How can we scan Copilot Studio topics for hardcoded secrets and credentials using APIs?

Build the compliance check by reading Topic v2 records from Dataverse’s botcomponent table or cloning each agent with PAC CLI, then run a dedicated secret detector that emits only redacted finding metadata; Copilot Studio’s automatic security scan does not scan arbitrary topic text for hardcoded credentials.

1. Retrieve agents and topic definitions

Copilot Studio stores agent authoring components—including topics—in Dataverse. The relevant records and fields are:

• Agent: bot.botid, bot.name
• Topic: botcomponent.botcomponentid, botcomponent.name
• Topic type: botcomponent.componenttype = 9 for Topic (V2)
• Agent relationship: botcomponent.parentbotid
• Definition text: botcomponent.data and, where populated, botcomponent.content

Both data and content are memo fields containing component configuration; data is documented as OBI-format content. Dataverse supports Retrieve and RetrieveMultiple through the Web API for this table.^1^

Query the Dataverse Web API with an authenticated identity:

GET /api/data/v9.2/botcomponents?
  $select=botcomponentid,name,parentbotid,componenttype,data,content&
  $filter=componenttype eq 9

Join parentbotid to the bot table to obtain the agent ID and display name. Dataverse supports both OData and FetchXML retrieval through its Web API.^2^

For inventory at scale, Microsoft’s Agent Inventory uses the same underlying model: agent identity comes from bot, while Topic v2 configuration, HTTP actions, prompts, connection references, and authentication modes are derived from botcomponent.data.^3^

Permissions: grant only the required Dataverse read access. System Customizer has organization-wide access to bot and botcomponent; Environment Maker normally has user-scoped access. A service account therefore needs a suitable custom security role if it must scan all agents without broader write privileges.^4^

2. Alternative: scan a local agent workspace

PAC CLI can clone an existing agent, including its authoring files, to a local workspace:

pac auth create --environment "<environment-id-or-url>"

pac copilot clone `
  --bot "<agent-id-or-schema-name>" `
  --environment "<environment-id-or-url>" `
  --output-dir ".\agents"

pac copilot clone requires an authenticated profile and accepts either the agent ID or schema name.^5^

For solution-based ALM, place the agent and required objects in an unmanaged custom solution and export it. Be aware that some custom topics or knowledge sources might be separate resources and not automatically included; use Agent → ⋮ → Advanced → Add required objects before export.^6^

3. Detection and privacy-preserving output

Scan the raw definition only in memory. Combine:

• Provider-specific token signatures.
• Connection-string and URL-credential patterns.
• Private-key and JWT signatures.
• High-entropy candidate detection.
• Contextual keywords such as password, apiKey, clientSecret, and authorization.
• Allowlisting for placeholders, references, and test values.

Return a record such as:

{
  "agentId": "redacted-guid",
  "agentName": "Support agent",
  "topicId": "redacted-guid",
  "topicName": "Call backend",
  "findingType": "PossibleApiKey",
  "severity": "High",
  "location": {
    "field": "data",
    "path": "$.actions[2].headers.Authorization",
    "line": 47
  },
  "fingerprint": "HMAC-SHA256:...",
  "remediationStatus": "Open"
}

Do not persist the matching value, surrounding snippet, request headers, or raw topic definition. Generate a keyed HMAC fingerprint in memory, then discard the candidate. The fingerprint allows deduplication and remediation tracking without making short or predictable secrets vulnerable to ordinary hash lookup.

remediationStatus is not supplied by the topic record; maintain it in your compliance store, keyed by agent ID, topic ID, detector rule, location, and fingerprint. On rescan:

• Same fingerprint: retain status.
• Finding absent: mark Resolved.
• Different fingerprint at the same location: create a new finding.

4. Microsoft scanner coverage

Copilot Studio’s automatic pre-publish scan currently warns about:

1. No authentication.
2. Maker-provided credentials for connectors or flows.
3. Sharing an agent with everyone.

It does not document scanning arbitrary topic definitions for embedded API keys, passwords, tokens, or connection strings.^7^

Power Apps Checker can analyze exported solution packages through pac solution check or its asynchronous web API and returns SARIF reports.^8^ However, the documented material does not establish a Solution Checker rule that detects arbitrary secrets inside Copilot Studio topic definitions. Use it as an additional solution-quality gate, not as the sole credential scanner.

Microsoft’s security guidance recommends periodically scanning source and build artifacts for exposed secrets. Any detected secret should be treated as compromised and revoked, then replaced with a Key Vault-backed secret reference where the consuming Power Platform component supports it.^9^

References

1. Agent component (botcomponent) table/entity reference (Microsoft Dataverse)
2. Use FetchXML to retrieve data from Dataverse
3. Agent Inventory data source
4. Secure your Copilot Studio projects
5. pac copilot
6. Export and import agents using solutions
7. Automatic security scan in Copilot Studio
8. Use the Power Apps checker web API
9. Recommendations for protecting application secrets