Building a Copilot Studio HR Agent from Scratch

Most Copilot Studio tutorials end at "Hello World." This one doesn't. We're building a production HR agent — connected to a real SharePoint knowledge base, triggering Power Automate flows for leave requests, authenticated via Entra ID, and deployed to Microsoft Teams. Every step is the way you'd actually do it in an enterprise environment.

70%

HR ticket reduction in 90 days

4–6hrs

Saved per new hire onboarding

$200/mo

Starting cost · 25K messages

Before You Start

Prerequisites & Licensing

✅ What You Need

Before opening Copilot Studio, make sure your environment has the following. Skipping this causes broken flows and auth failures later.

Microsoft 365 license — E3 or E5 (Copilot Studio is included in M365 Copilot; otherwise $200/month per tenant for 25K messages)
Power Platform environment — a dedicated non-default environment for production agents
SharePoint Online — HR policies site already exists with at least one document library
Power Automate — premium connectors enabled (required for SharePoint list writes and approval flows)
Entra ID App Registration — you'll create this in Step 07, but note it requires Global Admin or Application Administrator role
Microsoft Teams Admin access — to approve the agent for org-wide deployment

⚠️

Environment tip: Never build production agents in the Default environment. Create a dedicated Power Platform environment (e.g., "HR-Production") with its own DLP policies. This is the most common enterprise governance mistake.

⚙️ DLP Policy Check

Before building, verify your Power Platform DLP policy allows the connectors you'll use:

Power Platform Admin Center · DLP Check

# Power Platform Admin Center → Policies → Data policies
# Verify these connectors are in "Business" data group:

✓ SharePoint           ← Knowledge base reads
✓ Microsoft Teams      ← Deployment channel
✓ Office 365 Users     ← User profile lookup
✓ Office 365 Outlook   ← Leave approval emails
✓ Approvals            ← Manager approval flow

# If any are in "Non-business" — move them before proceeding
# Cross-group connectors will block flow execution silently

✦

Design

Agent Architecture Overview

Before writing a single topic, understand what you're building. Our HR agent has three layers: a conversation layer (Copilot Studio topics), a knowledge layer (SharePoint), and an action layer (Power Automate flows).

👤

Employee
via Teams

→

🤖

Copilot Studio
Agent

→

📚

SharePoint
Knowledge

→

⚡

Power Automate
Flow

→

✅

Manager
Approval

🗂️ Agent Scope — What It Handles

Onboarding Questions — new hire checklist, IT setup steps, benefits enrollment deadlines (answered from SharePoint)
Leave Requests — employee submits dates → agent triggers Power Automate → manager approval → HR SharePoint list updated
Policy Q&A — generative AI answers from HR policy documents in SharePoint (no manual topic authoring required)
Out of Scope (escalation) — payroll disputes, disciplinary matters → agent escalates to HR email or Teams channel

💡

2026 update: Copilot Studio now supports autonomous triggers — agents that fire proactively on events (new employee record created in Dataverse, email received) rather than waiting for a user message. We'll show how to configure this for the onboarding flow.

✦

Setup

Create the Agent in Copilot Studio

🚀 Create Your Agent

Go to copilotstudio.microsoft.com and sign in with your M365 account
Select your production environment (top-right dropdown — not Default)
Click Create → New agent
Choose "Describe your agent" — type a natural language description to auto-generate the initial setup

💬 Agent Description Prompt

Paste this in the "Describe your agent" field

You are an HR Assistant for a mid-size enterprise. You help employees with onboarding questions, leave requests, HR policy questions, and benefits information. You are professional, friendly, and concise. You have access to HR policy documents on SharePoint. For leave requests, you collect the employee's name, leave type, start date, and end date, then submit for manager approval. If you cannot answer a question, escalate to the HR team at hr-support@company.com. Never discuss payroll figures, disciplinary actions, or performance review details.

⚙️ Agent Settings to Configure

Copilot Studio · Agent Settings

# Settings → General
Agent Name:        "HR Assistant"
Icon:              Upload your company HR logo or use 👥
Language:          English (United States)  ← set primary language

# Settings → AI capabilities
Generative AI:     Enabled   ← powers policy Q&A without manual topics
Orchestration:     Generative ← agent dynamically routes intent (2026 default)

# Settings → Security
Authentication:    Azure Active Directory  ← configure in Step 07
Require sign-in:   Yes  ← essential for leave requests (identity verification)

✅

Pro tip: Enable Generative Orchestration (now default in 2026). This lets the agent dynamically decide which topic or knowledge source to use based on intent — you don't need to manually map every possible phrase to a trigger.

