KQL Search

Query Details

HomeAI ToolsDevice Query

Copilot Agent Approval

Query

# Copilot - Agent Approval

![KQL](https://img.shields.io/badge/language-KQL-blue.svg)
![Status: Stable](https://img.shields.io/badge/status-stable-brightgreen.svg)

## Query Information

### Description

Companies can use Copilot Studio to create more advanced agents. These agents can be published to different channels within your organization, such as Microsoft 365 Copilot and Microsoft Teams. When an agent is published from Copilot Studio, the agent will be displayed in the Requests tab in the All agents list in the Microsoft 365 admin center.

The below query show the events when admin approves such a request.

#### References

- [Manage requested Copilot Studio agents](https://learn.microsoft.com/en-us/microsoft-365/copilot/agent-essentials/agent-lifecycle/agent-copilot-studio-requested)

### Author

- **Alex Verboon**

## Defender XDR

```kql
OfficeActivity
| where OfficeWorkload == "MicrosoftTeams"
| where Operation == "TeamsAdminAction"
| extend ApprovedAppID = tostring(ExtraProperties[0].Value)
| where NewValue == @"Approved"
| project TimeGenerated, ApprovedAppID,UserId
```

```kql
CloudAppEvents
| where ActionType == @"TeamsAdminAction"
| extend Info = parse_json(RawEventData)
| where parse_json(Info)["NewValue"] == 'Approved'
| extend ApprovedAppID = tostring(parse_json(Info.ExtraProperties[0].Value))
| project TimeGenerated, ApprovedAppID, AccountDisplayName
```

Explanation

This KQL query is designed to track when an admin approves a request for an agent created in Copilot Studio to be published to platforms like Microsoft Teams. Here's a simple breakdown of what the query does:

  1. Data Source: The query pulls data from two sources: OfficeActivity and CloudAppEvents.

  2. Filter Criteria:

    • It looks for activities related to Microsoft Teams (OfficeWorkload == "MicrosoftTeams").
    • It specifically targets actions labeled as "TeamsAdminAction".
    • It checks for actions where the status has changed to "Approved".

  3. Data Extraction:

    • From the OfficeActivity source, it extracts the ApprovedAppID from the ExtraProperties field and the UserId of the person who approved the request.
    • From the CloudAppEvents source, it similarly extracts the ApprovedAppID and the AccountDisplayName of the approver.

  4. Output:

    • The query outputs the time of the event (TimeGenerated), the ID of the approved application (ApprovedAppID), and the user information (UserId or AccountDisplayName) for each approval event.

In summary, this query helps administrators track when and by whom requests to publish agents from Copilot Studio to Microsoft Teams are approved.

Details

Alex Verboon profile picture

Alex Verboon

Released: April 20, 2026

Tables

OfficeActivityCloudAppEvents

Keywords

OfficeActivityMicrosoftTeamsTeamsAdminActionCloudAppEventsActionTypeRawEventDataNewValueApprovedAppIDTimeGeneratedUserIdAccountDisplayName

Operators

whereextendtostringparse_jsonproject

Actions