Microsoft Power Platform Integration

Connect your Microsoft Power Platform environment to Capsule Security for complete visibility into your AI agents, workflows, and conversation history across Copilot Studio and Power Automate.

This integration uses Microsoft Entra ID (Azure AD) authentication to sync:

• Agents - Copilots built in Copilot Studio
• Tools - Actions, plugins, Power Automate flows, and connectors
• Knowledge Bases - Data sources and knowledge articles attached to copilots
• Conversations - Chat sessions and conversation history
• Audit - Activity logs with action invocations and session tracking

Before you begin, ensure you have:

• An active Microsoft Power Platform environment with Copilot Studio and/or Power Automate
• An Azure Entra ID account that is System Administrator in each environment Capsule should monitor, with a Power Apps or Dynamics 365 license assigned. Global, Power Platform, and Dynamics 365 admins, with the role assigned directly and not through a group, can grant themselves System Administrator. See Environments Fail with an Application User Error
• Access to the Capsule Security portal

For more information about Power Platform roles, see Administering Power Platform.

Start the integration setup from the Capsule Security portal.

1. Log in to the Capsule Security portal

2. Click Integrations in the left sidebar

3. Find the Microsoft Power Platform card and click Set up Integration

4. Click Connect with Microsoft

5. You'll be redirected to Microsoft's sign-in page

Grant Capsule the necessary permissions to access your Power Platform resources.

1. Sign in with your Microsoft account that has the required permissions (see Prerequisites)

2. Review the permissions requested by the Capsule application

3. Click Accept to grant consent

Capsule requests the following permissions across Microsoft APIs. Most grant read-only access used for discovery and monitoring; a few setup permissions (application install, role assignment, and user provisioning) are required to install the Capsule application and maintain ongoing synchronization.

For more information about the consent experience, see User and admin consent in Azure.

After you grant consent, Capsule automatically configures the integration.

• All Power Platform environments you have access to are discovered
• Copilot Studio bots and Power Automate flows within those environments are detected
• Required access permissions are configured automatically

If Capsule cannot add its application user in an environment, see Environments Fail with an Application User Error.

Some tenants limit who can use Copilot Studio to members of specific Microsoft Entra security groups, through the Copilot Studio authors tenant setting and related settings in the Power Platform admin center. Capsule installs into each environment by creating an application user for the Capsule Entra application and assigning it the System Administrator security role. When agent creation and management are scoped to security groups, that application user cannot be created until the Capsule application is a member of one of the groups.

• Setup fails for every environment, or for a subset of them, even though the authorizing user is a Global Administrator and a System Administrator in the environment
• Adding the Capsule application manually in the Power Platform admin center (Environments → your environment → Settings → Users + permissions → Application users → New app user) fails the same way: the business unit list does not load, or the panel reports that the user is not a member of the organization

Each environment is provisioned independently, so a restriction that covers only some environments produces a partial install.

1. In the Microsoft 365 admin center, go to Teams & groups → Active teams & groups and create a dedicated security group for Capsule, for example Capsule Security. Do not reuse a group that drives Copilot Studio licensing or internal cross-charging: Capsule counts as an extra member there and skews those reports.

2. In the Microsoft Entra admin center, add the Capsule enterprise application as a member of the group. The application appears under Enterprise applications once consent has been granted in Step 2 above.

3. In the Power Platform admin center, go to Manage → Tenant settings → Copilot Studio authors and add the group.

4. Review any other Copilot Studio settings your tenant scopes to the same security groups, such as those controlling who can manage or publish agents, and add the Capsule group to each of them.

5. Return to the Capsule portal, open Integrations, open the row menu of your Power Platform integration, and choose Refresh environments. Confirm that every environment you expect to monitor completes.

Note: Environment-level security groups (Manage → Environments → Edit → Security group) do not block Capsule. Microsoft lets application users run in any environment secured with a security group without being a member, so no change is needed there.

Capsule could not add its application user to some environments, usually because the admin who connected it is not System Administrator there or has no Power Apps or Dynamics 365 license. Microsoft no longer gives Global, Power Platform, or Dynamics 365 admins that role in every environment automatically (Manage high-privileged admin roles).

• In Integrations, select your Power Platform integration row. One or more environments show Failed in the Sync status column. Select the info icon next to Failed (View sync error) to read the cause: Capsule's application user is not a member of this Dataverse environment. Add it as an application user in Power Platform admin center.
• Refresh environments reports Couldn't refresh environments. Its message contains Capsule could not be registered in <environment names>. If Capsule could not register any environment, it contains No Power Platform environment could be registered.

Capsule sets up each environment separately, so only some of them may be affected.

