These are the prerequisites for the installation of the agent monitoring solution.

Before you begin (prerequisites)

Make sure you have all of the following before starting:

Requirement	Detail
Target environment	A Power Platform environment with Dataverse enabled.
Import permission	The System Administrator or System Customizer role in the target environment (see Required security roles and permissions).
Runtime permission	The account that owns the connections needs the right security role to reach every monitored agent (see Required security roles and permissions). A dedicated service account is strongly recommended.
Premium licensing	Capacity for the Premium HTTP with Microsoft Entra ID and Microsoft Copilot Studio connectors.
CMP (AAA) API access	Network access from the environment to https://api.inspark.nl, and an account/app that is pre-authorized to call it.
Copilot Studio access	An account that can see the Copilot Studio agents monitored in this environment.
The solution file	The managed solution .zip (for example InSparkAgentMonitoring_managed.zip).
Per-agent test set	Each agent to be evaluated must have a Copilot Studio evaluation test set named exactly AAA-AutomationCMP.

---

Required security roles and permissions

There are two distinct permission needs: one to import the solution, and one to run the flows successfully afterwards. They are often held by different accounts, so treat them separately.

To import the solution

The person performing the import needs, in the target environment, one of:

Security role	Notes
System Administrator	Recommended. Full rights to import solutions and create/bind connection references.
System Customizer	Sufficient to import this solution and customize components.

Environment Maker alone is not enough to import a solution that contains connection references and flows.

To run the flows successfully (the connection owner)

Once imported, both flows execute under the identity of the account that owns the bound connections — not under the identity of each person who happens to open them. That owner account must be able to do everything the flows do:

The flow does…	…so the connection owner needs
Call the CMP (AAA) API over HTTP with Microsoft Entra ID	Network + API authorization to https://api.inspark.nl, and at least the Basic User role to run the flow in a Dataverse environment
List test sets, start evaluations and read run details in Copilot Studio, for every monitored agent in the environment	Access to the agents' underlying Copilot (bot) records — see the important note below
Operate inside the Dataverse environment	Basic User role (minimum) in the target environment

Important — access to agents you did not author. In Copilot Studio, each agent is shared with the authoring team when it is created. The predefined Environment Maker role grants access only to the user's own agents (User-level access to the Copilot bot table). This means an owner who did not author an agent cannot evaluate it and the child flow will fail for that agent.

To evaluate all monitored agents regardless of who built them, the connection owner needs organization-level access to the Copilot (bot) table. Grant one of: - the System Customizer role (organization-level CRUD on the Copilot bot table), or - the System Administrator role, or - explicit co-ownership / sharing of each monitored agent with the owner account (only practical for a small, fixed set of agents).

Recommendation — use a dedicated service account as owner

Because the flows must be able to reach agents authored by many different makers, do not own the connections with a personal maker account (which typically only sees its own agents). Instead:

1. Create a dedicated service account (a non-interactive, licensed identity) for this solution.
2. Assign it the System Customizer role (or System Administrator) in the target environment, so it has organization-level access to all Copilot Studio agents.
3. Create and own the three connections with this service account.
4. Bind the connection references to those service-account connections during import.

This keeps the automation running independently of any individual's account and guarantees every monitored agent can be evaluated, even when the solution owner is not an editor of those agents.

Make sure the service account has the required licenses (Power Automate premium / Copilot Studio) and that its connections stay authenticated — an expired connection silently breaks the whole chain.