Agentic CLI: Build Microsoft Copilot Studio Agents at 20x Speed with Code & GitHub Copilot + Video

By /

Listen to this Post

Featured Image
Introduction: The Microsoft Copilot Studio CAT team has released a revolutionary plugin that transforms low-code agent development into a lightning-fast, code-first experience. By enabling developers to build, test, and deploy Copilot Studio agents directly from the command line using YAML files, this plugin codifies best practices and integrates seamlessly with Code and GitHub Copilot CLI—delivering a productivity boost that is “nothing short of mind-boggling.”

Learning Objectives:

  • Master CLI-based agent development using the Skills for Copilot Studio plugin with Code or GitHub Copilot
  • Implement version-controlled agent definition via YAML files and integrate CI/CD pipelines with automated evaluations
  • Apply security hardening techniques including OAuth 2.0, near-real-time runtime protection, and API security controls

1. CLI-First Agent Development: Setup & Core Workflow

The `skills-for-copilot-studio` plugin enables developers to create, test, and troubleshoot Microsoft Copilot Studio agents using YAML files directly from the terminal, providing AI-powered skills for authoring agent components, running tests, and debugging issues.

Step‑by‑step guide:

  1. Installation – Clone the repository and install dependencies: 
    git clone https://github.com/microsoft/skills-for-copilot-studio.git
cd skills-for-copilot-studio
npm install

  2. Configure the plugin for Code or GitHub Copilot CLI – Add the plugin to your AI coding assistant. For GitHub Copilot CLI, the plugin integrates with the Plugin System, which allows augmentation of the assistant with specialized capabilities through Custom Agents, MCP Servers, and Skills.

  3. Create your first agent YAML definition – The plugin uses YAML files to define agent components including topics, actions, knowledge sources, and child agents. Here’s a basic structure:

    agent:
name: "FikaAssistant"
description: "Helps arrange Swedish fika breaks"
languageModel: "gpt-4"
topics:</p></li>
</ol>

<p>- name: "ScheduleFika"
triggerPhrases:
- "I want to arrange fika"
- "Schedule a coffee break"
actions:
- type: http
url: "https://api.calendar.com/book"
method: POST
    1. Use the plugin with Code – In your terminal, invoke Code and describe the agent you want: 
      "Build a Copilot Studio agent that helps arrange Swedish fika with a barista sub-agent"

      Code orchestrates parallel sub-agents—one handling agent settings, one building topics with HTTP actions, one adding knowledge sources, and one creating child agents.

    2. Push to Copilot Studio – Once all components are ready, run the deployment command:

      npm run push -- --agent-name "FikaAssistant" --environment "production"

    2. Version Control & CI/CD Integration for Agents

    When you work with agents as code, they can be committed to git, enabling CI/CD pipelines to run automated evaluations before deployment. This approach ensures that agents are tested and validated just like any other software artifact.

    Step‑by‑step guide:

    1. Initialize a git repository for your agent definitions: 
      git init
git add agents/
git commit -m "Initial agent YAML definitions"

    2. Set up automated evaluations using Power Platform REST API – Microsoft Copilot Studio provides tools to continuously evaluate agent performance against predefined test sets. You can trigger evaluations programmatically as part of your development workflow.

    3. Obtain prerequisites – Before running automated evaluations, gather:

    – Target agent’s Bot ID and Environment ID
    – A test set created in Copilot Studio
    – A user access token issued by Microsoft Entra ID (OAuth 2.0)
    – Client ID from an app registration with appropriate scopes

    1. Run an evaluation via REST API – Use the following PowerShell script to trigger an evaluation: 
      Get access token
$token = Get-MsalToken -ClientId $clientId -TenantId $tenantId -Scopes "https://api.powerplatform.com/.default"

Start evaluation
$headers = @{
Authorization = "Bearer $($token.AccessToken)"
"Content-Type" = "application/json"
}
$body = @{
testSetId = "your-test-set-id"
botId = "your-bot-id"
environmentId = "your-environment-id"
} | ConvertTo-Json</p></li>
</ol>

<p>Invoke-RestMethod -Uri "https://api.powerplatform.com/copilotstudio/evaluations" `
-Method POST -Headers $headers -Body $body
      1. Integrate into GitHub Actions CI/CD pipeline – Create .github/workflows/agent-ci.yml: 
        name: Agent CI/CD
on: [bash]
jobs:
evaluate:
runs-on: ubuntu-latest
steps:</li>
</ol>