✦

Knowledge Sources

Connect SharePoint Knowledge Base

This is where your agent gets its intelligence. Instead of manually authoring answers for every possible HR question, you point the agent at your SharePoint document library and it uses generative AI to answer naturally.

📚 Add SharePoint as Knowledge Source

In Copilot Studio → your agent → Knowledge tab → Add knowledge
Select SharePoint from the source list
Paste your HR SharePoint site URL: https://yourcompany.sharepoint.com/sites/HR
Select the specific document libraries to include (e.g., "HR Policies", "Benefits", "Onboarding")
Click Add — initial indexing takes 5–15 minutes

📂 Recommended SharePoint Structure

SharePoint · HR Site Structure

HR Site (https://company.sharepoint.com/sites/HR)
├── HR Policies/
│   ├── Leave-Policy-2026.pdf
│   ├── Code-of-Conduct.pdf
│   ├── Remote-Work-Policy.pdf
│   └── Performance-Review-Process.pdf
├── Benefits/
│   ├── Health-Insurance-Guide.pdf
│   ├── Retirement-Plan-401k.pdf
│   └── Benefits-Enrollment-Deadlines.pdf
└── Onboarding/
    ├── New-Hire-Checklist.pdf
    ├── IT-Setup-Guide.pdf
    └── First-90-Days-Guide.pdf

# Keep documents in PDF or Word format — best indexing quality
# Use descriptive filenames — they influence search relevance
# Update documents in SharePoint → agent automatically re-indexes

⚠️

Permissions note: The agent respects SharePoint permissions. If an employee doesn't have access to a document, the agent won't surface its content to them. For broad HR Q&A, ensure your HR Policies library grants read access to all employees.

💡 Improve Answer Quality

Add a custom instructions block in Knowledge settings to tell the agent how to cite sources: "Always mention the document name when answering policy questions"
Use sensitivity labels on confidential documents — labeled content won't be surfaced by the agent
Remove outdated documents from the library — stale content causes incorrect answers

✦

Conversation Design

Build Topics & Conversation Flows

Topics are structured conversation paths for actions that need to collect specific data — like a leave request. Unlike policy Q&A (handled by generative AI from SharePoint), topics give you precise control over the flow.

🗂️ Topics to Create

Leave Request — collects leave type, dates, and triggers approval flow
Onboarding Checklist — guides new hires through Day 1 setup steps
Escalate to HR — out-of-scope handler that collects question and emails HR team
Greeting — personalized welcome using employee's name from Entra ID

⚡ Leave Request Topic — Full Flow

Copilot Studio · Leave Request Topic

# Topic: Leave Request
# Trigger phrases (add at least 5 variations):
"I want to apply for leave"
"request time off"
"submit a leave request"
"I need to take leave"
"annual leave request"
"sick leave"

# Conversation nodes (in order):

Message:
  "I can help you submit a leave request. Let me collect a few details."

Question: LeaveType
  "What type of leave are you requesting?"
  Options: Annual Leave | Sick Leave | Parental Leave | Unpaid Leave

Question: StartDate
  "What is your leave start date?"
  Type: Date

Question: EndDate
  "What is your leave end date?"
  Type: Date

Question: LeaveReason
  "Would you like to add a reason? (Optional)"
  Type: Text

Confirm message:
  "You're requesting {LeaveType} from {StartDate} to {EndDate}.
  Shall I submit this for manager approval?"
  Options: Yes, Submit | No, Cancel

Call flow: Submit-Leave-Request  ← Power Automate (Step 06)

Message (on success):
  "Your leave request has been submitted. Your manager will receive
  an approval request and you'll be notified via Teams."

💬 Conversational Starters to Configure

Add these as conversation starters in your agent settings — they appear as quick-reply buttons when employees first open the agent in Teams:

Copilot Studio · Conversation Starters

🏖️  "I want to request leave"
📋  "Show me the new hire onboarding checklist"
❓  "What is our work from home policy?"
💊  "When is benefits enrollment?"
📞  "I need to speak to someone in HR"

🎭 Sample Conversation — Policy Q&A

Live Preview · HR Agent · Policy Q&A via SharePoint

👤

How many days of annual leave do I get per year?

