Skip to content

Pre-Session Homework: Power Platform Admin

This page lists the 44 control(s) you are responsible for as Power Platform Admin. Please review each control and bring the requested evidence to your assessment session.

For the full assessment experience, see the Readiness Assessment.

Control 1.1 — Restrict Agent Publishing by Authorization

Security · Zone 1, Zone 2, Zone 3

Pass criteria: Environment Maker role removed from All Users; named publisher security group exists; share-with-everyone disabled and agent publish gated by approval workflow across Zone 2/3 environments.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.11 — Conditional Access and Phishing-Resistant MFA

Security · Zone 1, Zone 2, Zone 3

Pass criteria: CA policies require phishing-resistant MFA (FIDO2/passkey/WHfB/CBA) for agent makers, owners, and admins; break-glass excluded; CA for Workload Identities applied to agent service principals.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.14 — Data Minimization and Agent Scope Control

Security · Zone 1, Zone 2, Zone 3

Pass criteria: Each agent has a documented grounding inventory with zone-based justification, narrowed SharePoint scopes, public web grounding disabled for Zone 3 NPI agents, and active scope-drift monitoring.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.15 — Encryption: Data in Transit and at Rest

Security · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.18 — Application-Level Authorization and Role-Based Access Control (RBAC)

Security · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.2 — Agent Registry and Integrated Apps Management

Security · Zone 1, Zone 2, Zone 3

Pass criteria: All agents and integrated apps registered with named owner and backup owner, admin consent workflow enabled, and no orphaned service principals across Entra, Integrated Apps, and Copilot Studio.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.20 — Network Isolation and Private Connectivity

Security · Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.23 — Step-Up Authentication for AI Agent Operations

Security · Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.25 — MIME Type Restrictions for File Uploads

Security · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.26 — Agent File Upload and File Analysis Restrictions

Security · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.27 — AI Agent Content Moderation Enforcement

Security · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.28 — Policy-Based Agent Publishing Restrictions

Security · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.29 — Global Secure Access: Network Controls for Copilot Studio Agents

Security · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.4 — Advanced Connector Policies (ACP)

Security · Zone 1, Zone 2, Zone 3

Pass criteria: ACP and classic DLP enforce a connector allowlist at environment-group scope; consumer connectors blocked and action-level restrictions limit high-risk connectors to read-only in Zone 2/3.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.5 — Data Loss Prevention (DLP) and Sensitivity Labels

Security · Zone 1, Zone 2, Zone 3

Pass criteria: Purview DLP covers SharePoint, OneDrive, Exchange, Teams, Endpoint, and Copilot/Copilot Chat, plus Power Platform data policies for Copilot Studio agents, all using FSI-tuned SITs.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.7 — Comprehensive Audit Logging and Compliance

Security · Zone 1, Zone 2, Zone 3

Pass criteria: Unified Audit Log on; Audit Premium with the 10-year retention add-on enabled and a custom audit retention policy targets Copilot/agent events for the applicable 6-year FINRA/SEC window.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.8 — Runtime Protection and External Threat Detection

Security · Zone 2, Zone 3

Pass criteria: Prompt Shields and content moderation enabled per Copilot Studio agent, Defender for Cloud Apps AI Agent Protection toggled on, and external threat-detection webhook configured for Zone 3 agents.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.9 — Data Retention and Deletion Policies

Security · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.10 — Patch Management and System Updates

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.15 — Environment Routing and Auto-Provisioning

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.17 — Multi-Agent Orchestration Limits

Management · Zone 2, Zone 3

Pass criteria: Multi-agent designs document delegation depth limits, circuit breakers, HITL triggers, and the 128-tool ceiling; A2A/MCP cross-protocol chains tracked in the agent inventory.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.2 — Environment Groups and Tier Classification

Management · Zone 1, Zone 2, Zone 3

Pass criteria: Environment groups aligned to Zone 1/2/3 with rules published per zone (sharing, channels, AI model restrictions, CUA disabled), and routing places makers into the correctly governed environment.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.22 — Inactivity Timeout Enforcement

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Management · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.24 — Agent Feature Enablement and Restriction Governance

Management · Zone 1, Zone 2, Zone 3

Pass criteria: Per-zone feature catalog approved by change management; tenant, environment, and agent-level toggles enforce it; preview/MCP/code-interpreter features explicitly approved per zone.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.25 — Microsoft Agent 365 — Admin Center Governance Console

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.3 — Change Management and Release Planning

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.4 — Business Continuity and Disaster Recovery

Management · Zone 2, Zone 3

Pass criteria: Critical agents tier-classified with documented RTO/RPO, secondary-region environments provisioned, automated solution backup running, and annual DR test executed with results retained.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.5 — Testing, Validation, and Quality Assurance

Management · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.6 — Model Risk Management (OCC 2011-12/SR 11-7)

Management · Zone 1, Zone 2, Zone 3

Pass criteria: AI agents classified within the firm's MRM framework with model inventory, independent validation, ongoing performance monitoring, bias testing, and change-control evidence retained per 17a-4(f).

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.8 — Access Control and Segregation of Duties

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.9 — Agent Performance Monitoring and Optimization

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.1 — Agent Inventory and Metadata Management

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.10 — Hallucination Feedback Loop

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.11 — Centralized Agent Inventory Enforcement

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.12 — Agent Governance Exception and Override Management

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.2 — Usage Analytics and Activity Monitoring

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.3 — Compliance and Regulatory Reporting

Reporting · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.4 — Incident Reporting and Root Cause Analysis

Reporting · Zone 2, Zone 3

Pass criteria: Written IR program covers AI agent incidents with runbooks for the parallel clocks (NYDFS 72h, SEC 8-K 4-day, banking 36h, Reg S-P 30-day) and RCA evidence retained per 17a-4.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.5 — Cost Allocation and Budget Tracking

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.6 — Orphaned Agent Detection and Remediation

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.7 — PPAC Security Posture Assessment

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.8 — Copilot Hub and Governance Dashboard

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.9 — Microsoft Sentinel Integration

Reporting · Zone 2, Zone 3

Pass criteria: Sentinel ingests Power Platform Admin Activity, CopilotInteraction, Entra and service-principal sign-ins, and Defender connectors with FSI analytics rules, workbooks, and Logic Apps playbooks.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Generated from assessment/manifest/controls.json by scripts/generate_homework_pages.py. Edit the manifest, then re-run.