The admin who does the fix needs a Power Apps or Dynamics 365 license. Users with only Office licenses (with the Dataverse plan enabled) "aren't pre-provisioned into environments", so assign a Dynamics 365 or Power Platform license. Without a license, Microsoft limits admins to configuring and customizing the system, even with the System Administrator role, which can stop Capsule from adding its application user.

In the Microsoft 365 admin center, go to Users → Active users, select the admin, open Licenses and apps, choose a license, and select Save changes. Microsoft's license guide has the full steps.

Microsoft then syncs the license to each environment, so allow time for it.

If no admin in your organization has a Power Apps or Dynamics 365 license, contact Capsule support.

Do this in each affected environment, signed in as the licensed admin who will finish the fix.

Note: Global, Power Platform, and Dynamics 365 admins can grant themselves System Administrator, but only with the admin role assigned directly, not through a group. Dynamics 365 admins must also be members of the environment's security group, if it has one. If your admin role is activated through Privileged Identity Management (PIM), finish these steps before the activation expires. Microsoft logs each elevation in Purview.

One environment, in the admin center

1. Sign in to the Power Platform admin center, go to Manage → Environments, and select the environment.

2. In the command bar, select Membership.

3. In the System Administrators pane, select Add me.

Many environments, with the Power Platform CLI

1. Install the CLI with Microsoft's install guide (dotnet tool install --global Microsoft.PowerApps.CLI.Tool, requires .NET), then run pac to confirm it starts.

2. Run pac auth create and sign in as that admin. Add --deviceCode if you have no browser. Run pac auth who to confirm the active profile.

3. Run pac admin list and copy the Environment Id of each affected environment from the table.

4. Replace the placeholders with those Environment Ids and run:

   $environmentIds = @(
     "<environment-id-1>",
     "<environment-id-2>"
   )
   
   foreach ($environmentId in $environmentIds) {
     Write-Host "Elevating in $environmentId"
     pac admin self-elevate --environment $environmentId
   }

Use this when the licensed account is a Global, Power Platform, or Dynamics 365 admin, or is already System Administrator in every failing environment.

1. Make that account System Administrator in each failing environment (see above).

2. In Capsule, open Integrations, open the row menu of your Power Platform integration, choose Reinstall, and sign in with Microsoft using that account. Reinstall and Refresh environments need permission to manage integrations in Capsule, and Reinstall appears only to users who have it. If you don't see it, ask your Capsule admin to grant that permission or to do these steps with you. If Microsoft asks for admin approval, have a Global Administrator approve the request, then choose Reinstall again.

3. Capsule adds its application user to every environment in the background and starts a sync. Then choose Refresh environments in the row menu. It re-runs setup with your sign-in, starts a sync, and reports any environment that still fails (the messages are listed under Symptoms above). Run it again until it reports no failures, then check Confirm the fix. If the same environments are reported every time, see Troubleshooting item 4 and the Note under Confirm the fix.

Use this when a different admin does the work, or the licensed account cannot be elevated. The Capsule application ID is cd96f28b-f3a1-40fa-a982-0df2a8f319e8.

1. Use an admin who has a Power Apps or Dynamics 365 license and is System Administrator in the environment (see above).

2. Add the application user with either method.

   Admin center

   1. Go to Manage → Environments, select the environment, then go to Settings → Users + permissions → Application users.
   2. Select + New app user. In the Create a new app user pane, select + Add an app, search for the application ID, select it, and select Add.
   3. Select a Business Unit and enter an Email address (a contact address your team monitors). Microsoft's application user guide describes both fields.
   4. Select the edit icon for security roles, choose System Administrator, and select Save. Select Save again to confirm the role assignment.
   5. Select Create.

   CLI (after the CLI setup above)

   Replace the placeholders with the Environment Ids from pac admin list:

   $environmentIds = @(
     "<environment-id-1>",
     "<environment-id-2>"
   )
   
   foreach ($environmentId in $environmentIds) {
     pac admin assign-user `
       --environment $environmentId `
       --user "cd96f28b-f3a1-40fa-a982-0df2a8f319e8" `
       --role "System Administrator" `
       --application-user
   }

3. In Capsule, open Integrations, open the row menu of your Power Platform integration, and choose Sync. You can also select Sync now in the integration drawer toolbar. Sync only covers environments already listed under the integration. If an environment you fixed isn't listed, choose Reinstall instead and sign in with the admin from step 1 (see Option A step 2). Capsule then adds that environment and starts a sync.

