Build, govern, and scale intelligent AI chatbots across your enterprise. From knowledge-grounded generative AI to autonomous agents with full governance and DLP controls.
Microsoft Copilot Studio (formerly Power Virtual Agents) is a low-code platform for building enterprise AI chatbots and autonomous agents. Agents answer questions from SharePoint, Dataverse, and websites. They run business processes via Power Automate. They deploy across Microsoft Teams, websites, and Dynamics 365.
By Errin O'Connor, Founder & Chief AI Architect, EPC Group
Quick Answer: Microsoft Copilot Studio (formerly Power Virtual Agents) is Microsoft's low-code platform for creating enterprise AI chatbots and autonomous agents. This platform enables organizations to build conversational AI that can:
Licensing begins at $200 per tenant per month. This plan includes 25,000 messages. Additionally, Copilot Studio bots can enhance Microsoft Copilot for M365 as plugins.
This setup provides a unified AI assistant experience throughout the organization.
Enterprise organizations require AI chatbots that go beyond answering basic FAQs. They need bots that can:
Microsoft Copilot Studio offers all these features within the Microsoft ecosystem, eliminating the need for a third-party chatbot platform.
EPC Group has implemented Copilot Studio across healthcare systems (HIPAA-compliant patient intake bots), financial institutions (KYC and compliance assistants), government agencies (citizen services portals), and Fortune 500 enterprises (IT help desk automation reducing Tier 1 tickets by 40-60%). Our Microsoft 365 consulting practice includes end-to-end Copilot Studio design, development, governance, and optimization.
This guide provides essential information for enterprises. It includes:
Microsoft rebranded Power Virtual Agents to Copilot Studio in late 2023, adding generative AI, autonomous agents, and Copilot extensibility to the existing low-code bot-building platform.
Visual authoring canvas for building conversational topics, trigger phrases, and branching logic without writing code. Business users and citizen developers can create bots independently.
Connect knowledge sources (SharePoint, websites, documents) and Copilot Studio generates natural-language answers using Azure OpenAI — no manual topic authoring for every question.
Call Power Automate flows from bot conversations to execute business processes: create tickets, send approvals, update records, query databases, and trigger multi-step workflows.
Deploy bots to Microsoft Teams, websites (embed widget), Dynamics 365, Facebook, Slack, SMS, and custom channels through the Azure Bot Framework — one bot, many channels.
Entra ID authentication, DLP policies, environment-level security roles, conversation logging, and tenant isolation. Built for organizations with regulatory requirements.
New in 2025-2026: bots that run proactively on triggers (email received, record created, schedule) rather than waiting for user messages. AI agents that take action autonomously.
| Criteria | Copilot Studio | Custom Bot (Azure Bot Service + Code) |
|---|---|---|
| Development Speed | 1-4 weeks for production bot | 2-6 months for equivalent functionality |
| Developer Requirement | Citizen developers / business users | Professional developers (C#, Node.js, Python) |
| Generative AI | Built-in, toggle-on from knowledge sources | Custom integration with Azure OpenAI required |
| Maintenance | Visual editor, no deployments needed | CI/CD pipeline, code reviews, testing |
| M365 Integration | Native — Teams, SharePoint, Dataverse | Custom connectors and Graph API coding |
| Governance | Built-in DLP, environments, maker controls | Custom RBAC and logging implementation |
| Scalability Ceiling | Handles 95% of enterprise use cases | Unlimited — full code flexibility |
| Cost (Year 1) | $2,400 - $50,000 (licensing + config) | $150,000 - $500,000+ (development + infra) |
| Best For | IT help desk, HR, FAQ, internal processes | Consumer-facing, high-volume, custom NLU |
EPC Group recommendation: Begin with Copilot Studio for 95% of enterprise chatbot use cases.
Only consider custom bot development in specific situations, such as:
Copilot Studio leverages Azure OpenAI to generate natural-language responses grounded in your organization's data — no hallucination-prone open-ended generation.
When a user asks a question that does not match an authored topic, Copilot Studio searches connected knowledge sources. It generates a response based on the retrieved content. Each response includes citations that link back to the source document. This feature allows users to verify the accuracy of the information.
