MT.1113: AI agents should not be shared with broad access control policies.
| ID | MT.1113 |
| Severity | High |
| Suite | Mito |
| Product | Copilot Studio |
| Feature | Agents |
| Security area | AI and agents |
| Resource type | Agent |
| User impact of fixing | Medium |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:AC-3 Access Enforcement |
| MITRE ATT&CK | T1213 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”AI agents should not be shared broadly with unrestricted access.
Agents with access control set to Any or Any multitenant can be accessed by anyone, including users outside your organization. This increases the risk of data exposure and unauthorized use of connected systems.
How to fix
Section titled “How to fix”In Copilot Studio, go the agents overview and click on the three dots (...) and “share”. From here, select “My organization” and make sure it’s set to No permissions, unless specified. Then, in the specific agents settings, go to “Security” and “Authentication” and make sure “Multi-tenant support” is toggled off.
Learn more: Control how agents are shared and share agents with other users
Mito check. Author: lnfernux. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.