SoftTech AI Registry
Microsoft · Microsoft Copilot Studio

AI Approvals

A Microsoft-documented preview feature of Microsoft Copilot Studio agent flows in which an AI stage inside a multistage approval evaluates an approval request against maker-written natural-language instructions and supplied inputs (text, documents, images, knowledge and outputs of earlier flow stages) and returns an Approve or Reject decision with a rationale in JSON. The decision governs the approval: by default an approval decision continues the approval to the next stage, a rejection ends the approval as rejected, and a failure to decide ("Analysis failed") continues to the next stage. The decision and rationale are visible in the Approvals center History tab and logged in the Power Automate prompt builder Activity section. Any business-system write, message or transaction that follows is performed by other agent-flow actions and connectors, not by the AI approval stage, and is not attributed here.

Recorded characteristics

Function
Microsoft documents AI stages within multistage approvals in Copilot Studio agent flows: "AI stages in your multistage approval enable you to implement automated decision-making at key points in your approval workflow. In these stages, you provide the AI model with specific instructions and relevant inputs such as documents, images, text, and organizational knowledge, and the AI produces a clear Approve or Reject decision with clear rationale based on your instructions." The FAQ states AI approvals "evaluate approval requests against your business rules and return an 'Approved' or 'Rejected' decision with a rationale". The documented stage sequence is: an approval request enters the multistage approval -> the maker-configured AI stage receives the request together with referenced inputs -> the model applies the maker's written instructions and criteria -> the stage emits a decision and rationale as JSON output -> the surrounding approval and agent flow branch on that decision. Default routing documented by Microsoft: an AI approval continues the approval to the next stage; an AI rejection ends the approval as rejected; a stage that fails to produce a decision continues to the next stage. Makers can place human approver stages before or after AI stages, and Microsoft states "You can configure approval decisions from AI stages for review and approval by human approvers in subsequent stages." Criteria are natural-language instructions interpreted by the model, written in an Instructions pane ("write the instructions and criteria that you want the AI stage to use to make a decision"), with Microsoft's own example expressed as conditional rules such as rejecting an expense report when the Total field exceeds a stated amount. They are not deterministic rules evaluated by a rules engine.
Data access
Microsoft documents that the AI stage evaluates what the maker passes into it: "If you want the AI stage to use inputs such as documents, images, text, and knowledge to make an approval decision, type / where you want that input". The FAQ states AI approvals "can interpret unstructured data and complex documents (like PDFs or images attached to a request) and apply nuanced logic to make a decision". A documented limitation qualifies this: "Only base64-encoded file contents in file inputs for AI stages are supported... File attachments aren't currently supported." Outputs of earlier flow actions can be referenced, including responses collected by the separate Request for information action, which Microsoft demonstrates being used as parameters in a subsequent AI approval action. Microsoft does not document the AI approval stage independently searching tenant data, mailboxes, SharePoint or other Microsoft 365 content; the registry therefore records data access as limited to the request fields, instructions, knowledge and inputs passed into the stage. Microsoft states images are processed with automatic face blurring before analysis and that "no facial recognition or facial template matching is involved".
Actions
Can take actions
External actions
Unknown
Human confirmation
Conditional
Permission basis
Not established
Administrative control
Microsoft documents maker-side controls rather than a dedicated tenant admin switch for AI approvals: the maker writes the stage instructions and criteria, orders AI and human stages within the multistage approval, selects the model from a model picker (with Microsoft advising to "favor the more powerful models for approval decisions"), and can require human approver stages to review AI decisions. Microsoft advises that for highly sensitive approvals makers "ensure that human approval stages are reached in the flow". Capacity governance is documented: Copilot Credits must be assigned to the environment, and "If you don't have sufficient Copilot Credits, your approval stalls and doesn't proceed." Content safety is applied by the platform: "AI approvals use Azure AI Content Safety service". Auditability is documented through the Approvals center History tab, which shows the decision and rationale of preceding AI stages, and through the Power Automate prompt builder Activity section, where Microsoft states all decisions are logged. Microsoft's AI approvals pages do not document DLP policy behaviour, connector restriction behaviour, or an admin-level enable/disable control specific to AI approvals; generic Power Platform controls are not recorded here as capability-specific claims. Microsoft documents that application lifecycle management and sharing are not currently supported for advanced approvals.
Default state
Disabled
Availability
Microsoft documents AI approvals as preview/prerelease functionality delivered through the Human in the loop connector in Copilot Studio agent flows, whose actions are labelled "Run a multistage approval (preview)" and "Request for information (preview)". The connector reference states availability as "Copilot Studio | Standard | All Power Automate regions". No language availability statement for AI approvals is documented.
Licensing
Microsoft documents that Copilot Studio Copilot Credits must be assigned to the environment before an AI stage is added to a multistage approval, and that insufficient credits stall the approval. General Copilot Studio billing documents agent flow actions at 13 Copilot Credits per 100 actions (with a no-charge path for Microsoft 365 Copilot licensed users through a specific trigger) and premium generative AI tools at 10 Copilot Credits per 1,000 tokens. Microsoft does not publish a separate AI-approval-specific credit rate; the documentation points to the general billing rates.
External model or provider
Microsoft states AI approvals "use AI (Azure OpenAI models or models that you can bring from Azure AI Foundry)" and specifically that "AI approvals support GPT 4.1 mini, GPT 4.o, GPT 4.1, and o3 models, which are hosted on Azure OpenAI Service", with bring-your-own fine-tuned models from Azure AI Foundry supported for specific or custom needs. The maker selects the model from a model picker in the AI stage. Microsoft states customer data isn't used to train or improve Azure OpenAI Service foundation models.
Limitations and uncertainty
The highest authority Microsoft establishes for AI Approvals itself is producing a decision and rationale that becomes the approval stage outcome, visible in the Approvals center History tab and logged in the prompt builder Activity section; downstream connector writes, emails, records or transactions configured by the agent-flow author are performed by other actions and are deliberately not attributed to this capability. Action capability is recorded as can_take_actions because the AI stage's Approve/Reject result is not merely generated text: it sets the approval outcome (a rejection ends the approval as rejected) and is retained in approval history and activity logs. External action capability is unknown: Microsoft publishes no affirmative statement that the AI stage cannot affect external systems, and the registry does not inherit the containing flow's connector authority. Human confirmation is conditional: an AI-only stage can return Approved or Rejected without human confirmation, while makers can configure human approver stages before or after AI stages and Microsoft recommends doing so for sensitive approvals; responsible-AI wording alone is not treated as an enforced safeguard. Permission basis is not_established because no fetched Microsoft page states the runtime identity under which an agent flow or AI stage executes; the identity of downstream connectors is not used to infer it. Default state is disabled because the AI stage does not exist until a maker adds it to a multistage approval, configures instructions, inputs and model, and the environment holds Copilot Credits. No numeric confidence score, confidence threshold or automatic escalation mechanism is documented; the only documented no-decision outcome is a response labelled "Analysis failed", which by default continues to the next stage. Microsoft documents that the system was not designed for high-stakes or life-altering decisions affecting health, safety, finances or legal status (naming insurance claims, medical authorizations, loan approvals and immigration determinations), that final legal or disciplinary decisions should remain with humans, that it was not evaluated for compliance in regulated industries, and that performance reviews, hiring decisions and customer eligibility assessments were not part of its design or impact assessment. This capability does not include the separate Request for information action, which pauses a flow to collect human input and can supply parameters to a later AI approval; that relationship is recorded but the two are not merged. DLP behaviour, language availability, a dedicated AI-approval credit rate and runtime identity are not documented.

Evidence