This is retrieval-augmented generation (RAG) built directly into the platform. There is no need for a custom Azure AI Search or LangChain setup.
Enterprise control: Administrators can configure content moderation levels. They can select from high, medium, or low settings. They also have the option to set limits on answer lengths and require citations for all generative responses.
Furthermore, administrators can restrict which knowledge sources the generative AI can access. This restriction can be based on specific topics or bots.
Copilot Studio does more than just answer questions. It can also decide which Power Automate flow to run based on user intent.
Instead of using fixed conversation trees, the generative orchestrator understands what the user needs. It can:
Example: A user says, "I need to return the laptop I received last week." The bot recognizes the intent as an equipment return. It then initiates the IT asset management flow to find the device and begins the return process. This occurs without the user having to navigate a menu tree.
All generative AI responses go through Azure AI Content Safety filters before reaching users. Administrators can set the moderation strictness to:
Additional controls include:
Governance Tip: Never connect a Copilot Studio bot to your entire SharePoint tenant. Scope knowledge sources to specific site collections relevant to the bot's purpose. An IT help desk bot should only access IT documentation sites — not HR, legal, or executive SharePoint sites.
Topics are the building blocks of Copilot Studio bots. Each topic handles a specific intent with trigger phrases, conversation nodes, and actions.
Authored topics are custom conversation flows tailored for important and common scenarios. They allow for precise control over the conversation path and gather specific information.
Furthermore, these topics can trigger Power Automate flows. This ensures that responses remain consistent.
Generative fallback addresses all other inquiries. When a user's question does not match a specific topic, the bot searches linked knowledge sources to create a response. This feature reduces the need to manually develop hundreds of FAQ topics.
By connecting your SharePoint documentation library, the bot can automatically answer questions based on that content.
The primary enterprise channel allows you to deploy bots across your organization. You can use the Teams Admin Center or let users find them in the app catalog.
Teams bots offer several features:
Pro tip: Pin the bot to the Teams left rail for organization-wide visibility. Usage increases 3-5x when the bot is visible versus buried in the app catalog.
You can embed a Copilot Studio bot on any website. Use the provided JavaScript snippet or iframe for this. You can also customize the chat widget's appearance to fit your brand. Adjust the:
Website bots support both authenticated (employee portals) and anonymous (public-facing) modes.
Use case: Customer support widget on your public website that handles product questions, routes complex issues to human agents, and collects leads after hours.
Our solution offers native integration with Dynamics 365 Customer Service, Sales, and Field Service. Bots can:
Additionally, Omnichannel for Customer Service ensures seamless bot-to-human escalation.
Enterprise value: Deflect 40-60% of Tier 1 customer service cases before they reach a human agent, reducing cost-per-resolution by 60-70%.
Every Copilot Studio bot can call Power Automate flows to execute business logic. This includes:
With over 1,000 connectors, bots can interact with nearly any system.
Generative actions: In 2026, bots can dynamically select which flow to call based on the user's intent — no rigid conversation menu required.
Without governance, Copilot Studio becomes shadow AI. EPC Group implements governance frameworks that enable innovation while maintaining control and compliance.
Separate Dev, Test, and Production environments with distinct DLP policies and security roles. Prevent untested bots from reaching production users.
Power Platform DLP policies control which connectors bots can use. Block HTTP connectors in production, restrict SharePoint access to approved sites, prevent external API calls.
Define who can create bots (maker permissions), who can publish to production channels, and who can access analytics. Prevent uncontrolled bot proliferation.
Implement approval workflows for bot publishing. Require security review before production deployment. Version control and rollback capabilities.
All bot conversations are logged in the Microsoft 365 compliance center. Configure retention policies, eDiscovery holds, and audit trail requirements.
Configure content safety thresholds for generative AI responses. Block harmful content, restrict off-topic responses, and enforce topic boundaries.
For a comprehensive governance framework that covers Copilot Studio alongside Copilot for M365, see our Copilot Governance Strategy: Enterprise Playbook 2026.
Configure bots to require Entra ID (Azure AD) sign-in before they respond. This setup allows for:
For bots deployed in Teams, authentication is seamless. The bot inherits the user's existing Teams session.
