Create a Copilot Studio Dataverse custom role

Create a Copilot Studio Dataverse custom role.

Before you begin

Role required: User Security role

Procedure

1. Navigate to Power Platform Admin Center > Environments > Pick the environment > Settings > Users + Permissions. > Security roles.

2. Click New role and give it a name like SGC-Copilot Discovery (Read only).

   Note: Start empty rather than copying, so you don't inherit stray privileges.

3. In the role editor, find each of the three tables and set only the Read privilege.

   Note: Leave Create/Write/Delete/Append/Append To/Assign/Share at None.

4. Set the Read access level to the scope your discovery needs.

   For tenant/environment‑wide cataloging via a service principal, set Read to Organization (the filled full circle) on all three tables. Anything lower (User/BU) will silently hide records the app user doesn't "own."

5. Save.

   Note:

   The three targets:

   • Bot — the agents/copilots themselves.
   • Bot component — topics, entities, and other authored components.
   • Conversationtranscript— the transcript records; the transcript body lives in the Content column, which comes back with the row's Read privilege (no separate file/attachment privilege needed for this table).