Environments created later need the same fix, and Capsule adds them only when you choose Refresh environments or Reinstall. Refresh environments sets up a new environment with the account that last connected Capsule, so it works only when that account is a licensed System Administrator there. Otherwise, use Option A, or Option B and finish with Reinstall as described in its step 3.

In Integrations, select your Power Platform integration row. When the sync finishes, each fixed environment's Sync status changes from Syncing to Synced. No other step is needed.

Note: If you are already a licensed System Administrator in the failing environment, a tenant restriction may be the cause instead. See Tenants That Restrict Copilot Studio with Security Groups.

Capsule ingests data from both Copilot Studio and Power Automate through a unified Power Platform integration. Both services share the same Entra ID app and are discovered automatically from each environment.

During setup, Capsule uses the Microsoft Discovery Service to automatically detect all Power Platform environments accessible by the authorizing user. Each environment is registered with:

All Copilot Studio agents, Power Automate flows, and users within each discovered environment are then synced automatically.

Copilot Studio bots are ingested as Agents in Capsule. Each agent includes:

Each copilot's components are parsed and categorized:

Capsule fetches conversation transcripts for each copilot and extracts individual activity events:

Power Automate workflows are ingested as Flows in Capsule. Only modern automation flows (non-managed) are collected.

Each flow's definition is parsed to extract its individual steps:

Connections between steps represent the execution graph:

Capsule collects flow run history starting from the 7 days before the integration was connected:

Power Platform connectors are captured across both Copilot Studio and Power Automate:

• In Copilot Studio - connector references are extracted from bot component actions. Each skill's connector type is identified from its connection reference (e.g., SharePoint, Outlook, Dataverse).
• In Power Automate - connector references are extracted from the flow definition. Each step that uses an API connection (OpenApiConnection, ApiConnection, Http) captures the connector's API ID, operation ID, and connection name.

Connectors provide visibility into which external services and data sources your AI agents and automation flows are interacting with.

Capsule extends the Power Platform integration to cover Power Apps, providing visibility into canvas and model-driven apps within each discovered environment.

Platform users are collected from each Power Platform environment and deduplicated across Copilot Studio and Power Automate. Each user includes their name, email, and job title from the Dataverse system user record.

Once the integration is configured:

• Initial sync begins automatically
• First sync may take several minutes depending on data volume
• View synced agents in Inventory → Agents
• View conversations in Observability → Filter Activity Type - Session
• To block risky tool calls at runtime, set up Copilot Studio Threat Detection

Register Capsule as the external threat detection provider for your Copilot Studio agents. Before an agent calls a tool, Copilot Studio asks Capsule whether to allow it, and Capsule blocks tool calls that violate your prevention policies.

Every time a Copilot Studio agent is about to invoke a tool, Copilot Studio sends Capsule:

• The tool, its proposed inputs, and the agent's reasoning for choosing it
• The user's latest prompt and recent chat history
• Outputs of the agent's earlier tool calls
• Conversation metadata: the agent, the user, the tenant, and the trigger

Capsule evaluates the call against your prevention policies and answers allow or block. On block, the agent stops and tells the user their message was blocked. On allow, the agent continues with no visible change.

Only agents that use generative orchestration call the threat detection provider. Copilot Studio skips classic agents.

• Complete the integration setup above. Capsule identifies your organization by the Microsoft Entra tenant in each request and looks the agent up in the inventory this integration syncs
• Create at least one Prevention policy in Capsule. Without one, every tool call is allowed
• You need permission to create app registrations in your Microsoft Entra tenant, the Power Platform Administrator role, and your Entra tenant ID

Pick the endpoint that matches your Capsule portal URL:

Use this exact string, with no trailing slash, both for the Entra app and in Power Platform admin center. Microsoft encodes the endpoint into the app's federated credential, so any difference between the two fails authentication.

Copilot Studio authenticates to Capsule with an Entra app in your tenant that uses a federated identity credential, so there is no client secret to store or rotate. You don't give Capsule the app ID: Capsule accepts tokens issued by your Entra tenant for your Capsule endpoint.

1. Open Windows PowerShell 5.1 or later as an administrator, install Create-CopilotWebhookApp from the PowerShell Gallery, and change to the folder it was installed in:

Install-Script -Name Create-CopilotWebhookApp
Set-Location (Get-InstalledScript -Name Create-CopilotWebhookApp).InstalledLocation

2. Run the script with your tenant ID and your Capsule endpoint:

.\Create-CopilotWebhookApp.ps1 `
  -TenantId "<your-entra-tenant-id>" `
  -Endpoint "https://agentsecurity.us-east1.capsulesecurity.io/v1/webhook" `
  -DisplayName "Capsule Copilot Studio Threat Detection" `
  -FICName "CapsuleThreatDetection"

Add -DryRun to validate the parameters without creating anything.

