Skip to content

Portal Walkthrough: Control 2.8 — Access Control and Segregation of Duties

Last Updated: April 2026 Portals: Microsoft Entra Admin Center, Microsoft 365 Admin Center, Power Platform Admin Center (PPAC), Copilot Studio, Power Automate Estimated Time: 3–4 hours for the initial Zone 3 build; ~30 min/quarter for ongoing review tasks Audience: M365 administrators in US financial services responsible for AI agent governance

This playbook configures the portal-side scaffolding for Control 2.8. The companion PowerShell Setup automates group creation, SoD detection, and evidence export. Portal screenshots should be captured per docs/images/2.8/EXPECTED.md and stored under maintainers-local/tenant-evidence/ (never committed).

Prerequisites

  • Entra Global Admin (initial setup only) and Entra Privileged Role Admin (ongoing PIM configuration)
  • Entra Identity Governance Admin (for Access Reviews and PIM for Groups)
  • Power Platform Admin (for Dataverse security roles and environment access)
  • Microsoft Entra ID P2 licensing for every user who will be PIM-eligible or a reviewer of record
  • Role definitions, exception register, and reviewer-of-record list documented and signed off by AI Governance Lead and Compliance Officer
  • Naming standard published for SG-Agent-* groups (kept in sync with the PowerShell baseline)

Canonical role names — use the short names defined in docs/reference/role-catalog.md. Do not substitute display names like "Global Administrator" inside the framework.

Step 1 — Create role-assignable security groups (Entra Admin Center)

  1. Open the Microsoft Entra Admin Center.
  2. Browse to Identity → Groups → All groups → New group.
  3. Create the five governance groups below. For any group that will hold or be granted a directory role, set Microsoft Entra roles can be assigned to the group to Yes at creation (this cannot be changed later).
Group name Description Type Membership Role-assignable Owner
SG-Agent-Developers Authoring identities (makers) for Copilot Studio agents Security Assigned No AI Governance Lead
SG-Agent-Reviewers Independent reviewers of agent submissions Security Assigned No AI Governance Lead
SG-Agent-Approvers Approvers for production publish/share Security Assigned Yes (PIM-managed) Compliance Officer
SG-Agent-ReleaseManagers Identities authorised to deploy to Zone 3 production environments Security Assigned Yes (PIM-managed) Compliance Officer
SG-Agent-PlatformAdmins Holders of Power Platform Admin / Environment Admin (PIM-eligible only) Security Assigned Yes Entra Privileged Role Admin

The Approvers, Release Managers, and Platform Admins groups should be role-assignable so that PIM for Groups can manage them and so that they cannot be modified by Group Administrators outside the privileged-access path.

Step 2 — Configure Dataverse / Power Platform security roles (PPAC)

  1. Open the Power Platform Admin Center.
  2. Environments → select the target Zone 2 or Zone 3 environment → Settings → Users + permissions → Security roles.
  3. Either clone an existing role (recommended starting points: Environment Maker, Basic User, System Customizer) or create custom roles. Apply least-privilege table and column privileges.
Dataverse role Privileges Mapped Entra group Notes
Agent Author (custom, cloned from Environment Maker) Read/Write on agent assets owned by user; Read on shared environment metadata SG-Agent-Developers Do not grant Append-To across all tables; scope to agent-related tables only
Agent Reviewer (custom) Read on all agent assets; Append (annotate) SG-Agent-Reviewers Read-all is required for independent review
Agent Approver (custom) Read on all agent assets; Approve workflow steps SG-Agent-Approvers No Write/Deploy privileges — approval is a workflow signal
Release Manager (custom) Publish/Deploy on agent assets; Read on solutions SG-Agent-ReleaseManagers Reserve for production-aligned environments
Dataverse System Administrator All (no standing assignment) Break-glass only — assign via PIM for Groups, time-boxed
  1. Assign each role to its Entra group via Users + permissions → Teams → New team → Microsoft Entra ID security group team (Group team) and attach the security role to the team. This keeps Dataverse role membership in sync with Entra group membership.

April 2026 path note — PPAC moved the security-role list under Settings → Users + permissions → Security roles in the post-March 2026 navigation refresh. The legacy Settings → Security roles path still resolves but is deprecated.

