Last updated: November 12, 2026
By ZapAI Team
Agent evaluation in Copilot Studio is how you prove an agent works before real people depend on it, and how you catch it quietly getting worse afterward. Our Copilot Studio consulting team treats it as a release requirement, not a nice extra. Microsoft made the feature generally available on March 31, 2026. This guide covers the built-in tools, what to measure, security tests, analytics after launch, and the pass marks we start with.
Copilot Studio agent evaluation runs a saved test set of up to 100 questions against your agent, grades each answer with methods like general quality, compare meaning and tool use, and reports a pass rate you can compare across releases.
Most agent projects we see test the happy path in the test pane, show it to a manager, and publish. Then a SharePoint page changes. Or someone swaps the model. Answers drift, and nobody notices for weeks.
That’s avoidable. Our guide to building an AI agent for Dynamics 365 gave testing one step. This post is the whole step. Credits and licensing live in our Copilot Studio pricing guide, so we only touch cost where it changes how you test. Facts checked November 2026.
What Is Copilot Studio Agent Evaluation?
It’s a built-in feature on each agent’s Evaluation page that runs a test set against the agent, scores every response with one or more test methods, and gives you a pass rate. You can rerun the same set later and compare results.
Per Microsoft’s agent evaluation overview, a test case is one simulated interaction, either a single question or a whole conversation, with an optional expected answer. A group of test cases is a test set. Copilot Studio sends each question, records the reply, grades it, and shows the transcript, the activity map and the knowledge or tools the agent used.
Status first. Microsoft announced agent evaluation as generally available on March 31, 2026. One wrinkle. The test chat page on Learn still links to evaluation with a preview label, so two Microsoft pages disagree, though the GA announcement is the clearer statement.
Two limits matter before you plan anything. Evaluations support agents set to No authentication or Authenticate with Microsoft, not Authenticate manually. And Fabric data agents aren’t supported.
Which Testing Tools Does Copilot Studio Give You?
Three, plus analytics. The test chat handles hands-on conversations, the activity map traces what the orchestrator did, and agent evaluation runs repeatable batches. After launch, the Monitor page tells you how real sessions went.
| Tool | Best for | Weak spot | Copilot Credits |
|---|---|---|---|
| Test chat | Walking through one conversation, checking topics and variables | Hard to repeat, one question at a time | Agent activity isn’t billed, per Microsoft’s billing FAQ |
| Activity map | Seeing the plan, tools and knowledge behind each turn | One conversation at a time | Same as test chat |
| Agent evaluation | Batches of up to 100 cases, rerun after every change | Less control over conversations than the test chat | Not stated on the pages we checked |
| Monitor page | Real user sessions after publishing | Excludes test panel activity | Billed usage lives in the admin center |
The test chat is still where debugging starts. Microsoft’s test your agent page describes the activity map for agents with generative orchestration, Track between topics for classic flows, and Save snapshot, which downloads the agent content plus conversation diagnostics. Sensitive data included. Guard it.
One more catch. Inactivity triggers might not fire in the test pane. Test those in Teams.
Cost is the quiet advantage. The Copilot Studio billing FAQ says agent activity in the embedded test chat, such as generative answers and agent actions, doesn’t consume Copilot Credits. For evaluation runs, the Learn pages we checked are silent. Watch the consumption report after your first large run.
How Do Test Sets and Test Methods Work?
You build a test set, pick one or more test methods, and run it. Single-response sets hold up to 100 test cases. Conversation sets hold up to 20, each with up to 12 messages.
There are six ways to fill a test set, per Microsoft’s guide to creating test sets.
