Migrate agents that use Bot Framework skills to single-tenant app registrations

Copilot Studio creates an Azure app registration for each custom agent to enable secure communication with the agent's configured channels and skills. The app registration doesn't access or expose any customer data, resources, or agent information.

Copilot Studio securely and compliantly manages the app registration. However, in order to meet Secure Future Initiative requirements, Copilot Studio no longer creates multitenant applications. This change was made to address the fact that many customers don't allow multitenant app registrations in their tenant.

All new Copilot Studio agents are now created using single-tenant app registrations with Federated Identity Credentials. Previously created agents continue to use multitenant Azure app registration.

How does this change affect me? 

No action is required since existing agents aren't migrated to single-tenant agents.

What if I want to migrate my agent with a multitenant app registration to single-tenant?

While you can't migrate your existing agent, you can export and import your custom agents new environment. When you import an agent, the process creates a new Azure single-tenant app registration. For more information about exporting and importing agents, see export and import agents.

Important

If your agent uses Bot Framework skills, you need to make changes to your skill to support your newly created single-tenant app registration.

What do I need to do to prepare my skill to support newly created agents with single-tenant app registrations? 

Perform the following steps to migrate the Azure app registrations of your existing custom agents with skills to single-tenant.

Identify affected agents and inform agent owners and skill developers

First, you need to identify affected agents and communicate changes to their owner and their skill developer.

1. Go to your Azure app registration.

2. Search the affected agent’s application (client).

3. Select the app Display name and select Manifest under Manage in the left pane.

4. Find Power Platform Environment ID and Bot Id under the description field in the manifest.

5. Go to https://make.powerapps.com/environments/<Power Platform Environment ID>.

6. Select Tables in the left pane and then, to view all the tables, select All.

7. Search for the agent table. Enter "Copilot" in the search box.

8. Search for the agent. Locate the Owner column for the agent owner and add "Bot" for bot ID.

9. Contact the agent owner and skill developer.

Update skills to single-tenant

The skill developer needs to update the skill to support single-tenant app registration and deploy that skill (or at least its app registration) in the same tenant that has the Copilot Studio agent's app registration. Perform the following steps to do the update:

1. Update your multitenant skill to support both single-tenant and multitenant agents. This ensures your skill continues to work during the migration.

2. If you're using Bot SDK to call Copilot Studio as a skill, update to single-tenant app registrations.

Frequently asked questions

Here are some frequently asked questions about the migration of Copilot Studio agents to single-tenant Azure app registration.

Where do I see the changes?

You can see the changes in your Azure App registration under Authentication.

Can I just change my app registration to single-tenant?

No, you shouldn't change your custom agents Azure app registration to single-tenant because it breaks the agent.

Why are you not migrating existing agents from multitenant to single-tenant as previously documented?

We identified that agents using Bot Framework skills would be broken if we automatically migrated the agents. As such, we won't automatically migrate agents to avoid creating issues for customer solutions.