- uses: actions/checkout@v3
- name: Run agent evaluation
run: |
 Trigger evaluation via REST API
curl -X POST https://api.powerplatform.com/copilotstudio/evaluations \
-H "Authorization: Bearer ${{ secrets.POWER_PLATFORM_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"testSetId":"${{ secrets.TEST_SET_ID }}","botId":"${{ secrets.BOT_ID }}"}'

        3. Agent-2-Agent (A2A) Communication & External Agent Integration

        Copilot Studio agents can communicate with external agents via the Agent-2-Agent (A2A) protocol, enabling multi-agent orchestration and integration with custom Python or .NET agents built using the Microsoft 365 Agent Framework.

        Step‑by‑step guide:

        1. Install Agent 365 CLI – This command-line tool is used to deploy, administer, and govern Agent 365 agents: 
          Windows (using winget)
winget install Microsoft.Agent365CLI

Or via npm
npm install -g @microsoft/agent365-cli

          Required permissions: Global Administrator, Agent ID Administrator, or Agent ID Developer.

        2. Create a custom agent using the Microsoft 365 Agent Framework (Python):

          from agent_framework import Agent, Topic, Action</p></li>
</ol>

<p>class CustomEngineAgent(Agent):
def <strong>init</strong>(self):
super().<strong>init</strong>(name="TravelAdvisor")

@topic(trigger_phrases=["recommend a restaurant in Rome"])
async def recommend_restaurant(self, context):
 Custom logic here
return {"restaurant": "Trattoria Da Enzo", "rating": 4.8}

          3. Register the agent in Agents 365 Registry:

          agent365 register --agent-name "TravelAdvisor" --endpoint "https://myagent.azurewebsites.net"
          1. Add the external agent to Copilot Studio – In Copilot Studio, navigate to Agents → Add an agent → External agent (A2A) and provide the registered agent’s endpoint URL.

          5. Test the integration using the Agents Playground:

          npm install -g @microsoft/m365agentsplayground
agents-playground --agent-id "your-agent-id"
          1. Security Hardening: OAuth 2.0, API Authentication & Near-Real-Time Protection

          Microsoft Copilot Studio agents are “secure by default,” with built-in defenses against cross prompt injection attacks (XPIA) and user prompt injection attacks (UPIA). For enterprise-grade security, organizations can implement OAuth 2.0 authentication and near-real-time runtime protection.

          Step‑by‑step guide for OAuth 2.0 configuration:

          1. Register an application in Microsoft Entra ID – Obtain Client ID, Client Secret, Authorization URL, and Token URL.

          2. Configure the MCP server with OAuth 2.0 – When connecting Copilot Studio to an APIM-hosted MCP server, choose OAuth 2.0 as the authentication method. This corresponds to token-based inbound access using Microsoft Entra ID.

          3. In Copilot Studio, configure authentication:

          • Go to Agents → Settings → Security
          • Set Authentication to Authenticate manually
          • Provide the Client ID, Client Secret, Authorization URL, and Token URL from your Entra app registration
          1. Enable near-real-time protection – This public preview feature allows organizations to connect their own monitoring systems to evaluate and block unsafe agent actions during runtime. When a user prompt is received, Copilot Studio sends the agent’s plan to the monitoring system via API call. The system has one second to approve or block the action.

          5. Configure monitoring via Power Platform Admin Center:

           Example: Register a custom security provider
Set-AdminPowerAppApisToBypassConsent -ApiName "CopilotStudioSecurity"
          1. Audit logging – Copilot Studio generates detailed audit logs of each interaction with external security systems, which can be used to track attempted breaches and refine policies.

          2. Advanced Agent Architecture: Multi-Agent Orchestration & Knowledge Integration

          Complex agents can be built with multiple sub-agents working in parallel, each handling a specific capability such as reservations, payments, knowledge grounding, or child agent delegation.