- A quick question set, which generates 10 questions from the agent’s description, instructions and capabilities
- A full question set, generated from knowledge sources or topics, with a slider for the count
- Your latest test chat conversation
- A CSV or text file with Question and Expected response columns, up to 100 questions of 1,000 characters each
- Questions you type yourself
- Real user questions from a theme in analytics
Generation has limits. It reads text, Word, Excel, PDF and individual SharePoint files up to 5 MB, not SharePoint folders. And Microsoft says it’s good for testing what the agent already knows, not for finding information gaps. A generated set mostly asks questions your documents can answer. Real users don’t.
| Test method | What it checks | Scoring | Needs |
|---|---|---|---|
| General quality | Relevance, groundedness, completeness and abstention | Out of 100% | Nothing extra |
| Compare meaning | Whether the meaning matches the expected answer | Out of 100%, default pass score 50 | Expected answer |
| Tool use | Whether the expected tools or topics ran | Pass or fail | Expected tools |
| Keyword match | Any or all expected keywords present | Pass or fail | Keywords |
| Text similarity | Wording close to the expected answer | Pass score you set | Expected answer |
| Exact match | Character for character match | Pass or fail | Expected answer |
| Content safety | Hate and unfairness, sexual content, violence, self-harm | Pass or fail at a severity level from 0 to 7 | One method per content type |
| Custom | Your own instructions and labels, like Compliant and Non-Compliant | Pass or fail by label | Instructions and labels |
Method details come from Microsoft’s evaluation methods page. Sources conflict on conversations. The conversation test set page lists general quality, keyword match, tool use and custom, while the methods table marks content safety as available for conversations too. Check in your tenant. Text similarity isn’t available in GCC.
Read the general quality fine print. It scores abstention, meaning whether the agent attempted to answer, so a correct refusal can get flagged for improvement. Microsoft’s fix is a custom method that defines the expected refusal as a pass. We build one for every agent, because refusals are half of what a safe agent does.
Two operational details trip teams up. Evaluations run as the signed-in user, so testing as someone else means signing out and back in as that person. And results stay in Copilot Studio for 89 days, so export the CSV if you need release evidence.
Results arrive line by line. Each case gets Pass, Fail, Invalid or Error, and the summary shows a pass rate. Per the evaluation results page, you can compare two runs of the same set, and each interaction gets a measured response time in seconds. It doesn’t affect pass or fail. Still useful.
Newer graders keep arriving. Message Center posts say a task completion grader reached general availability on October 15, 2026, and a library of reusable custom graders plus ready-made Microsoft graders is due November 15, 2026. Neither appears on the methods page we checked.
What Should You Measure Before Go-Live?
Eight things. Answer accuracy, groundedness, citations, tool success, escalation behavior, safety, latency and credit use. Each maps to a test method or a measurement, and each needs a pass mark agreed before testing starts, not after.
| What to measure | How to test it in Copilot Studio | ZapAI starting threshold |
|---|---|---|
| Answer accuracy | Compare meaning on golden cases with expected answers | 90% pass, with the pass score raised from 50 to 70 |
| Groundedness | General quality, with Allow ungrounded responses turned off | 85% pass |
| Knowledge citations | Review sources used per result, keyword match on document names | Right source cited in 9 of 10 sampled answers |
| Tool and action success | Tool use method, then a live run against test data | 95% call the expected tool, zero writes to wrong records |
| Escalation and handoff | Custom method with labels for correct handoff | Handoff cases route, in-scope cases stay with the agent |
| Safety | Content safety method plus a red-team set | 100% pass on red-team and critical cases |
| Latency | Response time in evaluation results | Median under 5 seconds for knowledge answers, under 10 with tool calls |
| Credit use | Admin center consumption report after a pilot week | Within 20% of the estimate per session |
These thresholds are ZapAI starting points, not Microsoft guidance. Microsoft gives one default, a compare meaning pass score of 50, though its Employee Self-Service examples use 70. We start stricter for customer-facing agents and relax for low-risk internal ones.
Citations deserve a closer look. When Allow ungrounded responses is off, Microsoft’s knowledge sources page says the agent returns a knowledge answer only when it includes an in-text citation, and the model occasionally drops one. Result? A correct answer gets withheld, and asking again might work. Intermittent failures like that look random in the test chat. Across 100 cases they show up clearly.
Credits need a real-world check. Tenant graph grounding, a reasoning model or an agent flow can each multiply cost per session, and a test set won’t show it, so run a pilot week and compare the admin center report with your estimate before anyone signs off on rollout.