3. Copy the App ID the script prints.

1. In the Azure portal, go to Microsoft Entra ID → App registrations and select New registration.

2. Enter a name such as Capsule Copilot Studio Threat Detection, select Accounts in this organizational directory only (Single tenant), and select Register.

3. Copy the Application (client) ID.

4. Go to Certificates & secrets → Federated credentials and select Add credential.

5. Set Federated credential scenario to Other issuer and fill in:

6. Select Add.

<encoded-endpoint> is your base64url-encoded Capsule endpoint:

<encoded-tenant-id> is your tenant ID's GUID bytes in base64url, not the encoded text of the ID. Compute it in PowerShell:

$tenantId = [Guid]::Parse("<your-entra-tenant-id>")
[Convert]::ToBase64String($tenantId.ToByteArray()).Replace('+','-').Replace('/','_').TrimEnd('=')

1. In the Power Platform admin center, go to Security → Threat detection and select Additional threat detection. This link opens the pane directly.

2. Select the environment to protect and select Set up.

3. Select Allow Copilot Studio to share data with a threat detection partner.

4. In Azure Entra App ID, enter the app ID of the Entra application.

5. In Endpoint link, enter your Capsule endpoint.

6. Under Set error behavior, select Allow the agent to respond.

Important: Keep Set error behavior on Allow the agent to respond. With Block the query, every tool call Capsule doesn't answer within one second is blocked, even when no policy matches. See Failure behavior.

7. Select Save.

On save, Copilot Studio requests a token with your Entra app and calls Capsule to validate the connection. The save succeeds only if the federated credential and the endpoint match. If it fails, see Threat detection troubleshooting.

Threat detection is set per environment. Repeat this for every environment whose agents you want protected, including environments you create later.

Copilot Studio waits up to one second for Capsule's decision. Set error behavior decides what happens when Capsule times out or returns an error:

Capsule also allows a tool call when it can't match the agent to your inventory, for example an agent created after the last sync. Protection starts once the agent appears in Inventory → Agents.

1. In Capsule, create a Prevention policy that blocks a tool used by a test agent.

2. In Copilot Studio, open the test agent in the protected environment and use the Test pane to send a message that makes the agent call that tool.

3. Confirm the agent stops and replies that the message was blocked.

4. Delete or disable the test policy.

1. In the Power Platform admin center, open Additional threat detection, select the environment, and select Set up.

2. Clear Allow Copilot Studio to share data with a threat detection partner and select Save.

Copilot Studio stops sending tool calls to Capsule for that environment. Inventory and conversation sync continue. Delete the Entra app registration once no environment uses it.

When Save fails, select Copy error info in the admin center to see the underlying error.

For Microsoft's side of this setup, see Enable external threat detection and protection for Copilot Studio custom agents.

1. Consent failed or permissions error

   • Verify you are System Administrator in each environment Capsule should monitor. See Prerequisites
   • Ensure your account has access to the Power Platform environments

2. Setup fails for every environment, even as a Global Administrator

   • Your tenant likely restricts Copilot Studio to security groups. See Tenants That Restrict Copilot Studio with Security Groups

3. Some environments show Failed with "Capsule's application user is not a member of this Dataverse environment"

   • Capsule could not add its application user there. See Environments Fail with an Application User Error

4. Environments still show Failed after you made yourself System Administrator

   • The admin who connected Capsule may have no Power Apps or Dynamics 365 license. See Before you start: assign a license.
   • If an environment still fails after the license is assigned and you are System Administrator there, check your Access Mode:
     1. In the Power Platform admin center, go to Manage → Environments, select the environment, then go to Settings → Users + permissions → Users and select your user.
     2. Select ..., choose Manage user in Dynamics 365, and open the Administration tab.
     3. Under Client Access License (CAL) Information, confirm Access Mode is Read-Write. If it is not, select Read-Write and select Save.
   • If Access Mode can't be changed, the license may not have reached that environment yet. Select the user, choose Run diagnostics to sync it, then try again. If it still can't be changed, contact Capsule support.

5. No environments discovered

   • Confirm Copilot Studio or Power Automate resources exist in your environments
   • Check that you have the necessary permissions to access these resources

6. Sync not completing

   • Allow several minutes for the initial sync to complete
   • Contact support if the issue persists

For help with this integration:

• Email: support@capsule.security
• Include: Your organization ID, integration status, and any error messages

For Power Platform-specific issues:

• Power Platform documentation
• Copilot Studio documentation
• Power Automate documentation
• Microsoft support