Deny Event Correlation Report¶
Version: v2.0.2 | Status: live | Domain: Monitoring & Analytics | Tier: 2
Daily reporting for correlating deny/no-content events across Copilot and Copilot Studio using Purview, Application Insights, and optional Defender data.
Mapped Controls¶
Prerequisites¶
| Role | Requirement |
|---|---|
compliance-admin |
Purview Compliance Admin/View-Only Audit Logs for audit log extraction and CSV exports. |
log-analytics-reader |
Monitoring Reader on Application Insights for RAI telemetry correlation. |
m365-admin |
Azure subscription access for Storage, Automation, and scheduled runbook deployment. |
Dependencies¶
Verification¶
Confirm the daily runbook produces CSV exports and current-day audit/RAI correlations without errors.
Documentation¶
| Document |
|---|
| Architecture |
| Prerequisites |
| Troubleshooting |
View source on GitHub { .md-button }