What it does
Two Power Platform admin center settings that govern what agents in Copilot Studio can reach. Knowledge sources for agents controls whether agents may use SharePoint and OneDrive, public websites, and uploaded documents as knowledge. Skills in Copilot Studio controls which skill sections makers can configure, and replaces the old Copilot Studio virtual connectors in classic data policies. Both work at environment and environment group level. The skills rule is documented separately at https://learn.microsoft.com/en-us/power-platform/admin/skills-copilot-studio-rule.
Key facts
- Knowledge sources sit under Security > Data and privacy > Knowledge sources for agents, and as a rule on an environment group.
- SharePoint + OneDrive and Public websites each offer None, All or Custom. Custom is an ordered allow/deny list of URLs, with the first URL taking priority. Documents is a simple Yes or No for uploads.
- If you set a control on an environment group it's pushed down to the environments and can't be changed there.
- Skills rules can be set from Manage > Environment groups > Rules, or from Security > Data and privacy. Environment group rule changes need Publish rules before they apply.
- Advanced connector policies don't support the skills rule, so you can't carry the old virtual connector approach across.
When to use / skip
Use the knowledge rule as soon as agents are being built outside a central team: it's the quickest control on oversharing through agent knowledge. Use the skills rule when you're retiring virtual connectors from your data policies. Skip both for a single locked-down environment where DLP already does the job and few agents exist.
Configuration decisions
- Group-level versus environment-level: set the baseline on the group, and accept that environments inside it lose the ability to deviate.
- Public websites: None, or a custom allow list. "All" turns every agent into a web-grounded one.
- Whether uploaded documents are allowed at all in production environments.
- Ordering of a Custom URL list, because order is priority.
Gotchas
- Inheritance runs one way. A maker who needs an exception will be told no by a setting they can't see the origin of, so document the group baseline.
- Moving skills governance off virtual connectors changes where the control lives. Anyone auditing classic data policies will no longer find it there.
- Rule edits at group level don't take effect until published.
- Several of these admin pages are new and still moving; screens may not match the docs for a while.
Consultant notes
- Run an inventory of existing agents and their knowledge sources before you flip a group to None. Breaking live agents on a Friday is a classic.
- Keep dev environments in a looser group than production. Makers need to experiment; you want the tight rule at the point of promotion.
- Write down which control owns what: DLP for connectors, these rules for knowledge and skills. Otherwise nobody knows where to look during an incident.
Worth revisiting after the next Power Platform admin center update.