Credential Oversharing Detector¶
Version: v2.1.2 | Status: live | Domain: Agent Configuration | Tier: 2 | Zones: personal, team, enterprise | Data classification: confidential
Scans Copilot Studio agent credentials against zone policy to detect overprivileged connectors, excessive OAuth scopes, unauthorized service accounts, cross-environment sharing, and stale credentials.
Mapped Controls¶
Prerequisites¶
| Role | Requirement |
|---|---|
power-platform-admin |
Power Platform admin tenant role and Dataverse environment with the fsi publisher prefix. |
Verification¶
Validate host compatibility and connector telemetry against a known agent before interpreting findings; run Invoke-CredentialScan.ps1 with -DataverseUrl and confirm expected scan and seeded violation rows in fsi_credentialscans and fsi_credentialviolations. Zero connectors is incomplete coverage, not a passing credential review.
Documentation¶
| Document |
|---|
| Dataverse Schema |
| Flow Configuration |
| Prerequisites |
| Technical Verification 2026 10 16 |
| Troubleshooting |
View source on GitHub { .md-button }