environment if needed.

Copilot Agent Kit security roles

Copilot Agent Kit includes two security roles designed for distinct personas:

Security role	Description
CSK - Administrator	Full administrative access to all Copilot Agent Kit features. Intended for solution administrators who configure, manage, and maintain the entire kit. Administrators have organization-level access to most tables, so they can view and manage all records across the organization.
CSK - Maker	Limited access for users who build and test agents. Makers typically have user-level access, so they can work with their own records while reading shared configuration data. Suitable for developers and testers who create and validate agent functionality.

Important

The following legacy security roles are deprecated and shouldn't be assigned. Migrate users to CSK - Administrator or CSK - Maker.

• Copilot Studio Kit - Administrator - Deprecated
• Copilot Studio Kit - Configurator - Deprecated
• Copilot Studio Kit - Tester/KPI Viewer - Deprecated

Compare roles by feature area

The following table summarizes how the two roles compare across Copilot Agent Kit feature areas. For the authoritative per-table permission matrix, open each role in the Power Platform admin center role editor.

Feature area	CSK - Administrator	CSK - Maker
Test automation	Full organization access	Full access, except user-level access for test results
Conversation KPI	Full organization access	No access
Agent Inventory	Full organization access	No access
Agent Compliance	Full organization access	No access
Conversation Analyzer	Full organization access	No access
Agent Review Tool	Mixed: user-level for reviews, organization-level for patterns	Mixed: user-level for reviews, organization-level for patterns, no delete on some tables
SharePoint synchronization	Organization-level access	User-level access
Agent Value Summary	Organization-level access	No access
Common tables (Agent Configuration, Copilot Agent Kit Logs)	Organization-level access	User-level access

Learn more about how Dataverse security roles work in Security concepts in Microsoft Dataverse and Security roles and privileges.

Assign security roles to users

Assign security roles to users so they have the permissions they need for configuring and testing agents in Copilot Agent Kit. You can assign roles by creating Microsoft Entra ID teams (recommended) or by assigning roles to individual users.

Create Microsoft Entra ID teams to drive security role assignment (option 1)

Use Microsoft Entra group teams to manage user permissions. Users automatically inherit security roles when they're group members, so you don't need to assign roles individually.

1. Sign in to the Power Platform admin center.
2. Select Manage > Environments and select the environment where you installed Copilot Agent Kit.
3. Select See all under Access >Teams. (Alternatively, go to Settings > Users + permissions > Teams.)
4. Select + Create team.
5. Set the required properties, and for Team type, select either Microsoft Entra ID Security Group or Microsoft Entra ID Office Group.
6. Search (start entering characters) and select the desired Group name and Membership type.
7. Select Next.
8. For the Manage security roles step, select CSK - Administrator or CSK - Maker.
9. Select Save.

More information: Manage group teams

Assign security roles to individual users (option 2)

Security roles control a user's access to data through a set of access levels and permissions. To assign security roles to a user, you need the appropriate privileges.

1. Sign in to the Power Platform admin center.
2. Select Manage > Environments and select the environment where you installed Copilot Agent Kit.
3. Select See all under Access > Users. (Alternatively, go to Settings > Users + permissions > Users.)
4. If the user isn't in the list, add them by following a link at the top of the page.
5. Select the user.
6. Select Manage security roles.
7. Select CSK - Administrator or CSK - Maker.
8. Select Save.

More information: Assign a security role to a user

Set a Microsoft Entra ID security group to restrict access to the environment (optional)

To set a Microsoft Entra ID security group:

1. Sign in to the Power Platform admin center.
2. Select Manage > Environments and select the environment where you installed Copilot Agent Kit.
3. On the environment overview page, in the Details section, select Edit.
4. Search for and select a Security group.
5. Select Save.

More information: Control user access to environments with security groups and licenses

Set up a column security profile (optional)

By using column security profiles, users or teams without the system administrator role can access specific secured columns, such as Direct Line Channel Security Secret.

Note

If you don't store secrets in these columns, you don't need to complete this step.

1. Sign in to the Power Platform admin center.
2. Select Manage > Environments and select the environment where you installed Copilot Agent Kit.
3. Select Settings > Users + permissions > Column security profiles.
4. Select Power CAT Copilot Studio Kit Column Security Profile.
5. Go to the Teams or Users tab, select Add Teams or Add Users, and add the relevant teams or users that you want to have access to these secured columns.

More information: Add teams or users to a column security profile to control access

Next step

Configure agents