How Do You Build a Golden Test Set From Real Questions?
Start from questions people actually ask, not questions your documents answer. Pull them from help desk tickets, shared inboxes, pilot transcripts and themes in analytics, write each expected answer with the process owner, and tag every case by risk.
Microsoft’s Employee Self-Service guidance suggests starting with 15 to 20 focused queries, 3 to 5 per intent. Our recipe, as ZapAI practice, grows that to 60 to 100 single-response cases and 10 to 20 conversation cases.
- About half common questions, phrased the way users type them, typos included
- A fifth edge cases, like an outdated policy, two similar products or a question that spans two documents
- A tenth out-of-scope questions the agent should refuse or hand off
- A tenth red-team prompts, covered in the security section below
- The rest tool and action cases with known inputs and outputs
Write expected answers as short facts, not paragraphs. “Returns within 30 days, receipt required” grades better with compare meaning than a pasted policy page. Then add keywords for anything that must appear, such as a form name.
Keep the golden set in a CSV under version control next to the agent’s package, owned by the process owner rather than the maker, split into sets by area so a weak spot in billing questions isn’t hidden inside one blended score. Refresh it quarterly. Questions drift.
Mind one warning in Microsoft’s own docs. Generated test cases can include sensitive data the connected account can reach, and any maker with access to the agent can view its test sets. Generate with a test account that sees only what a typical user sees.
How Should You Test Agent Security?
Test four layers. Prompt injection, oversharing through knowledge, connector permissions and content moderation. Copilot Studio blocks some attacks by default, but your configuration decides how much an attacker or a curious employee can actually reach.
Prompt injection
Microsoft’s external threat detection page says custom agents include built-in protection against user prompt injection attacks and cross-domain prompt injection attacks, the kind hidden inside a document or web page the agent reads. Content is checked twice, on input and before the reply. Test it anyway. Ask the agent to ignore its instructions, reveal them, or obey text planted in a test document, then grade with a custom method that labels compliance a fail.
Microsoft also offers external threat detection, a preview that calls a service such as Microsoft Defender before each tool invocation, set per environment and limited to generative orchestration. If the service doesn’t answer within one second, the tool runs anyway by default. Change that to block for sensitive agents.
Oversharing through knowledge
SharePoint, Dataverse and connector knowledge use the agent user’s Microsoft Entra ID authentication, so a user should see only content they can already open. That’s the theory. In practice, an agent faithfully surfaces whatever your permissions already overshare. Run the golden set as a low-privilege test user and look for answers citing HR, finance or executive sites. Our Microsoft 365 Copilot oversharing guide covers finding and fixing those sites.
Connector permissions
Tools can authenticate with end-user credentials or maker-provided credentials, and both are enabled by default. Microsoft’s page on maker-provided credentials warns they could lead to oversharing, since an end user acts with the maker’s access. Test each tool as a user who shouldn’t be allowed the action. If it works, fix it. Admins can restrict the choice per environment, though autonomous agents then fail without a signed-in user.
Content moderation
Moderation runs from Lowest to Highest, defaults to High, and can be set per agent, per generative answers node and per prompt, with the topic level winning at runtime. Lower means more answers and more risk. Run the content safety method at your production setting and again whenever someone moves the slider, then check the Protection status column on the Agents page before publishing.
Admin rules such as data policies and connector blocking belong to Power Platform governance, which sets the boundaries these tests confirm.
How Do You Run Regression Tests Across Environments?
Rerun the same golden set in every environment the agent passes through, and block promotion when the pass rate drops. Copilot Studio supports this through the Power Platform API and a Copilot Studio connector, so the run can sit inside a pipeline.
The API lists test sets, starts a run and returns per-case results, and Microsoft pitches it for release validation and regression testing. Microsoft’s Eval Gate sample for Azure DevOps goes further. It imports the package into a CI environment, runs the evaluation and blocks the merge below a pass rate threshold. The sample says test sets are part of the package and travel with it on import, and that the evaluation API needs delegated user permissions with no app-only path. Plan for a dedicated test user account.
