Dataverse Schema Reference

Overview

The Agent Access Governance Monitor uses three Dataverse tables to store access baselines, validation history, and violation records. Tables share option sets with the Agent Configuration Validator (ACV) solution for consistent zone and severity classification.

Tables

fsi_accessbaselines

Stores captured access configuration snapshots for each Power Platform environment. Only one active baseline exists per environment at a time.

Column	Type	Description
fsi_environmentguid	String	Power Platform environment unique identifier
fsi_environmentname	String	Display name of the environment
fsi_zone	OptionSet (fsi_acv_zone)	Governance zone (100000001, 100000002, or 100000003)
fsi_botlimitsharingmode	String	Agent sharing limit setting at capture time
fsi_botauthoringsharingdisabled	Boolean	Whether agent authoring sharing is disabled
fsi_botmaxlimitusersharing	String	Raw Managed Environment bot-maxLimitUserSharing value at capture time (viewer cap per agent when sharing is limited to individuals; AAM categorizes -1 as Uncapped; blank when the environment is not a Managed Environment)
fsi_capturedby	String	UPN or service principal that captured the baseline
fsi_capturedat	DateTime	Timestamp of baseline capture (UTC)
fsi_isactive	Boolean	Whether this is the current active baseline
fsi_rawjson	Memo	Full JSON payload of access settings at capture time

The viewer cap is per agent, not per maker. Capped/Uncapped are AAM comparison categories; Microsoft does not document the 0 or -1 semantics for the bot-prefixed cap in its agent-sharing examples. Retain raw values as evidence rather than interpreting a category as the measured audience size. See the technical verification record.

fsi_accessvalidationhistory

Append-only validation audit log (by role design, not a native Dataverse feature). Each record represents one complete validation scan across all environments. The append-only behavior is achieved post-deployment by granting the AAM application user Create + Read only and denying Write/Delete on this table — Dataverse has no native column- or row-level immutability. See role-design-append-only.md.

Column	Type	Description
fsi_name	String	Run display name (auto-generated)
fsi_runid	String	Unique GUID identifying the validation run
fsi_zone	OptionSet	Governance zone at time of validation (optional; null for aggregate cross-zone runs; per-zone detail available in fsi_summaryjson)
fsi_severity	OptionSet	Overall validation result severity (maps OverallStatus via fsi_acv_severity: Passed→100000000, Warning→100000001, Failed→100000003, Error→100000004)
fsi_validationtime	DateTime	Timestamp of validation execution (UTC)
fsi_totalenvironments	Integer	Number of environments scanned
fsi_compliantcount	Integer	Environments meeting zone requirements
fsi_violationcount	Integer	Environments with access violations
fsi_overallstatus	String	Aggregate status (Passed, Warning, Failed, Review)
fsi_summaryjson	Memo	Per-zone breakdown as JSON (Total, Compliant, Violations per zone)

fsi_accessviolations

Individual access policy violations detected during validation. Linked to validation runs via fsi_runid.

Column	Type	Description
fsi_name	String	Violation display name (auto-generated)
fsi_environmentguid	String	Environment where violation was detected
fsi_environmentname	String	Display name of the environment
fsi_zone	OptionSet (fsi_acv_zone)	Governance zone of the environment
fsi_violationtype	String	Setting that violated policy (e.g., bot-limitSharingMode)
fsi_expectedvalue	String	Required value per zone policy
fsi_actualvalue	String	Current environment setting value
fsi_severity	OptionSet (fsi_acv_severity)	Severity classification (option set integer; see fsi_severitylabel for text)
fsi_severitylabel	String	Original severity string for Critical/High distinction
fsi_regulatorycontext	String	Applicable regulations (e.g., FINRA 4511, SOX 404)
fsi_detectedat	DateTime	Timestamp of violation detection (UTC)
fsi_runid	String	Links to fsi_accessvalidationhistory run
fsi_acknowledged	Boolean	Whether an administrator has acknowledged this violation
fsi_acknowledgedby	String	Identity that acknowledged the violation
fsi_acknowledgedon	DateTime	When the violation was acknowledged (UTC)
fsi_resolvedat	DateTime	When the violation was resolved (UTC)
fsi_notes	Memo	Administrator notes on this violation

