Dear Microsoft team,
I would like to confirm whether it is permissible to conduct a penetration test (vulnerability assessment) on a chatbot built using Copilot Studio.
The chatbot is embedded into a portal site that is hosted on a third-party SaaS platform. The agent secrets are protected via a custom-developed API, which is deployed on Azure Web Apps.
Given this setup, is it acceptable to perform a standard enterprise-level penetration test on the chatbot? Are there any procedures or approvals required before doing so?
Additionally, I would appreciate any guidance on whether such a vulnerability assessment is recommended or necessary for this type of deployment.
Thank you in advance for your support.
Best regards,
Under review
Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.
As AI tools become more common, we’re introducing a Responsible AI Use…
We are honored to recognize Tom Macfarlan as our Community Spotlight for October…
These are the community rock stars!
Stay up to date on forum activity by subscribing.
Romain The Low-Code... 523 Super User 2025 Season 2
Michael E. Gernaey 378 Super User 2025 Season 2
DAnny3211 132