🤖

According to the Leave Policy 2026 document, full-time employees are entitled to 20 days of annual leave per calendar year. This increases to 25 days after 5 years of service. Leave accrues monthly and unused days can be carried over up to a maximum of 10 days. Would you like to submit a leave request?

👤

Yes please

🤖

I can help you submit a leave request. Let me collect a few details. What type of leave are you requesting?

🏖️ Annual Leave 🤒 Sick Leave 👶 Parental Leave 📋 Unpaid Leave

✦

Automation

Power Automate Integration

This is where the agent stops being a chatbot and becomes an actual business tool. The leave request flow collects data from the conversation, creates a SharePoint record, sends a manager approval, and notifies the employee — all automatically.

⚡ Build the Leave Request Flow

In Copilot Studio → your topic → Call an action → Create a flow
This opens Power Automate with a pre-wired trigger: "When Copilot Studio calls a flow"
Add input parameters: LeaveType, StartDate, EndDate, LeaveReason, EmployeeEmail

Power Automate · Leave Request Flow Steps

Trigger:  When Copilot Studio calls a flow
  Inputs: LeaveType, StartDate, EndDate, LeaveReason, EmployeeEmail

Step 1:  Get user profile (Office 365 Users)
  # Lookup employee's manager using EmployeeEmail
  Action: Get manager (V2)
  User: EmployeeEmail

Step 2:  Create SharePoint list item
  Site: https://company.sharepoint.com/sites/HR
  List: "Leave Requests"
  Fields:
    Employee:    EmployeeEmail
    LeaveType:   LeaveType
    StartDate:   StartDate
    EndDate:     EndDate
    Reason:      LeaveReason
    Status:      "Pending"
    SubmittedOn: utcNow()

Step 3:  Start approval (Approvals connector)
  Title:    "Leave Request: {EmployeeEmail} — {LeaveType}"
  Assigned: Manager email from Step 1
  Details:  "{LeaveType} from {StartDate} to {EndDate}. Reason: {LeaveReason}"

Step 4:  Condition — Approved or Rejected?
  If Approved:
    → Update SharePoint item Status = "Approved"
    → Send Teams message to employee: "✅ Your leave was approved!"
  If Rejected:
    → Update SharePoint item Status = "Rejected"
    → Send Teams message to employee: "Your leave request was not approved. Please contact HR."

Return to Copilot Studio:
  Output: Status  # "Submitted" — agent confirms to user

💡

SharePoint Leave Requests list setup: Create a list at your HR SharePoint site with columns: Employee (Person), LeaveType (Choice), StartDate (Date), EndDate (Date), Reason (Text), Status (Choice: Pending/Approved/Rejected), SubmittedOn (Date). The flow writes to this list automatically.

✦

Security

Authentication with Entra ID

Without authentication, any user could interact with the agent — and leave requests wouldn't know who's submitting them. We use Entra ID (Azure AD) so the agent knows exactly who it's talking to, automatically.

🔐 Create App Registration

Entra ID · App Registration Setup

# Entra ID (portal.azure.com) → App registrations → New registration

Name:           "HR-Copilot-Agent"
Account type:   Accounts in this org directory only
Redirect URI:   Web → https://token.botframework.com/.auth/web/redirect

# After creation — note these values (needed in Copilot Studio):
Application (client) ID:  xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Directory (tenant) ID:    xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

# Certificates & secrets → New client secret
Description:  "Copilot Studio Auth"
Expires:      24 months  ← calendar a renewal reminder now
Value:        copy immediately — only shown once

# API permissions → Add permission → Microsoft Graph → Delegated:
✓ User.Read           ← employee profile
✓ People.Read         ← manager lookup
✓ offline_access      ← token refresh
# Grant admin consent for all permissions

⚙️ Configure Auth in Copilot Studio

Copilot Studio · Authentication Settings

# Settings → Security → Authentication

Authentication type:  Azure Active Directory v2
Client ID:            paste Application (client) ID from App Registration
Client secret:        paste the secret value
Tenant ID:            paste Directory (tenant) ID
Scopes:               User.Read People.Read offline_access

Require authentication: Yes
# This means the agent always knows who the employee is
# You can use System.User.DisplayName in messages:
# "Hello {System.User.DisplayName}, how can I help you today?"

