Copilot Agent Approval

Query

OfficeActivity
| where OfficeWorkload == "MicrosoftTeams"
| where Operation == "TeamsAdminAction"
| extend ApprovedAppID = tostring(ExtraProperties[0].Value)
| where NewValue == @"Approved"
| project TimeGenerated, ApprovedAppID,UserId

About this query

Copilot - Agent Approval

Query Information

Description

Companies can use Copilot Studio to create more advanced agents. These agents can be published to different channels within your organization, such as Microsoft 365 Copilot and Microsoft Teams. When an agent is published from Copilot Studio, the agent will be displayed in the Requests tab in the All agents list in the Microsoft 365 admin center.

The below query show the events when admin approves such a request.

References

Manage requested Copilot Studio agents

Author

Alex Verboon

Defender XDR

CloudAppEvents
| where ActionType == @"TeamsAdminAction"
| extend Info = parse_json(RawEventData)
| where parse_json(Info)["NewValue"] == 'Approved'
| extend ApprovedAppID = tostring(parse_json(Info.ExtraProperties[0].Value))
| project TimeGenerated, ApprovedAppID, AccountDisplayName

Explanation

This KQL query is designed to track when an admin approves a request for an agent created in Copilot Studio to be published to platforms like Microsoft Teams. Here's a simple breakdown of what the query does:

Data Source: The query pulls data from two sources: OfficeActivity and CloudAppEvents.
Filter Criteria:
- It looks for activities related to Microsoft Teams (OfficeWorkload == "MicrosoftTeams").
- It specifically targets actions labeled as "TeamsAdminAction".
- It checks for actions where the status has changed to "Approved".
Data Extraction:
- From the OfficeActivity source, it extracts the ApprovedAppID from the ExtraProperties field and the UserId of the person who approved the request.
- From the CloudAppEvents source, it similarly extracts the ApprovedAppID and the AccountDisplayName of the approver.
Output:
- The query outputs the time of the event (TimeGenerated), the ID of the approved application (ApprovedAppID), and the user information (UserId or AccountDisplayName) for each approval event.

In summary, this query helps administrators track when and by whom requests to publish agents from Copilot Studio to Microsoft Teams are approved.

Details

Alex Verboon

Released: April 20, 2026

Tables

OfficeActivityCloudAppEvents

Keywords

OfficeActivityMicrosoftTeamsTeamsAdminActionCloudAppEventsActionTypeRawEventDataNewValueApprovedAppIDTimeGeneratedUserIdAccountDisplayName

Operators

whereextendtostringparse_jsonproject

Actions

GitHub

KQL Search