How can i get the values for security and risk for my copilot agent?

There is no single Graph, Dataverse, or Power Platform endpoint that returns CSAT, runtime security/risk, and token usage together; use Dataverse transcripts for CSAT, the Agent Review Tool’s Dataverse table for generated risk scores, and Power Platform capacity reports for consumption.

Supported data paths

1. Retrieve CSAT from Dataverse

Copilot Studio writes usage and transcript data to the associated environment’s ConversationTranscript table. Its Content column contains JSON activities, including CSATSurveyRequest and CSATSurveyResponse; metadata identifies the agent. Default Dataverse transcript retention is 30 days.^1^ ^2^

To inspect the data first:

1. Open Power Apps → Tables → All.
2. Search for and open ConversationTranscript.
3. Select Export → Export data.
4. Parse the Content JSON for activities whose valueType is CSATSurveyResponse.
5. Use Metadata.BotId or Bot_ConversationTranscript to associate results with an agent.

The caller needs the Bot Transcript Viewer security role; Environment Maker alone doesn't automatically grant transcript access.^2^

A simplified parsing pattern is:

const transcript = JSON.parse(row.Content);

const csatResponses = transcript.activities
  .filter(a => a.valueType === "CSATSurveyResponse")
  .map(a => ({
    timestamp: a.timestamp,
    response: a.value
  }));

For an interface, query conversationtranscript through the normal Dataverse Web API using an application or delegated identity that has table read permission, then perform this JSON parsing in the service layer. Alternatively, Copilot Studio’s Analytics → Effectiveness page displays the CSAT score, calculated as the average score out of five for sessions in which users answered the survey.^3^

2. Separate runtime security from review-generated risk

Runtime protection status

For published agents, Copilot Studio displays Protected, Needs review, or Unknown under Agents → Protection status. Selecting the status opens Authentication, Policies, Content moderation, blocked-message statistics, and security trends for the last 7, 14, or 30 days.^4^

The documented interface is the Copilot Studio UI. Microsoft Graph agent registry APIs provide agent inventory and metadata for administrators, but the documentation doesn't state that they return Copilot Studio’s protection status or security-analytics values.^5^

Therefore, don't scrape the Copilot Studio page or assume the protection value exists in the bot table. A supported public endpoint for this particular runtime status isn't documented.

Risk/compliance scores that can be queried

If your interface can display an assessment generated by the Copilot Agent Kit Agent Review Tool, run a review for each agent:

1. Install/open Agent Review Tool.
2. Select the environment.
3. Find the agent and select Review.
4. Read the resulting rows from the Dataverse table cat_agentreviews.

Useful columns include:

• cat_botid
• cat_overallscore
• cat_patternscore
• cat_instructionscore
• cat_totalissues
• cat_reviewresultjson

These are review results—not the built-in runtime Protection status. Reviews are user-scoped: users can only read reviews they created, and each review consumes Copilot Credits.^6^

3. Retrieve consumption, not exact token counts

For agent-level consumption:

1. Open Power Platform admin center.
2. Go to Licensing → Products → Copilot Studio → Summary.
3. Select Download report.
4. Download the agent report, or select an environment and download its detailed report.

The detailed report includes agent, AI feature, channel, LLM model, knowledge source/tool, and billed/non-billed Copilot Credits. It explicitly does not include per-message usage or input, output, and cached token counts.^7^

For supported reasoning-model rows, credits can provide an approximate billed-token estimate by multiplying credits by 100, but prompt-tool consumption can make that approximation inaccurate.^7^

For automation, Agent Inventory can retain up to 180 days of usage metrics in its Agent Details and Agent Usage History Dataverse tables after Agent sync configuration → Include usage metrics is enabled.^8^

References

1. Develop a custom analytics strategy
2. Understand downloaded conversation transcripts from Power Apps
3. Monitor conversational agent effectiveness
4. Agent runtime protection status
5. Agent registry integration for Copilot Studio
6. Analyze agents using Agent Review Tool in Copilot Agent Kit
7. Manage Copilot Credits and capacity for Copilot Studio
8. Monitor agents by using Agent Inventory in Copilot Agent Kit