⚠️

Secret expiry: Client secrets expire. Set a calendar reminder for 2 months before expiry to rotate the secret. An expired secret silently breaks authentication — employees see "sign-in failed" with no clear error.

✦

Deployment

Deploy to Microsoft Teams

Deploying to Teams is where your agent becomes a first-class citizen in the employee's daily workflow — available in the Teams sidebar like any other app, with zero friction to start a conversation.

📦 Publish & Deploy to Teams

In Copilot Studio → Publish button (top right) → Publish to save the latest version
Go to Channels tab → Microsoft Teams → Turn on Teams
Click Open in Teams to test as yourself first before org-wide deployment
For org-wide rollout: download the Teams app manifest → submit to Teams Admin Center

Teams Admin Center · App Approval

# Teams Admin Center (admin.teams.microsoft.com)
# Teams apps → Manage apps → Upload new app

# Upload the manifest .zip from Copilot Studio
# Set these policies before approving:

App status:     Allowed
Permissions:    Review and accept on behalf of org

# App setup policy → Add to pinned apps for HR-related groups
# This pins the agent in the Teams left sidebar for all employees
# Consider a phased rollout: pilot group first → full org

# Recommended Teams app description:
"Your HR Assistant — ask policy questions, request leave,
and get onboarding help. Available 24/7."

✅

Phased rollout tip: Use Teams app setup policies to deploy to a pilot group (e.g., one department) for 2 weeks before org-wide rollout. Monitor the Analytics dashboard in Copilot Studio for unrecognized intents and missed topics — this tells you what to add before scaling.

✦

Testing

Test Scenarios & Sample Prompts

Before go-live, run through these test scenarios in Copilot Studio's test pane. Each one validates a different capability of the agent.

🧪 Test Scenario 1 — Policy Q&A (SharePoint)

Test · SharePoint Knowledge Retrieval

👤

Can I work from home every day?

🤖

According to our Remote Work Policy, employees may work from home up to 3 days per week, subject to manager approval. Fully remote arrangements require VP-level sign-off and are reviewed annually. Would you like me to send you a link to the full policy document?

🧪 Test Scenario 2 — Leave Request (Power Automate)

Test · Leave Request Flow + Approval Trigger

👤

I need to take annual leave next week

🤖

I can help you submit a leave request. What type of leave are you requesting?

🏖️ Annual Leave 🤒 Sick Leave 👶 Parental Leave

👤

Annual leave

🤖

What is your leave start date?

👤

May 20

🤖

And your end date?

👤

May 23

🤖

You're requesting Annual Leave from May 20 to May 23 (4 days). Shall I submit this for manager approval?

✅ Yes, Submit ❌ Cancel

🧪 Test Scenario 3 — Escalation (Out of Scope)

Test · Graceful Escalation Handling

👤

I have a complaint about my manager

🤖

I understand. This type of concern is best handled directly by our HR team to ensure confidentiality and proper process. I've noted your request and will send your details to hr-support@company.com. A member of the HR team will reach out within 1 business day. Is there anything else I can help you with?

💬 Additional Sample Prompts to Test

Test Pane · Prompts to Validate

# Onboarding
"What do I need to do on my first day?"
"How do I set up my laptop?"
"Where do I find the IT setup guide?"

# Policy Q&A
"What is the dress code policy?"
"How many sick days do I get?"
"What happens to unused leave at year end?"

# Leave
"I need maternity leave"
"Can I check the status of my leave request?"
"I need to cancel my leave"

# Edge cases (make sure these escalate gracefully)
"What is my salary?"           ← should NOT answer
"Who got a bonus this year?"    ← should NOT answer
"I want to report harassment"   ← must escalate to HR team

You've Built a Production-Ready HR Agent

What you've deployed isn't a demo. It's a fully authenticated, SharePoint-grounded, Teams-integrated agent that handles real HR workflows — with a Power Automate backbone and proper escalation handling for sensitive topics.

The same architecture scales to IT helpdesk (60% L1 auto-resolution), finance procurement Q&A, and compliance policy assistants. The pattern is identical — swap the knowledge source, redesign the topics, rewire the flows.

In 2026, the question isn't whether your organization should deploy Copilot Studio agents. It's how many are already running without governance. Build them right the first time.