An agent built in Copilot Studio answers from whatever knowledge its maker points it at. In a managed environment, that choice no longer has to be the maker's alone. The Power Platform admin center now has a setting, Knowledge sources for agents, that decides which SharePoint and OneDrive sites, which public websites, and whether uploaded documents an environment's agents may use. Next to it, a feature called maker guidelines puts a short message from the administrator in the Copilot Studio Review pane. The roadmap gives maker guidelines a preview in September and general availability in November CY2026 (ID 570967). Learn marks both pages as prerelease documentation.
Our view: the site list is a records decision. The records owner says which sites hold content an agent may answer from, the Power Platform administrator enforces it, and the maker builds inside it.
Three switches, one of them per URL
Knowledge sources for agents sits under Security > Data and privacy in the admin center, and also as an environment group rule. It has three parts.
SharePoint + OneDrive. None, All, or Custom. Custom takes a list of site URLs, each marked Allow or Deny, and agents reference them in priority order starting with the first URL.
Public websites. The same None, All or Custom choice, with the same allow and deny list.
Documents. Yes or No: whether people can upload documents to their agents as knowledge.
All is the setting to avoid in any environment where agents touch business process. It hands the question back to each maker, one agent at a time. Custom, with a short Allow list the records owner has signed, is where we'd start. For uploaded documents we'd start at No in those environments, so agents ground on libraries that already have an owner, a retention policy and labels, and turn it on deliberately where a team needs it.
Set it on the group, not the environment
The setting works at environment and environment group level. When an administrator sets it on a group, Learn says it's distributed to every environment in the group and can't be modified at environment level. That's the behavior you want for production. A maker with environment admin rights in one environment can't quietly widen what agents there may read.
The same rules list for environment groups carries the controls that sit around it: sharing agents with Editor permissions, sharing with Viewer permissions, access to conversation transcripts, generative AI settings, external models, maker welcome content and maker guidelines. The sharing rules matter here as much as the knowledge rule. Turn off Viewer sharing and makers can't share an agent with individual viewers or with any security group. Choose "Only share with individuals" and you can cap how many viewers each agent can have. An agent that grounds on a restricted site and is then shared widely is an access decision too, and it deserves the same owner.
Two places to tell makers the rules
Managed environments have had maker welcome content for a while. It's plain text or Markdown that greets makers when they sign in to Power Apps or Copilot Studio, with an optional Learn more URL. One option is worth using: Include consent button and log maker activity makes makers acknowledge a terms page before they continue, and logs a UserConsented event in Microsoft Purview with the date and time. That's evidence a maker was told.
Maker guidelines does a different job. It appears when a maker selects Review on an agent, beside the agent's blockers and warnings, under the heading "A message from your admin", and it stays there even when the agent has no issues. The administrator gets:
a plain-text message of up to 400 characters,
an optional HTTPS button link, with a label of up to 50 characters,
an optional contact email.
It can be set per managed environment or per environment group. On a group's Rules tab, Save isn't enough; the rule takes effect after Publish rules. It isn't available outside managed environments.
Write the 400 characters
Four hundred characters is a constraint worth respecting. A message along these lines uses 251 of them:
Agents here may use the Finance Policies and Procedures sites only. No uploaded files, no public websites. Share with named people, not groups. If your agent needs another site, use the request button. The records owner approves new knowledge sources.
It names what's allowed, says no to the rest, and points at a request path with an owner. The button link goes to the request form, and the contact email goes to a team mailbox rather than a person who might leave. If the message doesn't match the knowledge rule the administrator set, makers will believe the setting, so change both together.
Who approves, who applies
The records owner approves the Allow list of sites, any public sites, and whether uploads are permitted, and approves each request to add a source. The Power Platform administrator applies the rule at environment group level, sets the sharing limits, writes the welcome content and the maker guidelines message, and publishes them. The maker builds against the list and asks when it's wrong.
Our Power Platform environments post argued that flows touching business records belong in environments with a named owner. Agents belong in the same place, for the same reason, and now the environment can say which records they may read.
