Prerequisites

Requirements for deploying the Generative AI Config Auditor (GAC) solution.

PowerShell Requirements

Requirement	Version	Purpose
PowerShell	7.0+	Core runtime
Microsoft.PowerApps.Administration.PowerShell	2.0.180+	Power Platform environment enumeration
Az.Accounts	2.0+	Dataverse token acquisition (interactive mode)
MSAL.PS	4.37+	Evidence export authentication (Install-Module MSAL.PS)

Python Requirements

Requirement	Version	Purpose
Python	3.9+	Deployment scripts runtime
msal	1.24+	Entra ID authentication
requests	2.31+	Dataverse Web API HTTP client

Install Python dependencies:

pip install -r scripts/requirements.txt

Installation

# Install Power Platform Admin module
Install-Module -Name Microsoft.PowerApps.Administration.PowerShell -Force -Scope CurrentUser

# Install Az.Accounts for Dataverse authentication
Install-Module -Name Az.Accounts -Force -Scope CurrentUser

# Install MSAL.PS for evidence export
Install-Module -Name MSAL.PS -Force -Scope CurrentUser

Microsoft Entra ID App Registration

A Microsoft Entra ID app registration is required for both interactive and non-interactive authentication.

Registration Steps

1. Navigate to Azure Portal > Entra ID > App registrations
2. Click New registration
3. Name: GAC-GenAIConfigAuditor (or your organization's naming convention)
4. Supported account types: Single tenant
5. Redirect URI: http://localhost (for interactive auth)
6. Click Register

API Permissions

API	Permission	Type	Purpose
Dynamics CRM	user_impersonation	Delegated	Dataverse read/write for schema and data
Microsoft Graph	Environment.Read.All	Application	Power Platform environment enumeration

Note: After adding permissions, an admin must grant consent for the tenant.

Certificate Authentication (Recommended for Automation)

For non-interactive Azure Automation execution:

1. Generate a self-signed certificate or use a CA-issued certificate
2. Upload the .cer file to the app registration (Certificates & secrets > Certificates)
3. Upload the .pfx file to the Azure Automation account (Certificates blade)
4. Record the certificate thumbprint for configuration

Permissions

Power Platform

The executing user or service principal must have one of:

• Power Platform Admin role
• Dynamics 365 Service Admin role
• Global Admin role

These roles are required to enumerate environments and query bot records across the tenant.

Dataverse (Per-Environment)

To query bot and botcomponent records, the executing identity needs read access to the bot, botcomponent, and botcomponentextendedmetadata tables in each target environment's Dataverse instance.

Role	Environment	Purpose
System Administrator or System Customizer	Target environments	Read bot and botcomponent records
Dataverse User	Governance environment	Write validation results, baselines, violations

Service Principal (Automated Scans)

For non-interactive automation:

1. Register an app in Entra ID (see above)
2. Create a client secret or certificate
3. Add the app as an application user in each Dataverse environment
4. Grant appropriate security roles

Azure Automation Account

For scheduled daily scans via Power Automate:

1. Create an Azure Automation account (or reuse an existing governance account)
2. Import the Start-GenAIConfigValidationRunbook.ps1 as a PowerShell 7.2 runbook
3. Upload the authentication certificate to the Certificates blade
4. Install required modules: MSAL.PS, Microsoft.PowerApps.Administration.PowerShell
5. Configure runbook parameters (tenant ID, client ID, certificate thumbprint, Dataverse URL)

Network Requirements

Endpoint	Protocol	Purpose
api.powerplatform.com	HTTPS	Power Platform API
api.bap.microsoft.com	HTTPS	Power Platform Admin API
*.crm.dynamics.com	HTTPS	Dataverse (bot table queries, schema deployment)
login.microsoftonline.com	HTTPS	OAuth token acquisition
*.openai.azure.com	HTTPS	AOAI endpoint validation (connectivity check only)

Environment Lifecycle Management (ELM) Integration

For zone classification via ELM, the ELM solution must be deployed with:

• fsi_environment table containing zone classifications
• Environment records linked to Power Platform environment GUIDs

Without ELM, zone classification falls back to naming convention matching (e.g., -Z3- in environment name maps to Zone 3).

External Dependency: Shared Zone Classification Module

The private helper scripts/private/Get-ZoneClassification.ps1 delegates to a shared module located at scripts/shared/Get-ZoneClassification.ps1 (outside this solution directory, in the parent repository). This shared module provides the core zone classification logic used across multiple governance solutions.

Impact: If the shared module is absent on the deployment target, zone classification will fail at runtime for all environments. Agents will not be assigned to zones, and all violations will be classified as "Warning" severity instead of their correct Critical/High/Medium severity.

Resolution options:

1. Deploy the shared module alongside this solution at the expected relative path (../../../scripts/shared/Get-ZoneClassification.ps1 from scripts/private/)
2. Replace scripts/private/Get-ZoneClassification.ps1 with a self-contained implementation that does not delegate to the shared module

Dataverse Schema

For Dataverse persistence features (validation history, violation tracking, approved connections):

Table	Purpose
fsi_GACBaseline	Per-agent generative AI configuration snapshots
fsi_GACValidationHistory	Immutable scan summary records
fsi_GACViolation	Per-agent violations with severity
fsi_GACApprovedConnection	Approved Azure OpenAI connections
fsi_GACFeatureInventory	Per-agent feature tracking

Deployment Scripts

Deploy the Dataverse schema using the Python scripts in scripts/:

# Install Python dependencies
pip install -r scripts/requirements.txt

# Deploy all components (schema, connection refs, env vars) -- dry-run first
python scripts/deploy.py \
    --environment-url https://org.crm.dynamics.com \
    --tenant-id <your-tenant-id> \
    --interactive \
    --dry-run

# Deploy for real
python scripts/deploy.py \
    --environment-url https://org.crm.dynamics.com \
    --tenant-id <your-tenant-id> \
    --interactive

# Or deploy individual components
python scripts/create_dataverse_schema.py --interactive
python scripts/create_connection_references.py --interactive
python scripts/create_environment_variables.py --interactive

Python Requirements: Python 3.9+, packages listed in scripts/requirements.txt.