What's Changing
Microsoft has officially announced updates to the Copilot Agent framework and the Flow Bot (Power Automate's Teams-integrated bot) that directly affect how Microsoft Intune administrators can automate device management workflows and surface AI-driven operational insights. As of late 2024 and rolling into Q1–Q2 2025, the Flow Bot is being enhanced with Copilot Agent capabilities, meaning Power Automate flows triggered by Intune events can now interact with users and administrators through a conversational AI interface inside Microsoft Teams — without requiring custom app development.
The specific change: Microsoft is integrating Copilot Studio-built agents directly into the Power Automate Flow Bot channel. Previously, the Flow Bot could send adaptive cards and approval requests. Now, those interactions can be handled by a Copilot Agent that understands context, can query Microsoft Graph on behalf of the flow, and respond to natural language follow-up questions. This is documented under the Microsoft 365 Copilot Admin Overview and the broader Copilot Studio release notes.
For Intune specifically, Microsoft has confirmed that Intune-native Graph API triggers — including device compliance state changes, enrollment events, and policy assignment failures — can now feed directly into these Copilot Agent flows, enabling real-time, AI-augmented helpdesk responses at scale.
Who's Affected & When
This rollout affects tenants with the following license combinations:
- Microsoft 365 E3/E5 with Power Automate per-user or per-flow plans
- Microsoft Intune Plan 1 or Plan 2 (standalone or as part of Microsoft 365 E3/E5/F3)
- Microsoft Copilot Studio (formerly Power Virtual Agents) — required for custom agent authoring
- Tenants with Microsoft 365 Copilot add-on licenses will get the deepest feature access, including agent-to-agent orchestration
The Flow Bot Copilot Agent integration began general availability rollout in November 2024 for commercial cloud tenants. GCC and GCC High tenants should expect the rollout in Q3 2025 at the earliest, based on Microsoft's current gov cloud parity timelines. The feature is opt-in via Copilot Studio — it does not auto-enable in your tenant. No existing flows break. However, if your organization has disabled the Flow Bot in Teams admin center, that restriction will also block the Copilot Agent surface for these workflows.
Check your Teams admin center under Teams apps > Manage apps and confirm the Power Automate (Flow) app is set to Allowed. If you've applied app permission policies that block it, agents built on this channel will silently fail.
What This Means for Your Environment
From a pure Intune operations standpoint, this is the most significant workflow automation upgrade since the Graph API became stable enough to build production helpdesk tooling on. Here's the practical impact:
Compliance Alerting Gets Smarter
Previously, a device going non-compliant would trigger a Graph-based flow that sent an email or Teams message. With Copilot Agent integration, that same trigger can now initiate a conversational agent interaction with the end user — asking them to confirm their OS version, guiding them through a remediation step, and only escalating to a human if the agent can't resolve it. The agent retains context across the conversation, which the old Flow Bot adaptive card model could not do natively.
Admin-Facing Operational Queries
Intune admins can now query device state conversationally through a Teams-integrated agent without leaving the Teams interface. A flow triggered on a schedule can pre-fetch Graph data and make it available to the agent as grounded context. Example: an agent that answers "How many devices failed the Windows Update compliance policy in the last 24 hours?" by querying:
GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices
?$filter=complianceState eq 'noncompliant'
&$select=deviceName,complianceState,lastSyncDateTime,operatingSystem
&$top=50That response can be summarized and surfaced by the agent in natural language, with drill-down options for the admin — all within Teams chat.
What Could Break
If your tenant has Data Loss Prevention (DLP) policies applied to Power Platform, those will govern what connectors the Copilot Agent flows can use. Specifically, the Microsoft Intune connector and HTTP with Azure AD connector must be in the same DLP policy group (Business or Non-Business) for Graph-authenticated flows to function. Mismatched DLP grouping is the most common silent failure mode here.
Validate your DLP policy via the Power Platform admin center or with PowerShell:
# Requires Microsoft.PowerApps.Administration.PowerShell module
Get-DlpPolicy | Select-Object DisplayName, PolicyDefinition | Format-ListAlso review your Conditional Access policies. If you have policies scoped to Power Platform service principals that require compliant devices or MFA on every session, agent-initiated Graph calls may fail if the service account or managed identity used by the flow doesn't satisfy those CA requirements. Use a service principal with application permissions rather than delegated credentials wherever possible for unattended flows.
Reference the Power Automate DLP documentation and the Intune fundamentals overview as baseline reading before configuring these integrations in production.
Action Items
- Audit Teams app permission policies now — confirm the Power Automate / Flow app is allowed for your admin and helpdesk groups. Without this, no Copilot Agent surface will appear in Teams for those users.
- Review Power Platform DLP policies — ensure the Intune connector and HTTP with Azure AD are in the same classification tier. A mismatch will break Graph-authenticated agent flows silently.
- Evaluate Copilot Studio licensing — if you want to build custom agents (not just use the default Flow Bot), you need Copilot Studio capacity. Assess whether your Microsoft 365 Copilot licenses include this or if a standalone Copilot Studio subscription is needed.
- Pilot a compliance alert flow with Copilot Agent response in a test tenant or with a scoped pilot group before rolling to production. Focus on the non-compliant device trigger as a high-value first use case.
- Register an App Registration in Entra ID with
DeviceManagementManagedDevices.Read.AllandDeviceManagementConfiguration.Read.AllGraph permissions for use by your flows — avoid delegated auth for unattended automation. - Communicate to your helpdesk team that AI-assisted device compliance interactions may start appearing in end-user Teams chats. They need to know what the agent can and cannot do to avoid parallel manual outreach creating confusion.
- Check GCC/GCC High timelines if you're in a government cloud — this feature is not yet available and planning should account for the expected Q3 2025 window at the earliest.
