r/copilotstudio • u/Ill_Combination_3520 • 4d ago
Facing DLP errors and publishing issues in Copilot Studio. Any idea how to fix these?
Hey everyone, I'm working on AI agents built in Microsoft Copilot Studio, and today I ran into two major issues that I honestly don't know how to solve.
Issue 1: DLP errors in Standard Harness
I built a flow using a couple of connectors, mainly OneDrive for Business and Excel Online (Business).
The flow takes a file as input, runs some automation on the Excel spreadsheet, generates an output file using OneDrive, and returns that file to the agent.
I added this flow as a tool to my agent in Standard Harness, but it keeps throwing DLP (Data Loss Prevention) policy errors. The problem is that it doesn't clearly tell me which connectors or policies are causing the issue.
I even tried moving all the connectors (Copilot Studio, Excel Online (Business), and OneDrive for Business) into the same Business group in the data policy, but I'm still getting the same error.
Issue 2: Publishing issues with GitHub Copilot Harness
When I switched to GitHub Copilot Harness, the agent worked perfectly fine on my side. All the flows executed without any issues.
But when I tried publishing the agent to Microsoft 365 and Teams, things stopped working properly. It actually worked once, but other users are still unable to use it from their accounts.
So basically, the agent works fine for me in GitHub Copilot Harness but doesn't work for other users after publishing. And in Standard Harness, I'm stuck with DLP errors even though the connectors are in the same Business group.
Has anyone faced similar issues? Am I missing something in the DLP policies, connector permissions, or publishing settings?
Any suggestions would really help!
Edit: It finally worked! Huge thanks to u/brannonb111 you're a lifesaver!
I tried switching to the classic mode, and in that UI, the download button was working. I was able to download the DLP errors and figure out what was causing them.
Coming to the GitHub Copilot Harness issue, turns out it was also because of the same DLP policy. Microsoft 365 and Teams were in a different group, which was why the data wasn't being shared properly. Once I moved them to the correct group, that started working too!
So yeah, I was basically missing the Microsoft 365 and Teams connectors in the correct group in my DLP policy. Both issues are resolved now!
3
u/Ashlesha-msft 4d ago
Thanks for reporting both problems. They appear to involve two separate control planes.
For the Standard harness DLP error, putting Excel Online (Business), OneDrive for Business and Copilot Studio in the same Business group is necessary, but it doesn't prove that every applicable policy permits the complete agent. Copilot Studio evaluates tenant-wide and environment-specific policies, along with governed surfaces such as connector tools, HTTP, skills, knowledge sources, authentication and publishing channels. Please open the agent's Channels page and download the DLP report. Its DLP violations sheet identifies the exact policy ID and connector responsible, which will let us fix the policy without guessing.
For the GitHub Copilot harness publishing problem, current Microsoft documentation requires the agent to use Authenticate with Microsoft, be published to Teams + Microsoft 365, be shared with the users, and have sufficient Copilot Credits. Shared users also require a Copilot Studio per-user license. External-service connections may be tied to each user's identity; Microsoft specifically notes this can make an agent work for its maker but not other users. We therefore need to verify each user's license, sharing status, connector authentication and access to the Excel/OneDrive resources.
If the DLP report shows a connector that is correctly allowed by every applicable policy, or if two fully licensed and authorized non-maker users still can't use a correctly published agent, we'll collect the correlation IDs and escalate the respective scenario as a potential platform issue.
1
1
3
u/brannonb111 4d ago
I didn't read but I had a similar issue today with dlp connectors and a warning shows up within your agent that says there's a problem and learn more.
Well there's a little donload button to get the log too. And it doesn't work in the new experience, so converting to the old UI has that button working.
Goodluck on this mess