.png)
October 27, 2026
|
5 minutos de lectura
Governing Microsoft Copilot Studio Agents: Identity, Access, and Audit at the Gateway
.png)
Diseñado para la velocidad: ~ 10 ms de latencia, incluso bajo carga
¡Una forma increíblemente rápida de crear, rastrear e implementar sus modelos!
- Gestiona más de 350 RPS en solo 1 vCPU, sin necesidad de ajustes
- Listo para la producción con soporte empresarial completo
TrueFoundry AI Gateway ofrece una latencia de entre 3 y 4 ms, gestiona más de 350 RPS en una vCPU, se escala horizontalmente con facilidad y está listo para la producción, mientras que LitellM presenta una latencia alta, tiene dificultades para superar un RPS moderado, carece de escalado integrado y es ideal para cargas de trabajo ligeras o de prototipos.
Diseñado para la velocidad: ~ 10 ms de latencia, incluso bajo carga
Try now.
Inscríbase
¿Cómo se puede evitar que los costos de GenAI se disparen a gran escala?
Gartner Hype Cycle for Platform Engineering 2026
One Layer of Control for All AI
Tabla de contenido
Controle, implemente y rastree la IA en su propia infraestructura
Summarize with
Descubra más
No se ha encontrado ningún artículo.
.png)
.png)
No se ha encontrado ningún artículo.
Blogs recientes
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
Preguntas frecuentes
How do you govern a Copilot Studio agent with no code?
You govern it at the path its tool calls take. The Power Platform custom connector performs an OAuth on-behalf-of exchange and the TrueFoundry MCP gateway performs a second exchange into a token the MCP server accepts — adding identity, access control, and audit without touching the agent.
What is the Entra Agent ID, and does it reach the gateway?
It is a directory identity Copilot Studio creates automatically for the agent, used for inventory, sponsorship, and Conditional Access. It does not appear in the tokens sent to the gateway, so TrueFoundry uses a mirror agent identity keyed on the azp claim for access decisions.
Which mode should I use?
On-behalf-of for agents acting for a signed-in user: the MCP server rejects the agent-service audience, so the gateway stays on the path and the user is preserved. Client credentials for unattended agents. Avoid passthrough in production — only network controls keep the gateway on the path.
Why are my MCP tools being ignored?
Most often because orchestration is set to classic. Copilot Studio silently ignores MCP tools under classic orchestration — switch it to Generative.
Does the user identity reach my MCP server?
In passthrough and on-behalf-of modes, yes — key the user on oid, not sub. In client-credentials mode the user is dropped at the gateway, so per-user checks happen there and the server sees only an app identity with the Tool.Invoke role.
Can I scope which tools the agent can call?
Yes. The gateway restricts tools through Virtual MCP Servers, and applies guardrails, rate limits, and tool approvals per server or tool — on top of the MCP Server User and Agent Access grants.