          Step‑by‑step guide (based on the pizzeria management agent demo):

          1. Define agent identity and personality in YAML:

          agent:
name: "PizzeriaManager"
personality: "Friendly and enthusiastic, always uses emojis"
languageModel: "gpt-4"

          2. Create a reservation topic with HTTP action:

          topics:
- name: "TableReservation"
triggerPhrases:
- "I want to book a table"
- "Reserve for {partySize} people on {date}"
actions:
- type: http
url: "https://api.reservations.com/book"
method: POST
body:
partySize: "{partySize}"
date: "{date}"
authentication:
type: apiKey
key: "${RESERVATION_API_KEY}"
          1. Add knowledge sources – Ground answers using documents stored in SharePoint: 
            knowledgeSources:</li>
</ol>

- type: sharepoint
url: "https://company.sharepoint.com/sites/recipes"
documents:
- "pizza-recipes.pdf"
- "ice-cream-menu.docx"
            1. Create a child agent (travel advisor mode) – When customers ask about travel, the agent switches to a dedicated travel advisor mode with its own instructions and knowledge sources: 
              childAgents:</li>
</ol>

- name: "TravelAdvisor"
triggerPhrases:
- "travel to Italy"
- "sightseeing in Rome"
personality: "Professional, asks clarifying questions before answering"
knowledgeSources:
- type: sharepoint
url: "https://company.sharepoint.com/sites/travel-guides"
              1. Run parallel development with Code – The plugin orchestrates multiple sub-agents simultaneously, then handles the push to your environment when everything is ready.

              2. Training & Certification Path for AI Agent Development

              Microsoft offers comprehensive training resources and certifications for professionals building agents with Copilot Studio.

              Available certifications and courses:

              | Credential | Focus | Prerequisites |

              ||-||

              | Microsoft Applied Skills: Create agents in Microsoft Copilot Studio | Build custom agents, manage topics, configure generative AI, deploy to production | Experience with Copilot Studio, Microsoft Teams, Power Platform |
              | PL-7008: Create and extend custom copilots | Hands-on competency in building AI-powered conversational interfaces | Familiarity with Power Platform |
              | MS-4022: Extend Microsoft 365 Copilot | Extend Microsoft 365 Copilot capabilities | Intermediate Copilot Studio experience |
              | AI-3018: Copilot Foundations | Generative AI basics, RAG-based solutions with Azure AI Studio | None |

              Training resources:

              1. Command Reference: Essential CLI Commands for Agent Management

              | Operation | Command (Linux/macOS) | Command (Windows) |

              |–|-|-|

              | Install Agent 365 CLI | `npm install -g @microsoft/agent365-cli` | `winget install Microsoft.Agent365CLI` |
              | Register an agent | `agent365 register –agent-name “MyAgent” –endpoint “https://…”` | Same |
              | Deploy agent YAML | `npm run push — –agent-name “MyAgent”` | Same |
              | Run evaluation | `curl -X POST https://api.powerplatform.com/copilotstudio/evaluations -H “Authorization: Bearer $TOKEN”` | `Invoke-RestMethod -Uri …` |
              | Test agent locally | `agents-playground –agent-id “agent-id”` | Same |
              | Clone skills repository | `git clone https://github.com/microsoft/skills-for-copilot-studio.git` | Same |

              What Undercode Say:

              • The CLI‑first approach fundamentally changes low‑code development — By treating agents as version‑controlled YAML code, organizations gain the same rigor applied to traditional software: CI/CD, automated testing, and collaborative workflows. This eliminates the “black box” problem of portal‑only development.

              • Security must be embedded, not bolted on — The near‑real‑time protection layer and OAuth 2.0 integration demonstrate that AI agent security requires runtime monitoring and defensive design. Organizations should implement least‑privilege access, audit logging, and automated security evaluations as standard practice, not optional add‑ons.

              Prediction: Within 18 months, CLI‑first agent development will become the dominant paradigm for enterprise AI agent creation, displacing purely visual low‑code interfaces. The ability to version control, test automatically, and deploy via CI/CD will transform agent development from an experimental practice into a disciplined engineering discipline, with Microsoft’s CAT team plugin serving as the blueprint for how every major AI platform will approach agent lifecycle management.

              ▶️ Related Video (78% Match):

              🎯Let’s Practice For Free:

              IT/Security Reporter URL:

              Reported By: Andreasadner Copilotstudio – Hackers Feeds
              Extra Hub: Undercode MoN
              Basic Verification: Pass ✅

              🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

              💬 Whatsapp | 💬 Telegram

              📢 Follow UndercodeTesting & Stay Tuned:

              𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: