Copilot Studio Compliance: What Organizations Must Verify

Microsoft Copilot Studio is covered by a range of Microsoft security, privacy, and compliance programs, but using the service does not make an agent—or the organization operating it—automatically compliant. You must verify that the exact cloud, region, features, connectors, and downstream systems are in scope, then configure access, data handling, monitoring, retention, and human oversight for the intended use.

This article is a technical planning guide, not legal advice. Compliance owners and counsel should review current contracts and audit evidence before approving a production deployment.

Start with scope, not a certification list

A certification or attestation applies to a defined service boundary during a defined audit period. It may not cover a preview feature, third-party connector, external website, custom API, user device, or a different sovereign cloud. For every requirement:

1. Identify the law, contract, standard, and data classification that apply.
2. Map the complete agent data flow, including prompts, files, knowledge sources, actions, logs, analytics, and human handoffs.
3. Confirm that Copilot Studio and every dependent service are included in the relevant evidence.
4. Record the environment, region, licensing, authentication, and feature configuration reviewed.
5. Assign the controls Microsoft operates and those the customer must operate.
6. Retest after changes to the agent, connector, model, policy, or deployment channel.

Where to find authoritative evidence

Use Microsoft’s Copilot Studio compliance documentation to identify applicable programs. Authorized customers can obtain current SOC reports, ISO certificates, assessment reports, and other restricted documents through the Microsoft Service Trust Portal. Check the service name, audit dates, exclusions, and cloud environment inside each report rather than relying on a marketing summary.

The Microsoft documentation lists programs including HIPAA/HITECH, HITRUST, FedRAMP, SOC, ISO standards, PCI DSS, CSA STAR, UK G-Cloud, Singapore OSPAR and MTCS, South Korea K-ISMS, and Spain’s ENS. Coverage and terminology can change, so treat that list as a starting point for verification.

Data residency and cross-border processing

Data residency describes where data is stored or processed; it does not by itself address every privacy or sovereignty requirement. Provision the Power Platform environment in an approved geography and review Microsoft’s current Copilot Studio data-location documentation.

Microsoft documents exceptions and operational transfers, including support, troubleshooting, legal obligations, and certain disaster-recovery scenarios. Also map data leaving Copilot Studio through connectors, knowledge sources, analytics, channels, and custom actions. A compliant primary environment does not prevent a connector from sending data to an unapproved region.

HIPAA and health information

HIPAA applies to covered entities and business associates handling protected health information in the United States. Microsoft documents Copilot Studio within its HIPAA business-associate framework for eligible customers, but a Business Associate Agreement is only one requirement.

• Confirm that the organization has an applicable Microsoft BAA and that every used service is in scope.
• Use authenticated access, least privilege, data-loss-prevention policies, audit logs, retention controls, and approved incident procedures.
• Minimize PHI in prompts, transcripts, test cases, analytics, and support files.
• Prevent makers from connecting consumer or unapproved services to a health-data environment.
• Validate responses and escalation paths with qualified clinical and compliance reviewers.

Copilot Studio is not automatically a medical device and should not be presented as diagnosing, prescribing, or replacing professional judgment. A medical-device use requires a separate regulatory assessment.

HITRUST

HITRUST CSF combines requirements from several security and privacy sources into an assessable framework. If a customer or contract requires HITRUST, obtain the current Microsoft evidence and confirm the assessed scope. The customer still needs its own controls and, where required, its own assessment; a supplier’s certification does not transfer to the customer’s agent.

FedRAMP and US government environments

FedRAMP authorizes specific cloud offerings at specific impact levels. Do not assume that a feature in the commercial Copilot Studio service has the same authorization or availability in Government Community Cloud, GCC High, Azure Government, or a Department of Defense environment.

Check the applicable FedRAMP marketplace entry, Microsoft government-service documentation, tenant type, and feature availability. Record inherited controls and customer-responsible controls in the system security plan. Preview features and commercial connectors require particular scrutiny.

SOC reports

SOC reports provide independent assurance about specified controls over a period or at a point in time. Select the correct report type and period for the organization’s purpose, read the service boundaries and subservice-organization treatment, and implement all complementary user-entity controls stated in the report.

ISO standards

Microsoft publishes certificates and assessment reports for relevant online services through the Service Trust Portal. The Copilot Studio documentation has referenced the following ISO families; always verify the current edition and service scope in the certificate:

PCI DSS and payment data

PCI DSS applies to environments that store, process, or transmit cardholder data or can affect the security of the cardholder-data environment. Even if Microsoft evidence covers parts of the service, an agent that collects payment-card details can expand the customer’s PCI scope.

Prefer redirecting the user to a validated hosted-payment page or using tokenized payment components. Do not place full card numbers, security codes, or sensitive authentication data in prompts, transcripts, test cases, analytics, email, or general-purpose knowledge sources. Have a Qualified Security Assessor or the organization’s PCI owner approve the architecture.

CSA STAR and regional programs

CSA STAR registry entries and regional programs—such as UK G-Cloud, Singapore OSPAR and MTCS, South Korea K-ISMS, and Spain ENS—serve different purposes. Some are certifications or attestations; others are procurement frameworks, audit reports, or security schemes. Inclusion in one does not mean that every deployment satisfies every local rule.

For each program, verify the supplier legal entity, service and cloud, assessment level, report date, local hosting expectations, contractual terms, and customer control obligations.

Configure the customer side of compliance

• Identity: require appropriate authentication, Conditional Access where available, role separation, and periodic access review.
• Data policies: use Power Platform data-loss-prevention policies to separate business and nonbusiness connectors and block unapproved endpoints.
• Least privilege: give agent actions and service accounts only the permissions needed for each task.
• Data minimization: collect only necessary fields and redact sensitive values from logs, snapshots, and test data.
• Knowledge governance: restrict source access, honor source permissions, and review indexed content for retention or residency conflicts.
• Change control: separate development, test, and production; require review for publishing and connector changes.
• Monitoring: retain auditable events, alert on failures or unusual actions, and test incident-response procedures.
• Human oversight: require confirmation for high-impact actions and provide clear escalation to a qualified person.

Release checklist

• The current architecture and data-flow diagram match the deployed agent.
• Every Microsoft and third-party service has current evidence for the required framework.
• Data location, backup, support, and subprocessors meet contractual requirements.
• DLP, authentication, permissions, retention, and logging have been tested.
• Prompts, responses, tools, and failure paths have been evaluated with representative but sanitized data.
• Privacy notices, consent, records-management, accessibility, and incident processes are approved.
• An owner is assigned to monitor certificate expiry, service changes, and regulatory updates.

Reassess the deployment whenever you add a channel, connector, knowledge source, generative feature, or new category of data. Compliance is an operating process, not a one-time checkbox.