Microsoft shipped Copilot Studio connectors that reach on-premises SQL Server through existing gateway patterns, so agents can query private data without opening a public database endpoint.
Microsoft’s Copilot Studio update today is the kind of sentence that makes security teams unclench their jaws: agents can talk to on-premises SQL Server without you hanging a public database endpoint on the internet. The connectors ride the familiar on-premises data gateway pattern. Private stays private. The agent still has to ask politely through whatever tables you expose.
What changed for builders
Until now, a lot of Copilot Studio demos quietly assumed cloud data or a brave VPN story. The new connectors make the boring enterprise path official. You install and size the gateway, map allowed objects, and let Studio call those objects as tools. That is not magic. It is the same discipline Power Platform teams already know, pointed at agents that can loop if you let them.
Microsoft’s docs stress least privilege. Do not hand an agent the entire sales schema because a pilot wanted “flexibility.” Create a narrow view or stored procedure that answers the questions the agent is allowed to ask. Log the calls. Put a spend and rate cap on the agent before lunch, not after the first runaway weekend.
Operational gotchas
Gateway capacity is the silent killer. One chatty agent refreshing a dashboard query can starve the human reports that still matter on Monday. Treat the gateway like a production dependency: monitor queue length, plan a second node if you care about uptime, and document who owns restarts.
Also decide what “answer grounded in SQL” means for your compliance team. A correct row is still a disclosure. If the agent can summarize salary bands, the connector is not the bug—the permission map is. Copilot Studio gave you a pipe into the warehouse. You still choose which crates sit near the door.
Who should turn it on this week
Teams with clean gateway hygiene and a short list of approved procedures should pilot immediately on a non-critical agent. Teams that still share sa passwords in chat should fix that first. Tuesday’s feature removes an excuse. It does not remove judgment.