Official documentation checked October 14, 2026.
If a security group is missing from a Copilot Studio sharing dialog, first distinguish permission to chat from permission to edit the agent. Group sharing can be limited by the agent’s environment and governance policy. A missing search result does not establish that a Microsoft service principal needs tenant-wide Microsoft Graph consent.
Key takeaways
- Security groups can receive chat/viewer access in supported sharing workflows. Editor access is for individual users.
- Managed Environment rules can intentionally prohibit security-group sharing.
- Mail-enabled status affects email invitations; it is not a universal requirement to grant chat access.
Why Copilot Studio Cannot Share an Agent With a Security Group
Microsoft’s sharing documentation separates group chat access from collaborative authoring, which is granted to individual users. If you are trying to make a group an editor or coauthor, the requested permission may not be supported. Ownership of a directory group is also different from permission to share an agent.
Microsoft documents Managed Environment sharing rules such as Only share with individuals (no security groups) and controls on granting Viewer or Editor assignments. A blocked group can therefore be the expected policy outcome. See sharing controls and limits.
The sharing guide notes that a Microsoft 365 group with SecurityEnabled set to false cannot be used for the described chat-sharing workflow. It also distinguishes email-enabled groups for invitations. Do not convert or mail-enable a production group to make a picker work without reviewing the actual requirement.
Steps to Fix the Security Group Sharing Issue in Copilot Studio
1. Record the agent, sharing goal, and error
- Identify the agent, environment, host, harness, and whether the request is for chat access or authoring.
- Record the full error and affected account. Confirm the sharing account has the appropriate agent permission; do not treat group ownership as that permission.
- Have the directory administrator confirm the intended group’s identity, tenant, group type, and effective membership. Similar display names can refer to different groups.
2. Check the supported sharing and authentication workflow
In the documented web sharing workflow, open the agent, select the top-menu three dots > Share, enter the security group’s name, and review its permissions before sharing. Select chat/viewer access for a user group, rather than editing rights. Collaborative authoring requires individual users and appropriate environment roles; do not give a whole group maker or administrator access as a shortcut.
Check authentication against the intended channel. Microsoft’s authentication guidance explicitly states that Teams + Microsoft 365 channels support only Authenticate with Microsoft; selecting another authentication option blocks those channels. It also describes agent sharing to control who can chat in the Microsoft-authenticated Teams experience. Do not switch a Teams agent to manual authentication merely to copy the sharing guide’s manual-Entra prerequisite.
The sharing guide’s manual-authentication prerequisite and the channel-specific authentication documentation are not fully harmonized. For another supported authenticated channel, review that channel’s documented manual-Entra and required-sign-in workflow separately. Preserve the working channel configuration while resolving the applicable sharing path with the administrator; do not switch to No authentication to bypass a restriction.
3. Ask the environment administrator to inspect governance
Have the administrator review the effective Managed Environment or environment-group sharing rules, including whether Viewer sharing and security groups are allowed. If a restriction is intentional, use the approved individual-sharing or deployment process. If a policy change is appropriate, have its owner review the scope and consequences; do not disable the rule solely because the sharing attempt failed.
Microsoft’s sharing page also describes environment role requirements and a narrower custom role option containing ChatBotReaders. Check the necessary privilege instead of broadly assigning Environment Maker to everyone. The page contains multiple host-specific role notes, so the administrator should resolve the applicable workflow before assigning a role.
4. Verify chat access and data boundaries
After the approved share completes, have an included account open the published agent in its intended channel and run a harmless read-only test. Check an excluded account as well. An agent need not appear in the user’s authoring list to prove a chat-only share, and access to the agent does not automatically establish access to all its connections or business data.
If Copilot Studio Still Cannot Share With the Security Group
| Symptom | Check | Avoid |
|---|---|---|
| Group cannot be selected as editor | Use an individual coauthor or approved chat-group share | Granting broad Graph permissions |
| Group chat share is blocked | Effective environment sharing rules and group type | Disabling authentication or governance |
| Share succeeds but chat fails | Channel, sign-in, effective membership, and source/tool access | Giving every member maker rights |
| Email invitation is missing | Email-enabled invitation behavior | Assuming access was never granted |
Escalate a sanitized error and the verified configuration if the documented checks do not explain the failure. Do not export authentication headers or tokens from developer tools. The reviewed sources do not support a universal GroupMember.Read.All consent repair, mailNickname search rule, ban on every dynamic group, 100,000-member sharing cutoff, or fixed propagation deadline.
Verify the current host and policy scope before applying a configuration change.