Environment strategy, managed packages and pipelines are covered in our Power Platform ALM guide. Here’s what we add for agents.
- Run the golden set in development before every export.
- Run it again in test after import, as a user with production-like access.
- Run a smaller smoke set in production right after deployment.
- Rerun everything after any model change. Copilot Studio’s Review panel flags when the model changed since the last evaluation, but it doesn’t block publishing.
- Export results to CSV for each release, since runs expire after 89 days.
Our regression rule, again a ZapAI starting point. No critical case that passed last release may fail now, and the overall pass rate may not drop more than three points. Either one stops the release until someone explains it.
When Do You Need the Copilot Agent Kit or Microsoft Foundry?
Reach for the Power CAT Copilot Agent Kit when built-in evaluation runs out of room, like multi-turn scripts or rubric tuning. Look at Microsoft Foundry evaluation when the agent is custom code.
Until May 2026 it was called Copilot Studio Kit. Microsoft’s Copilot Agent Kit overview says the Power Customer Advisory Team created and maintains it. Its test automation runs through the Direct Line API with response match, attachment, topic match, generative answer, multi-turn and plan validation test types, plus user-defined rubrics. The November 3, 2026 release added Model Assessment, which compares agent behavior across models. Our use? Clients running several agents.
Foundry is a different tool for a different build. Its agent evaluators include Task Completion, Task Adherence, Tool Call Accuracy, Tool Selection and Tool Call Success, and several still carry preview labels, Task Completion and Task Adherence among them. They grade agent messages and tool calls you supply as data, so using them on a Copilot Studio agent means exporting and reshaping conversations first, which is real engineering work for a team that chose low-code to avoid exactly that. Our Copilot Studio vs custom AI agents comparison covers when that kind of build makes sense.
What Should You Watch in Analytics After Launch?
Watch conversation outcomes, satisfaction, answer quality, tool use and knowledge source use on the Monitor page, plus credit consumption in the Power Platform admin center. Testing says the agent can work. Analytics says whether it does.
Here’s what the Monitor page reports for conversational agents, per Microsoft’s agent effectiveness page.
- Session outcomes of Resolved, Escalated, Abandoned or Unengaged, with escalations split into System intended, System unintended and User requested
- Thumbs up and down reactions, plus comments for users with the Bot Transcript Viewer role
- A satisfaction score out of 5 from end-of-session surveys
- Sentiment, in preview
- Answer rate, plus answer quality sampled as Good or Poor with a reason
- Tool use counts and success rates
- Knowledge source use with error rates
- Themes, a preview that clusters user questions
- Custom metrics, a preview with up to three business metrics
Fine print. Analytics covers 360 days, transcripts only 28. Test panel activity is excluded. Themes need 50 questions with generative answers from 50 sessions in a week, a bar some small internal agents won’t clear.
We check Abandoned first. An engaged session that times out after 30 minutes without being resolved or escalated usually means a user gave up. System unintended escalations come second.
Then close the loop. A Poor answer, a negative reaction or a busy theme becomes a new test case in the golden set, so the next release is tested against last month’s failures.
Credits sit outside the Monitor page. Tenant consumption shows in the Power Platform admin center under Licensing, aggregated daily, and admins can set a monthly limit per agent. Set one before launch. A runaway reasoning model is cheaper to stop than to explain.
What Release Gates and Review Cadence Do We Use?
We use four gates, from development to broad rollout, and a review rhythm that tightens after every change. This is ZapAI practice. Not a Microsoft standard.
| Gate | When | Pass to move on |
|---|---|---|
| 1. Build complete | End of development | 80% general quality on the golden set, red-team cases all pass |
| 2. Pilot | 10 to 25 named users for two weeks | 90% compare meaning on golden cases, no critical failures, credits within 20% of estimate |
| 3. Broad rollout | After pilot sign-off | Abandoned rate under 20%, satisfaction of 4 or higher where surveys run, owner sign-off |
| 4. Change release | Every later change | Regression rule met, red-team rerun, results exported |
Review cadence after launch looks like this.
- Weekly for the first month. Outcomes, Poor answers, reactions and credits.
