Copilot Studio Security Guideline

I’m putting together a single, authoritative security guideline for Microsoft Copilot Studio that speaks to both tenant admins and app makers. It has to live inside Notion, so please structure the content in clean Markdown (H1/H2 hierarchy, tables, collapsible toggles, internal anchors) that can be pasted or imported without losing formatting.

The scope is end-to-end: data protection, user authentication and every other security-relevant setting or control mentioned anywhere in Copilot Studio’s documentation, preview features or admin center. I need practical instructions—what to enable, what to block, which roles can see what, and the exact click-path to reach each screen—alongside short explanations of the “why” so that a non-security colleague can follow the logic.

Visual aids aren’t required, so focus your time on concise wording, accurate terminology and canonical links back to Microsoft’s docs or relevant compliance standards.

Deliverables
• A Notion-ready Markdown file (or a shared Notion page) titled “Copilot Studio Security Guideline”
• Separate sections for Admins and Makers, plus an at-a-glance summary table of defaults vs. recommended settings
• Internal links, references and version dates checked for accuracy on delivery

I’ll review for completeness, clarity and Notion compatibility before sign-off.