For bots deployed on websites, you need to configure OAuth 2.0 sign-in. Use Entra ID as the identity provider.
Security Warning: Copilot Studio bots that use generative AI with SharePoint knowledge sources can inadvertently surface sensitive content if SharePoint permissions are overly permissive. Always audit SharePoint permissions before connecting sites as knowledge sources. EPC Group includes a SharePoint permissions audit in every Copilot Studio engagement.
EPC Group creates tailored Power BI dashboards. These dashboards combine Copilot Studio analytics with key organizational KPIs. They link bot performance to important business outcomes, including:
$200/tenant/month
$100/50,000 messages
| Scenario | Monthly Conversations | Est. Messages | Monthly Cost |
|---|---|---|---|
| Small (500 employees) | 2,000 | ~25,000 | $200 |
| Medium (2,000 employees) | 10,000 | ~120,000 | $~400 |
| Large (10,000 employees) | 50,000 | ~600,000 | $~1,400 |
| Enterprise (50,000 employees) | 200,000 | ~2,400,000 | $~5,000 |
Estimates are based on an average of 10 exchange conversations, with 20 messages each. Actual costs may vary depending on the complexity and volume of conversations.
Check your existing Microsoft 365 and Power Platform licensing. Copilot Studio may already be partially included.
Real-world implementations EPC Group has delivered across industries. Each use case delivers measurable ROI within 90 days of deployment.
Automate password resets, software requests, VPN troubleshooting, and common IT tickets. Reduce Tier 1 ticket volume by 40-60%.
Answer benefits questions, process PTO requests, onboarding workflows, and policy inquiries from the employee handbook.
HIPAA-compliant appointment scheduling, insurance verification, pre-visit questionnaires, and prescription refill requests.
KYC document collection, account opening workflows, regulatory Q&A, and compliance training reminders with full audit trails.
Course registration assistance, financial aid inquiries, academic advising scheduling, and campus resource navigation.
Order status tracking, return processing, product recommendations, and shipping inquiries with Dynamics 365 Commerce integration.
Submit maintenance requests, book conference rooms, report safety issues, and track work order status through Dataverse.
Retrieve pricing, generate quotes, pull competitive intelligence, and schedule customer demos from Dynamics 365 Sales data.
Answer contract clause questions, route NDA requests, track approval workflows, and surface relevant legal precedents from SharePoint.
Permit applications, benefits enrollment, service request routing, and multilingual FAQ responses for public-facing government portals.
EPC Group's 5-phase methodology for enterprise Copilot Studio deployments. Timeline: 6-16 weeks depending on complexity and governance maturity.
End-to-end M365 strategy, migration, governance, and optimization for enterprise organizations.
Learn MoreComplete deployment playbook for Copilot for Microsoft 365 — prerequisites, licensing, governance, and rollout.
Read GuideEnterprise governance framework for all Copilot products — DLP, compliance, security, and audit controls.
Read PlaybookMicrosoft Copilot Studio (formerly Power Virtual Agents) is a low-code platform for building enterprise AI chatbots and agents. It enables organizations to create conversational AI experiences that can answer questions from organizational knowledge (SharePoint, websites, Dataverse), execute business processes via Power Automate flows, authenticate users through Microsoft Entra ID, and deploy across Microsoft Teams, websites, Dynamics 365, and custom channels. In 2026, Copilot Studio includes generative AI capabilities powered by Azure OpenAI, allowing bots to generate natural-language responses from connected knowledge sources without manual topic authoring for every question.
Microsoft Copilot Studio uses two licensing models: 1) Per-tenant license at $200/tenant/month — includes 25,000 messages/month, unlimited bot creation, and all channels. 2) Message pack add-ons at $100 per 50,000 additional messages when you exceed the included 25,000. A "message" counts each user message AND each bot response as separate messages, so a typical conversation of 10 exchanges = 20 messages. For enterprises averaging 100,000 monthly conversations (10 exchanges each = 2 million messages), expect $200 base + approximately $3,900 in message packs = ~$4,100/month. Copilot Studio is also included in some Microsoft 365 plans — check your existing licensing before purchasing separately.
