Microsoft Copilot Studio
Discover Copilot Studio bots, flows, and topics in your Power Platform environment.
Airia connects to your Microsoft Power Platform (Dataverse) environment and enumerates Copilot Studio bots, the Power Automate workflows associated with them, and bot components and topics. Discovered agents land in the inventory with their composition.
Authentication model
A Microsoft Entra ID service principal with a client secret, authenticating against
Dataverse. Airia requests tokens for a scope derived from the target environment URL: for the
environment https://yourenv.crm.dynamics.com the scope is
https://yourenv.crm.dynamics.com/.default. Certificate authentication is also supported as
an alternative to a client secret.
Required Dataverse role
The service principal must be added as an Application User in the target Dataverse environment, with a security role granting Read on three tables:
bot(the Copilot Studio bots)workflow(associated Power Automate flows)botcomponent(bot topics and components)
The built-in System Customizer role is the simplest off-the-shelf role that covers these. For strict least privilege, create a custom security role with Read on exactly those three tables at Organization scope. System Administrator also works if your governance allows it.
Customer-side setup steps
- In the Azure portal, open Microsoft Entra ID → App registrations → New registration.
Name it something like
airia-copilotstudio-discovery. - Create a client secret under Certificates & secrets and copy it.
- Copy the Application (client) ID and Directory (tenant) ID from the app overview.
- In the Power Platform admin center, go to Environments, select your environment, then Settings → Users + permissions → Application users → New app user.
- Add the app from step 1 as an Application User.
- Assign the System Customizer security role (or your custom read-only role) to the new Application User.
- Copy the Environment URL (for example
https://yourenv.crm.dynamics.com). - In Airia, go to Discover → Connections → Microsoft Copilot Studio and create a new connection with the tenant ID, client ID, client secret, and (recommended) the environment URL.
Form fields the Airia UI asks for
| Field | Required | Notes |
|---|---|---|
| Tenant ID | Yes | Entra tenant GUID |
| Client ID | Yes | App registration's client ID |
| Client secret | Conditional | Stored encrypted; either this or certificate auth |
| Use certificate auth | No (toggle) | Alternative to the client secret |
| Certificate data / password | Conditional | When certificate auth is on |
| Environment URL | No | See "One environment or many" below |
| Webhook threat detection | No (toggle) | Optional feature |
One environment or many
- Environment URL set: Airia connects directly to that one environment. Simplest when a single Copilot Studio environment is in scope.
- Environment URL blank: Airia uses Microsoft's Global Discovery Service to enumerate environments. Useful for tenants with many environments, but the service principal must be added as an Application User (with the security role) in every environment you want discovered.
One Entra app registration and one client secret can cover multiple Dataverse environments in the same tenant; the per-environment work is Microsoft-side only (add the Application User and assign the role in each environment).
Multiple environments in Airia
Multiple Copilot Studio connections per tenant are supported. Two patterns: one connection per environment (explicit environment URL on each), or a single connection with the URL blank using Global Discovery Service as described above.