Today we´re going to extend the storyline around a risk assessment of Copilot experience in Power Platform and further discuss on observations I had outlined in my first and second article in regards to the behavior of Copilot. This time, we´ll set our focus on Power Automate cloud flows designer.
I am using the Copilot – Describe it to build a flow feature in the Power Automate Studio, which is set to a US environment. As shown in the image above, I am entering a prompt that I could have also used with Copilot for Microsoft 365. However, the result is different because this Copilot does not use Microsoft Graph to retrieve information about my last ten emails. Instead, it suggests that I create a cloud flow that can help me with this task and recommends using two common connectors: Office 365 Outlook and Content Conversion.
After the flow being created, I then challenged Copilot with a DALL-E task to see if it would generate an image for me. However, I only got a response saying that this Copilot would help with Power Automate questions in English.
If DALL-E doesn’t work, we can try other topics in this experience. How about Power Automate licensing? Copilot can help us with this topic, as you can see from the visual shared above. It can also explain the differences in licensing, which is useful for flow creators who want to learn more about the best licensing options for their flows.
Does this use the information from Power Automate Doc, or does it use Bing Search to get information from learn.microsoft.com? A CISO would also want to know what happens with the user prompt when it creates a meta-prompt (pre-processing) and how it performs some compliance and security checks after getting the response from an LLM (Large Language Model) (post-processing).
Therefore, one more try with a context outside of Power Automate and check on the response. But again, it doesn´t help with that one.
Let’s go back to the intention and see if it can help me add a SharePoint action. It does insert the action for me, but not exactly where I wanted. I asked it to be after the first action, but it put it after the trigger. We could debate whether the trigger counts as the first action or not, but anyway – it certainly does an action I give through my prompt.
How is all this done via Copilot and is there more information available on this Copilot doesn´t perform any job that my company would be concerned about? Current capabilities are listed here and I would recommend including this link in an internal risk assessment documentation. We know that capabilities could change or extend over time, and you may not want to completely re-write your documentation. And in terms of security and privacy of this experience, there´s also a great FAQ article you can link to.
More to come in my next article, stay tuned and, until then…
The Power Platform Talks 