Copilot Studio knowledge sources come up in a lot of my Microsoft 365 and Power Platform projects these days. A business unit builds its own Copilot Studio agent and everyone is enthusiastic, until someone adds SharePoint sites, file uploads or public websites as knowledge. Then the questions start. Who can actually see what? What happens in the background when the agent answers? Over the last few months I've seen more oversharing incidents than most admins would care to admit. In this post I go through how permissions behave for each knowledge source, which traps to avoid and how to test before you go live.

Copilot Studio agents draw on SharePoint, files, websites and more

A Copilot Studio agent can use several kinds of knowledge sources: SharePoint sites and files, uploaded files, public websites, Dataverse tables and Graph connectors. Most organizations I work with connect SharePoint first. File uploads and website content usually follow soon after, not least because the knowledge module in Copilot Studio makes adding a source very easy.

The question that matters is whose permissions apply. For SharePoint, you decide during setup whether the agent uses Microsoft authentication (acting as the signed-in user) or a fixed app connection. With Microsoft authentication, each user only gets answers based on their own access rights, and in most cases that's the safest choice. If someone configures an app connection instead, that context is used for every user, which can expose far more than intended. File uploads work differently. Uploaded documents are stored in the environment's Dataverse and are available to anyone who can talk to the agent, no matter what the individual file permissions were. This is the oversharing trap I run into most often. Microsoft's docs on adding SharePoint and file upload explain the technical setup, but the permission model behind it isn't always obvious in practice.

SharePoint sources and file uploads handle permissions differently

This simple flowchart shows how a Copilot Studio agent processes a user's request and which knowledge it can reach:

flowchart TD
  User["User submits query"] --> Agent["Copilot Studio agent"]
  Agent --> SharePoint["SharePoint source"]
  Agent --> File["File upload (Dataverse)"]
  Agent --> Web["Public website"]
  SharePoint --> CheckPerms["Check user permissions"]
  File --> NoPerms["No permission check"]
  CheckPerms --> ReplySP["Answer only if allowed"]
  NoPerms --> ReplyFile["Answer always if agent has access"]

Figure: How Copilot Studio agents check knowledge sources and permissions.

The takeaway is straightforward. File uploads turn into a global knowledge base for the agent, and anyone with access to the agent can query them. SharePoint with Microsoft authentication respects user permissions. For public websites and Graph connectors, access checks depend on the specific connector and authentication method, and you usually don't get the kind of granular permission filtering SharePoint offers.

Generative answers and moderation need testing with different users

Source-level access is only part of the picture. The generative answer and moderation settings in Copilot Studio also make a real difference. For each agent you choose whether it only responds with quoted information from its knowledge sources or whether it uses AI to generate new answers ("generative answers"). The second option brings more risk, particularly when the knowledge sources contain weak or outdated data. The content moderation level matters too. It ranges from "strict" (blocking risky content) to "relaxed" (letting more through), and organizations should pick it based on their risk tolerance and audience.

One tip has proven itself again and again:

Always test agents with at least two real test accounts: one with basic access, and one with elevated permissions. This is the only way to verify if knowledge sources are filtered properly, or if you're about to stumble into an oversharing disaster.

The preview and share features in Copilot Studio make this easy, and I consider it mandatory before an agent goes into production.

Uploaded files end up in Dataverse and open the door to oversharing

Teams like uploading files, especially when they don't have a well-maintained SharePoint structure. But every uploaded file lands in Dataverse and becomes a global knowledge source for the agent. Anyone with access to the agent can pull content from those files, whether that's confidential presentations, meeting notes or other sensitive documents. It only takes one person uploading them. There's no granular access control at this level. I covered these governance risks and the DLP options in my post on Copilot Studio governance: risks and controls in 2024, and the wider issue of Copilot oversharing keeps coming back. My advice is to avoid file uploads unless you really need them and to tightly restrict access to any agent that uses uploaded sources.

Every knowledge source needs a check before go-live

Before a Copilot Studio agent is released, I always run through this short checklist:

  • Are all knowledge sources documented and tested with the smallest possible audience?
  • Are SharePoint sources always set up with Microsoft authentication so user permissions are enforced?
  • Are there any file uploads, and is that content really meant for every agent user?
  • Which moderation level is set, and does it match your risk profile?
  • Are generative answers enabled or disabled, and was that a deliberate decision?

Any one of these points can spare you a privacy or compliance headache in production.

Copilot Studio knowledge sits one click away from disaster or success

With Copilot Studio, practically anyone can build a knowledge agent. That helps business agility, but it's also risky: one click too many and internal documents are suddenly available to hundreds of users before anyone notices. Every admin should understand the difference between SharePoint (with user authentication) and file upload (no permission checks). For now the technical controls are still limited, so secure use comes down to governance, awareness and careful testing. Keep an eye on your agents, test with real accounts, and keep in mind that Copilot Studio knowledge sources are only as secure as their weakest link.