Copilot Studio IS Power Virtual Agents — Microsoft rebranded the product in late 2023. Key improvements over the original PVA: 1) Generative AI answers — bots can now answer questions from connected knowledge sources (SharePoint, websites, uploaded documents) without manually authored topics. 2) Generative actions — bots can dynamically call Power Automate flows based on user intent. 3) Copilot extensibility — Copilot Studio bots can extend Microsoft Copilot for M365 as plugins. 4) Autonomous agents — bots can now run proactively on triggers, not just in response to user messages. 5) Improved analytics with conversation transcripts and AI-generated insights. If you built bots in PVA, they automatically migrated to Copilot Studio with no action required.
Yes. Copilot Studio supports multiple knowledge sources for generative AI answers: 1) SharePoint sites and document libraries — the bot indexes content and generates answers from internal documents. 2) Public websites — provide URLs and the bot crawls and answers from web content. 3) Dataverse tables — structured data from Dynamics 365 and Power Platform. 4) Uploaded documents — PDF, Word, and other files uploaded directly. 5) Custom data via Power Automate — connect to any system (SAP, ServiceNow, Salesforce) through flow-based knowledge retrieval. Enterprise governance tip: always scope SharePoint knowledge sources to specific sites rather than tenant-wide access. EPC Group configures knowledge sources with least-privilege principles to prevent data leakage.
Enterprise Copilot Studio security requires multiple layers: 1) Authentication — configure Microsoft Entra ID (Azure AD) authentication so bots verify user identity before responding. 2) Authorization — use Entra ID group membership to control which users can access which bot topics and data. 3) DLP policies — Microsoft Purview DLP policies can restrict which connectors and data sources bots can access. 4) Environment-level controls — deploy bots in managed Power Platform environments with security roles. 5) Tenant isolation — prevent bots from calling external APIs or connectors outside your organization. 6) Audit logging — all bot conversations are logged in the Microsoft 365 compliance center for regulatory review. 7) Sensitivity labels — content returned by bots respects Microsoft Purview sensitivity labels on source documents.
Yes, Microsoft Teams is the most popular deployment channel for Copilot Studio bots. Deployment options: 1) Organization-wide deployment via Teams Admin Center — push the bot to all users or specific groups. 2) App catalog publication — users can discover and install the bot from the Teams app store. 3) Direct link sharing — share a deep link that opens the bot in Teams chat. Teams-deployed bots support rich cards, adaptive cards, file attachments, and authentication. For enterprises, EPC Group recommends Teams deployment as the primary channel because it leverages existing Entra ID authentication, integrates with the daily workflow, and supports mobile access through the Teams app on iOS and Android.
Enterprise governance for Copilot Studio includes: 1) Environment strategy — create separate Dev/Test/Prod environments with different security policies. 2) DLP policies — restrict which connectors (HTTP, SQL, SharePoint) bots can use per environment. 3) Maker permissions — control who can create and publish bots using Power Platform security roles. 4) Bot approval workflows — require admin approval before bots are published to production channels. 5) Tenant-level settings — disable bot creation for non-approved users at the Power Platform admin center. 6) Conversation logging — all bot interactions are captured for compliance and audit. 7) AI content moderation — configure content safety filters to prevent bots from generating harmful or off-topic responses. EPC Group deploys a full governance framework as part of every Copilot Studio implementation.
Implementation timeline depends on complexity: Simple FAQ bot (single knowledge source, no authentication): 1-2 weeks including testing. Multi-channel bot with authentication and Power Automate integrations: 4-6 weeks. Enterprise-scale deployment with governance, DLP, multiple environments, and custom integrations: 8-12 weeks. Full autonomous agent with proactive triggers, multi-system integration, and compliance requirements: 12-16 weeks. EPC Group follows a 5-phase methodology: Discovery (1-2 weeks), Design (1-2 weeks), Build (2-6 weeks), Test & Govern (1-2 weeks), Deploy & Optimize (1-2 weeks). The most common delay is governance setup — organizations without existing Power Platform governance need 2-4 additional weeks to establish environments, DLP policies, and maker permissions.