Option Sets (Shared with ACV)

fsi_acv_zone

Value	Label
100000000	Unclassified
100000001	Zone 1
100000002	Zone 2
100000003	Zone 3

fsi_acv_severity

Value	Label
100000000	Passed
100000001	Warning
100000002	GracePeriod
100000003	Failed
100000004	Error

Note: The fsi_acv_severity picklist maps Critical and High violations to 100000003 (Failed). To distinguish them, the fsi_severitylabel text column stores the original severity string (Critical, High, Warning, Info).

Environment Variables

Schema Name	Type	Default	Purpose
fsi_AAM_GracePeriodHours	Decimal	48	Hours to exclude newly provisioned environments
fsi_AAM_ScanFrequencyHours	Decimal	24	Interval in hours between automated access compliance scans
fsi_AAM_IncludeSandbox	String	false	Include sandbox environments in validation
fsi_AAM_BaselineMaxAgeDays	Decimal	30	Alert threshold in days for stale access baselines
fsi_AAM_TeamsGroupId	String	(empty)	Microsoft Teams group GUID for alert notifications
fsi_AAM_TeamsChannelId	String	(empty)	Microsoft Teams channel GUID for alert notifications
fsi_AAM_DataverseUrl	String	(empty)	Dataverse instance URL for API calls (e.g., https://org.crm.dynamics.com). Currently initialized as a flow variable (see docs/flow-configuration.md, Step 2 — DataverseUrl); migrating to an environment variable requires flow restructuring and deployment coordination.

Connection References

Schema Name	Connector	Purpose
fsi_cr_dataverse_accessmonitor	Dataverse	Read/write validation history, violations, baselines
fsi_cr_office365_accessmonitor	Office 365 Outlook	Email alerts for compliance violations
fsi_cr_teams_accessmonitor	Microsoft Teams	Adaptive card alerts for drift detection

Note: The default Power Automate flow reads Dataverse and routes alerts. Only the optional Azure Automation hosting path uses the Azure Automation connector (azureautomation) to execute the validation runbook. That connection is configured manually, not by create_connection_references.py. Dataverse is a Premium connector in either hosting model; see prerequisites.

Entity Relationship Diagram

┌─────────────────────────────────┐
│   fsi_accessvalidationhistory   │
│─────────────────────────────────│
│ fsi_runid (PK, unique)         │──┐
│ fsi_validationtime              │  │
│ fsi_totalenvironments           │  │
│ fsi_compliantcount              │  │  matched by
│ fsi_violationcount              │  │  fsi_runid
│ fsi_overallstatus               │  │
│ fsi_summaryjson                 │  │
└─────────────────────────────────┘  │
                                     │
┌─────────────────────────────────┐  │
│     fsi_accessviolations        │  │
│─────────────────────────────────│  │
│ fsi_runid ──────────────────────│──┘
│ fsi_environmentguid ────────────│──┐
│ fsi_environmentname             │  │
│ fsi_zone                        │  │  same environment
│ fsi_violationtype               │  │
│ fsi_severity                    │  │
│ fsi_detectedat                  │  │
└─────────────────────────────────┘  │
                                     │
┌─────────────────────────────────┐  │
│      fsi_accessbaselines        │  │
│─────────────────────────────────│  │
│ fsi_environmentguid ────────────│──┘
│ fsi_environmentname             │
│ fsi_zone                        │
│ fsi_botlimitsharingmode         │
│ fsi_isactive                    │
│ fsi_capturedat                  │
└─────────────────────────────────┘

Violations link to validation runs via fsi_runid. Violations and baselines share fsi_environmentguid to correlate access settings with detected issues.