# Protect Your Copilots: Preventing Data Leaks in Copilot Studio

Copilot Studio bots published without authentication are enumerable via predictable schema names and tenant-derived environment IDs, letting anyone chat with them and leak internal data.

- Payout: Research
- Severity: medium
- Program: Microsoft
- Write-up by: Johann Rehberger
- Disclosed: 2024-07-30
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2024/copilot-studio-protect-your-copilots/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-copilot-studio-protect-your-copilots
- Tags: area:cloud domain:cloud impact:data-leak kind:research platform:research sev:medium tech:azure technique:default-creds technique:recon vuln:access-control vuln:info-disclosure vuln:misconfiguration

**Target:** Power Platform environment API (botsbyschema / directline token endpoints)
**Root cause:** Copilot schema names follow a predictable pattern (crXXX_<name> or Default_<name>) and environment IDs are derived from the tenant ID, while 'No authentication' and Secured Access are off by default, so bots are discoverable and chattable by outsiders.
**Steps:**
1. Resolve tenant ID from `https://login.microsoftonline.com/<tenant>.onmicrosoft.com/.well-known/openid-configuration`
2. Derive environment host: strip dashes from tenant ID, split last two chars into subdomain, e.g. `default8b63cc9ba2f948ea9cb6f82c96c9ac.08.environment.api.powerplatform.com`
3. Guess schema name as `Default_<name>` or `crXXX_<name>`
4. Probe existence: `GET /powervirtualagents/botsbyschema/<schema>/canvassettings?api-version=2022-03-01-preview` — returns botId/botName/tenantId if exists, `{"demoWebsiteErrorCode":"404"}` otherwise
5. Fetch token: `GET /powervirtualagents/botsbyschema/<schema>/directline/token?api-version=2022-03-01-preview` (or by botId); error 4103 = not found, 4011 = Secured Access enabled
6. Chat via `https://copilotstudio.microsoft.com/environments/Default-<tenant>/bots/<schema>/webchat` or DirectLine API
**How found:** Observed the /botsbyschema/ route in web traffic and noticed schema names start with a tenant-consistent prefix (cr5f7_) or Default_ plus the bot name; realized environment hostname is derived from tenant ID, making the whole URL guessable.
**Exploitation:** Attacker enumerates tenant IDs, derives environment hostnames, brute-forces schema names, confirms existence via canvassettings, obtains a DirectLine JWT token, and chats with the bot to extract connected internal data sources.
**Insight:** Low-code platform identifiers often embed tenant-scoped prefixes and derive hostnames from tenant IDs; capture the /botsbyschema/ traffic and compare schema names across bots in one tenant to spot the shared prefix, then brute-force the name suffix.