A web content filtering policy governs Copilot Studio agent traffic through the baseline profile
Overview
Section titled “Overview”Forwarding Copilot Studio agent traffic to Global Secure Access provides visibility but doesn’t restrict the web destinations agents can reach unless a web content filtering policy is linked to the baseline profile. The baseline profile is the supported enforcement path for agent traffic; security profiles linked to Conditional Access policies aren’t supported for agents. Without an enabled, administrator-configured web content filtering policy on the baseline profile, an agent’s HTTP node action or connector can reach web categories and URLs that the organization intended to block, giving a compromised or manipulated agent an unrestricted path to retrieve payloads, contact command-and-control infrastructure, or transmit data to an external destination. Linking the Copilot Studio web content filtering policy to the enabled baseline profile applies those restrictions tenant-wide to forwarded agent traffic.
Remediation
Section titled “Remediation”- Configure Secure Web and AI Gateway for Microsoft Copilot Studio agents - Create a web content filtering policy for agent requirements and link it to the baseline profile.
- Global Secure Access for Copilot Studio agents - Follow the Power Platform guidance for creating the Copilot Studio agent web repositories policy and linking it to the baseline profile.
- Review the linked policy in the Microsoft Entra admin center under Global Secure Access > Secure > Security profiles > Baseline profile.
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Network |
| Category | AI Gateway |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | AI and agents |
| ATT&CK | T1567 Exfiltration Over Web Service, T1071.001 Web Protocols |
| Licence | Entra_Premium_Internet_Access |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.