MT.1114: AI agents should require user authentication.
| ID | MT.1114 |
| Severity | High |
| Suite | Mito |
| Product | Copilot Studio |
| Feature | Agents |
| Security area | AI and agents |
| Resource type | Agent |
| User impact of fixing | Medium |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:IA-2 Identification and Authentication (Organizational Users) |
| MITRE ATT&CK | T1213 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”AI agents should require user authentication with sign-in enforced.
This test flags two issues:
- No authentication: Agents configured without any authentication allow anonymous access.
- Sign-in not required: Agents with authentication configured but “Require users to sign in” toggled off. This means users can interact with the agent without authenticating, undermining the auth configuration.
How to fix
Section titled “How to fix”- In Copilot Studio, open the agent settings and configure authentication to use Authenticate with Microsoft or Authenticate manually.
- Enable Require users to sign in to ensure every user authenticates before interacting with the agent.
Learn more: Configure user authentication in Copilot Studio
Mito check. Author: lnfernux. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.