If you operate in a regulated industry, Customer Lockbox is probably one of the controls you point at when an auditor asks how you limit Microsoft’s access to your data. It’s a good control for what it covers. The problem is what it doesn’t.
Customer Lockbox in Power Platform covers a specific set of operations: when Microsoft support engineers need access to your resources to resolve a support ticket, that access goes through an approval workflow you control. You see the request, you approve or reject it, and the access is logged and time-boxed.
Where the gap shows up
That approval workflow is scoped to support-driven access to your Power Platform resources. Audit telemetry is a different pipeline entirely. When Copilot Studio emits audit events, and when Agent 365 records agent activity, those events flow through Microsoft’s logging infrastructure outside the Lockbox approval model. Lockbox gates support access to your tenant’s resources. It does not gate the telemetry that Microsoft’s own services generate and process as part of running the platform.
For most tenants that distinction is academic. If you’re in healthcare, finance, or defense, it isn’t: your data protection commitments probably don’t carve out a “platform telemetry” exception, and an auditor who reads the Lockbox documentation closely will notice the scope boundary too.
What to do about it
A few practical moves:
- Read the Lockbox scope document before you cite it as a control. The list of lockbox-protected operations is explicit. Anything not on it should be described accurately in your compliance artifacts, not by implication.
- Treat agent audit events as tenant data in their own right. Know which audit categories you’re generating, where they land (Purview, Log Analytics, or both), and what retention you’ve configured.
- Ask the vendor question directly. If a contract or DPA claims Lockbox coverage for “all data access,” get that scoped in writing. Vague assurances about Microsoft access controls are how audit findings get born.
None of this means Copilot Studio or Agent 365 are unusable in regulated environments. It means the control narrative has to match the actual documentation, and the actual documentation is narrower than most people assume.
We run into this gap in nearly every regulated Copilot rollout we assess. If you want a second pair of eyes on what your tenant is actually emitting and who can see it, that’s the kind of work we do.