Disable or limit sharing of agents
You can control and limit how agents are shared in your tenant by applying the Editor and Viewer permission assignments to individuals who need to access Copilot Studio, and then configuring the permissions for who can share with whom.
The sharing limits for agents are configured as a Managed Environments control in the Power Platform admin center. You can configure these controls for an individual Managed Environment, or you can apply the sharing controls at scale using Environment Groups and Rules in the Power Platform admin center.
Note
Sharing rules are enforced when users try to share an app, flow, or agent. This doesn't impact any existing users who already have access to the app, flow, or agent prior to the application of the sharing rules. However, if an app, flow, or agent is out of compliance after rules are set, only un-sharing is allowed until the app, flow, or agent is compliant with the new rules.
After sharing rules are set in the Power Platform admin center, it may take up to an hour for them to begin enforcement.
Sharing rules in Dataverse for Teams environments do not impact sharing to a Team when you select Publish to Teams. However, when a user attempts to share with individuals or groups in a Team other than the one bound to the environment, the sharing limits are enforced.
See more about setting sharing limits for canvas apps, flows, and agents in the Power Platform administration documentation article, Limit sharing.
Use the Editor and Viewer roles to control sharing
You control sharing with individuals by setting sharing controls in the Power Platform Admin Center. This allows administrators to enforce how makers can share Editor or Viewer assignments with other individuals for their agents in Copilot Studio. See the Power Platform doc Limit sharing for instructions on setting assignments.
The remainder of this article describes how the assignments affect who can share and how.
Important
Editor permissions can only be given to individual users.
You can't grant Editor permissions to security groups.
The Editor assignment allows makers to edit, configure, share, and publish their content, while makers with the Viewer assignment can only chat with the agent.
Sharing rules | System behavior when selected | When not selected |
---|---|---|
Let people grant Editor permissions when agents are shared | Can share with any individual assigned as an Editor. | Can't share with an individual assigned as an Editor. This control doesn't affect the ability to share with viewers by owners or editors. |
Let people grant Viewer permissions when agents are shared | Can share with any individual assigned as a Viewer, and any security groups. | Can't share with an individual assigned as a Viewer. The owner or any other editors can't share with a security group. This control doesn't prevent owners/editors from sharing their agents with individuals as editors. |
Only share with individuals (no security groups) | Owners/editors can only share with individuals assigned as a Viewer. They can't share with a security group. | Editors and owners can share with individuals (assigned as a Viewer) and security groups. |
Limit number of viewers who can access each agent | If Only share with individuals (no security groups) is selected, you can control the maximum number of viewers with whom an agent can be shared with. | There's no limit on the number of individuals you can share with. |
Related information
- Managed Environments in the Power Platform admin center
- Limit sharing in Managed Environments (Power Platform admin documentation)