How can we retrieve Copilot Studio agents with policy or governance violations through an API?

There is no documented built-in Microsoft Graph, Power Platform Admin, or standard Copilot Studio API that returns the complete violation record you listed; the supported implementation is to deploy Copilot Agent Kit Agent Inventory and Compliance Hub, then query its custom Compliance Case records through the Dataverse Web API.

Recommended implementation: Compliance Hub and Dataverse

Compliance Hub evaluates agent configurations against organization-defined thresholds, assigns risk levels, opens compliance cases, and tracks SLA and enforcement status. It is an installed Microsoft kit solution—not a universal feed of Microsoft Purview findings, every DLP enforcement event, or other service-side compliance issues.^1^

1. Install and configure Copilot Agent Kit Agent Inventory.
2. Configure it to scan all required environments and agent types.
3. Install Compliance Hub.
4. In Solutions → Copilot Studio Accelerator → Cloud flows, enable:
   1. Grandchild flows
   2. Child flows
   3. Parent flows
5. Configure Threshold Config records defining:
   • Agent field and violating value
   • Risk level: High, Medium, or Low
   • SLA and enforcement action
6. Run Sync agents, followed by Run Compliance Scan.
7. Query the resulting Compliance Case, Threshold Config, and Agent Details tables through Dataverse.

The scan creates or updates compliance cases when configured thresholds are breached. Cases expose triggered thresholds, risk, lifecycle status, maker intake, and enforcement processing.^1^

Permissions and prerequisites

Initial setup requires:

• System Administrator in the target Dataverse environment
• Permission to create/configure cloud flows
• Entra permission to retrieve group IDs
• Agent Inventory installed first
• Data policies allowing Dataverse, Power Platform for Admins V2, Teams, Office 365 Groups/Users/Outlook, and Approvals^2^

For read-only API access, System Administrator is sufficient but broader than necessary. A dedicated application user or delegated user can instead have read privileges on:

• Compliance Case
• Threshold Config
• Agent Details
• Related user/team owner records

Acquire the Dataverse token for the target environment URL, such as https://<org>.crm.dynamics.com, and send it as a Bearer [Token]

Discover the installed table and column names

Compliance Hub tables are custom solution tables, so logical names, entity-set names, relationships, and available columns can vary by solution version. Discover them before building the query:

GET https://<org>.crm.dynamics.com/api/data/v9.2/EntityDefinitions
    ?$select=LogicalName,EntitySetName
    &$filter=contains(DisplayName/UserLocalizedLabel/Label,'Compliance Case')
Authorization: Bearer <dataverse-token>
Accept: application/json

Alternatively, open Power Apps → Solutions → Copilot Studio Accelerator → Tables, select the table, and inspect Properties, Columns, and Relationships. The Dataverse service document can also verify entity-set names.^3^

After substituting the discovered names:

GET https://<org>.crm.dynamics.com/api/data/v9.2/<compliance-case-entity-set>
    ?$select=<case-id>,createdon,<risk>,<status>,<remediation-status>
    &$expand=<agent-relationship>(
        $select=<agent-name>,<owner-id>
      ),<threshold-relationship>(
        $select=<violation-name>,<description>
      )
    &$filter=<status> ne <resolved-value>
Authorization: Bearer <dataverse-token>
Accept: application/json
OData-Version: 4.0
OData-MaxVersion: 4.0

Continue requesting each returned @odata.nextLink unchanged until it is absent.

Illustrative response—the property names are placeholders, not guaranteed schema names:

{
  "value": [{
    "caseId": "case-guid",
    "createdOn": "2026-11-12T08:30:00Z",
    "riskLevel": "High",
    "caseStatus": "Open",
    "remediationStatus": "Awaiting maker action",
    "agent": {
      "name": "HR Assistant",
      "ownerId": "owner-object-id"
    },
    "threshold": {
      "name": "Authentication required",
      "description": "Agent has no configured authentication"
    }
  }]
}

Verify whether your installed version has an explicit detection timestamp and violation description. Otherwise, createdon can represent case creation time, not necessarily the original detection time, and the description might reside on the related threshold rather than the case.

Tenant-wide scope

Agent Inventory provides tenant-wide visibility across configured environments, including ownership, configuration, governance indicators, and usage.^4^ Actual coverage is limited to:

• Environment and agent types selected in inventory configuration
• Environments accessible to the configured connection identities
• Records successfully enriched during synchronization

What the native APIs provide

Power Platform Inventory API can retrieve tenant inventory, owners, environments, connectors, and configuration fields:

POST {PowerPlatformAPI-url}/resourcequery/resources/query?api-version=2024-10-01
Authorization: Bearer <delegated-user-token>
Content-Type: application/json

It supports only delegated user authentication; service principals and managed identities receive HTTP 403. It does not document the requested complete compliance-case schema.^5^

Microsoft Graph Agent Registry lists tenant agents and retrieves individual agent metadata:

GET https://graph.microsoft.com/v1.0/copilot/admin/catalog/packages
GET https://graph.microsoft.com/beta/copilot/admin/catalog/packages/{id}

It requires a Microsoft Agent 365 license, CopilotPackages.Read.All at minimum, and the AI Administrator or Global Administrator role.^6^ The list response includes fields such as publisher, platform, blocked status, and modification date, but not the complete violation type, risk, detection, and remediation case data.^7^

For Graph paging, follow every @odata.nextLink exactly as returned.

Safety: Start Compliance Hub in manual-review/audit mode, validate thresholds in a non-production environment, verify exclusions and scope, and export affected agents before enabling quarantine or deletion. Deletion is permanent and cannot be undone.^2^

References

1. Set up and configure Copilot Agent Kit Compliance Hub
2. Define and enforce agent compliance with Copilot Agent Kit Compliance Hub
3. Use Insomnia with Dataverse Web API
4. Monitor agents by using Agent Inventory in Copilot Agent Kit
5. Power Platform inventory API
6. Graph API for agent registry and agent details
7. List packages (graph-preview)