Copilot Studio includes built-in analytics: 1) Session analytics — total sessions, engagement rate, resolution rate, escalation rate, and abandonment rate. 2) Customer satisfaction (CSAT) — built-in survey capability at end of conversations. 3) Topic analytics — which topics are triggered most, which have the highest abandonment. 4) Generative AI analytics — how often the bot uses generative answers vs. authored topics, and the quality of AI-generated responses. 5) Conversation transcripts — full logs of every interaction for quality review. 6) Power BI integration — export analytics data to Power BI for custom dashboards and cross-bot reporting. For enterprises, EPC Group builds executive dashboards that track deflection rate (conversations resolved without human handoff), cost-per-resolution, and ROI compared to traditional support channels.
For organizations already in the Microsoft ecosystem, Copilot Studio can replace most third-party chatbot platforms (Intercom, Drift, LivePerson) for internal and customer-facing use cases. Advantages over third-party platforms: 1) Native Microsoft 365 integration — authentication, SharePoint knowledge, Teams deployment. 2) Power Platform ecosystem — connect to 1,000+ data sources via Power Automate connectors. 3) No per-agent licensing — unlimited bots under the tenant license. 4) Generative AI included — no separate Azure OpenAI subscription needed. Limitations to evaluate: custom UI requirements beyond adaptive cards, complex NLU scenarios requiring fine-tuned models, and high-volume consumer-facing scenarios exceeding 5 million messages/month. EPC Group provides migration assessments for organizations moving from Dialogflow, Amazon Lex, or IBM Watson to Copilot Studio.
EPC Group specializes in designing, building, governing, and optimizing Copilot Studio implementations. We serve Fortune 500 companies, healthcare systems, financial institutions, and government agencies.
Our solutions range from:
We deliver production-ready solutions tailored to your needs.
29 years Microsoft ecosystem expertise | Microsoft Solutions Partner | HIPAA, SOC 2, FedRAMP-aligned consulting expertise implementations
Microsoft Copilot Studio (formerly Power Virtual Agents) is a low-code platform for creating enterprise AI chatbots and autonomous agents.
These agents can:
Copilot Studio builds conversational AI that combines generative answers with structured process automation.
A user asks a question using natural language. The agent identifies the user's intent and queries the relevant knowledge source. It then retrieves a grounded answer.
If the intent requires action, the agent triggers a Power Automate flow to complete the task. This process eliminates the need for menu trees.
Example: A user says, "I need to return the laptop I received last week." The agent recognizes the intent as an equipment return. It then calls the IT asset management flow to find the device. Finally, it starts the return process — all in one conversation.
Build a Copilot Studio agent when your knowledge source is well-structured and your process is clearly defined.
Purchase a pre-built Microsoft agent when the use case is generic enough to fit without customization. Options include:
Enterprise agents access sensitive organizational data. Build governance in from the start.
Copilot Studio is the new name for Power Virtual Agents. It now includes generative AI features. This tool allows you to create enterprise chatbots and autonomous agents.
These agents can:
Microsoft 365 Copilot is a personal AI assistant designed to boost individual productivity. It helps users with tasks like writing documents, summarizing meetings, and analyzing data.
Copilot Studio allows the creation of shareable agents for multiple users. Examples include:
While both utilize generative AI, they have distinct purposes.
SharePoint sites, uploaded documents, public websites, Dataverse tables, and Azure AI Search indexes are important knowledge sources. The quality of these sources impacts agent accuracy.
Clean and well-structured SharePoint sites can create accurate agents in 8–12 weeks. In contrast, overshared or poorly organized content requires cleanup before grounding.
Copilot Studio can be set up in a HIPAA-compliant way. This setup includes:
EPC Group has created HIPAA-compliant patient intake agents using this technology.
The platform license starts at $200 per month for 25,000 messages. The build cost varies based on complexity:
Contact EPC Group for a fixed-fee estimate based on your specific use case.
EPC Group designs, builds, and deploys Copilot Studio agents for enterprise and regulated-industry clients. Call (888) 381-9725 or schedule a discovery call.
DEPLOYING THIS IN PRODUCTION?
Fixed-fee readiness assessment — 240+ delivered since Aug 2025. Includes the 30-Day Tenant Hardening Accelerator option.
AI assistant — not human