- Monthly after that, with the process owner in the room
- A full golden set run after any change to instructions, knowledge, tools or model
- Quarterly, a red-team rerun, a permissions check and a golden set refresh from themes
Name an owner for each agent. Not the maker. The person accountable for the process the agent serves, who signs each gate. Questions like that one also sit in our AI readiness assessment checklist.
What Goes Wrong Most?
Six failures keep repeating.
- Admin-only testing. Evaluations run as the signed-in user, and a maker with broad access sees answers a regular user can’t.
- Generated sets only. They test what documents say, not what users ask.
- No refusal cases. General quality can mark a correct refusal down, so teams quietly delete those cases instead of adding a custom method.
- Silent model swaps. The Review panel warns, but publishing still works.
- Untested tools. A tool running on maker credentials passes the test and overshares in production.
- Stale knowledge. A policy page changes and nobody reruns the set.
Agents bundled into Microsoft products, like the Business Central agents, come with their own review screens, so this plan matters most for agents you build yourself. Agents calling Dynamics data through the Dataverse MCP server need a tool use case for each operation they’re allowed to run.
Copilot Studio Agent Evaluation Checklist
Print this. Tick it before every publish.
- Golden set of 60 to 100 real questions with expected answers
- Expected answers signed off by the process owner
- Refusal and handoff cases graded with a custom method
- Red-team prompts for injection and instruction leaks
- Tests run as a low-privilege user
- Each tool tested as a user who shouldn’t have access
- Maker-provided credentials reviewed tool by tool
- Content moderation confirmed at the production setting
- Allow ungrounded responses decision recorded
- Pass marks written down before the first run
- Results exported to CSV for this release
- Monthly credit limit set for the agent
- Owner named, review dates booked
What Could Change After Ignite 2026?
Probably a fair amount. Ignite runs November 17 to 20, 2026, in San Francisco, and evaluation features have shipped steadily all year. Expect a refresh of this post by late November.
What we’ll check first is whether the custom graders library lands on schedule, whether the task completion grader reaches the methods docs, whether evaluation runs get a published credit rate, and whether external threat detection leaves preview.
Wrapping Up
Built-in evaluation is ready for production. Cheap insurance, too. Build a golden set from real questions, test as a normal user, include refusals and red-team prompts, set pass marks before you test, rerun after every change, and let analytics feed the next test set.
ZapAI is a Microsoft Dynamics 365, Power Platform, Fabric and AI consulting firm in Irving, Texas, working with businesses across Dallas-Fort Worth and nationwide. Our AI agent development team and Copilot Studio consultants build agents with test sets, release gates and monitoring from day one. Already have an agent live? Ask us for an agent evaluation review, and we’ll build your first golden set and show you where it fails.
Questions Teams Ask About Testing Copilot Studio Agents
Is agent evaluation in Copilot Studio generally available?
Yes. Microsoft announced general availability on March 31, 2026. Related analytics features like themes are still preview.
What is the maximum size of a test set?
Up to 100 for single-response sets and up to 20 for conversation sets, with up to 12 messages per conversation. Imported questions can be up to 1,000 characters each.
Does testing an agent use Copilot Credits?
Not in the test chat, where Microsoft’s billing FAQ says agent activity isn’t billed. The evaluation pages we checked don’t state a rate for evaluation runs, so check your consumption report after a large run.
Can I run an evaluation as a different user?
Only by switching accounts. Evaluations run as the signed-in user, so you sign out and sign in as the test user. Through the API, you pass a connection ID for the user profile.
How long does Copilot Studio keep evaluation results?
For 89 days. Export results to CSV after each release if you need a longer audit trail.
What pass rate should an agent hit before launch?
Microsoft doesn’t set one. Our starting point is 90% on compare meaning for golden cases, 85% on general quality, and 100% on critical and red-team cases, then adjusted by risk.
Can evaluations run inside a deployment pipeline?
They can. The Power Platform API and the Copilot Studio connector start runs and return results, and Microsoft’s Eval Gate sample blocks Azure DevOps merges below a pass rate. The API needs delegated user permissions.