Skip to content

Control 2.13: Plugin and Graph Connector Security — Troubleshooting

Common issues and resolution steps for plugin and connector security.

Common Issues

Issue 1: Approved Agent or Plugin Tool Not Available

  • Symptoms: A previously approved agent or plugin tool is unavailable to users
  • Root Cause: Agent type, user access, agent distribution, or tool scope no longer includes the affected user.
  • Resolution:
  • Review the agent under Microsoft 365 Admin Center > Agents > All Agents > Registry
  • Check Agents > Settings > Allowed agent types and User access
  • Where licensed, verify the plugin under Agents > Tools > Plugins and correct its user or group scope
  • Allow 24 hours for policy propagation after changes

Issue 2: Graph Connector Returning Unauthorized Content

  • Symptoms: Users see content from Graph connectors that they should not have access to
  • Root Cause: ACL mapping may be incorrect, or the connector may not be enforcing ACLs properly.
  • Resolution:
  • Review the connection under Microsoft 365 Admin Center > Copilot > Connectors > Your Connections
  • Verify the ACL mapping correctly translates source system permissions to Entra ID
  • If the access permission is wrong, delete the connection and recreate it through Custom setup; in-place permission changes are not supported
  • Test with specific users to verify access restrictions
  • Symptoms: Users submit admin consent requests that go unreviewed, blocking business app usage
  • Root Cause: No dedicated approver or unclear ownership of the admin consent workflow.
  • Resolution:
  • Under Microsoft Entra Admin Center > Enterprise apps > Consent and permissions > Admin consent settings, assign dedicated reviewers
  • Define SLAs for consent review (24 hours for standard, 4 hours for urgent)
  • Configure email notifications for pending consent requests
  • Confirm reviewers hold a role that can grant the requested permissions; reviewer assignment alone does not elevate privileges

Issue 4: Plugin Security Assessment Blocking Business Adoption

  • Symptoms: Business teams report that the plugin approval process takes too long
  • Root Cause: Security assessment process may be too comprehensive for low-risk plugins.
  • Resolution:
  • Create tiered assessment levels based on plugin risk (data access scope, publisher reputation)
  • Fast-track Microsoft first-party and Microsoft-certified plugins
  • Use standardized assessment templates to streamline reviews
  • Maintain a pre-approved plugin catalog that does not require individual review

Issue 5: Security Copilot Events Appear in the Microsoft 365 Plugin Report

  • Symptoms: The evidence export contains Security Copilot activity or plugin IDs that are not in the approved Microsoft 365 inventory.
  • Root Cause: The search used the overloaded EnablePlugin operation, read plugin fields from the AuditData root, or accepted every CopilotInteraction / Workload = Copilot record without filtering AppIdentity and CopilotEventData.AISystemPlugin.ID.
  • Resolution:
  • Use the Agent Registry and Agents > Tools inventory for enabled or blocked configuration state
  • Run Script 4 with exact approved application and plugin IDs
  • Keep Copilot.Security.SecurityCopilot and unknown AppIdentity values in a separate evidence set
  • Reconcile each accepted AgentId, AppIdentity, and plugin ID to the approval record

Diagnostic Steps

  1. Check agent status: Review the agent in Agents > All Agents > Registry
  2. Review permissions: Run Script 1 for plugin permission audit
  3. Test connector ACLs: Verify access control on connector content
  4. Check consent policy: Run Script 3 and review existing grants separately
  5. Review usage evidence: Run Script 4 and investigate rejected or unknown AppIdentity and plugin ID values separately

Escalation

Severity Condition Escalation Path
Low Plugin approval delays Governance team process improvement
Medium Connector ACL misconfiguration Security Operations and connector admin
High Unauthorized content exposed through connector Security Operations and CISO
Critical Plugin data breach or unauthorized data exfiltration Incident response team immediately