Step 3 — Separate Copilot Studio authoring from administration

  1. Open Copilot Studio.
  2. Confirm that members of SG-Agent-Developers hold Copilot Studio author (Environment Maker + the relevant Dataverse role) only — they should not appear in SG-Agent-PlatformAdmins.
  3. In PPAC, verify that no identity is simultaneously a member of SG-Agent-Developers and holds Power Platform Admin or Environment Admin in a Zone 3 environment. The PowerShell SoD check enforces this; the portal step is a visual cross-check during the change window.
  4. If your tenant has the March 2026 enhanced admin controls enabled, set Approved authentication providers at the environment-group level so that makers cannot introduce identity paths that reviewers cannot independently validate.

Step 4 — Configure PIM for Roles (Entra Admin Center)

  1. Identity governance → Privileged Identity Management → Microsoft Entra roles → Roles.
  2. For each of the following roles, open Settings and apply the Zone 3 configuration:
Role Max activation MFA Justification Approval Approvers
Power Platform Admin 4 hours Required Required (ticket #) Yes SG-Agent-Approvers (excluding the activator)
AI Administrator 4 hours Required Required Yes SG-Agent-Approvers
Entra Global Admin 1 hour Required Required Yes Compliance Officer + Entra Privileged Role Admin
Privileged Role Administrator 1 hour Required Required Yes Compliance Officer
  1. Assignments → Add assignments → assign Eligible (not Active) members from SG-Agent-PlatformAdmins.
  2. Confirm the Audit history tab is populating (this feed is consumed by Control 3.x reporting).

Step 5 — Configure PIM for Groups (Entra Admin Center)

  1. Identity governance → Privileged Identity Management → Groups → Discover groups → onboard SG-Agent-Approvers, SG-Agent-ReleaseManagers, and SG-Agent-PlatformAdmins.
  2. For each onboarded group, open Settings → Member and set:
  3. Activation max: 4 hours (Approvers, Release Managers); 1 hour (Platform Admins)
  4. MFA on activation: Required
  5. Justification: Required
  6. Approval to activate: Required (Zone 3); approver = a different group than the requester's home team
  7. Move standing members to Eligible assignments. The only Active members should be break-glass identities documented in your incident-response runbook.

PIM for Groups is the recommended Zone 3 control because it brings just-in-time enforcement to Dataverse-bound identities (group-team assignments) that PIM for Roles alone cannot reach.

Step 6 — Configure Access Reviews (Entra Identity Governance)

  1. Identity governance → Access reviews → New access review.
  2. Configure a per-zone review schedule:
Review name Scope Frequency Duration Reviewers Auto-apply If reviewer doesn't respond
Agent Governance — Zone 3 Privileged Roles PIM-eligible assignments for Power Platform Admin, AI Administrator, Dataverse System Administrator Monthly 7 days Group owners + AI Governance Lead (multi-stage) Yes Remove access
Agent Governance — Zone 3 Approver/Release groups SG-Agent-Approvers, SG-Agent-ReleaseManagers Quarterly 14 days Compliance Officer + Group owner Yes Remove access
Agent Governance — Zone 2 maker groups SG-Agent-Developers, SG-Agent-Reviewers Quarterly 14 days Group owner Yes Take recommendations
Agent Governance — Zone 1 broad makers All Power Platform makers (Environment Maker) Annually 21 days Manager (M365 manager attribute) Yes Take recommendations
  1. Enable Justification required and Show recommendations (recommendations are based on sign-in activity).
  2. Save and confirm the first instance is scheduled.

Step 7 — Build the SoD-enforcing approval workflow (Power Automate)

  1. Open Power Automate in the shared production-aligned environment (not the maker's personal environment).
  2. Create a flow Agent Production Publish — SoD Approval with trigger When a Copilot Studio agent is submitted for publish (or an HTTP request from your release pipeline).
  3. Add the following branching:
  4. Initialize variable RequestorUPN = trigger output.
  5. Get group members (V3) for SG-Agent-Approvers, store UPNs.
  6. Condition: if RequestorUPN is in the Approvers list OR if RequestorUPN is in SG-Agent-Developers for the agent's solution → Terminate with status Failed and reason SoD: requestor cannot approve own work.
  7. Otherwise → Start and wait for an approval (Approval type: First to respond, Assigned to: SG-Agent-Approvers minus RequestorUPN).
  8. On Approve → call the deployment endpoint (only SG-Agent-ReleaseManagers should hold the deployment service-principal credentials).
  9. Always → write an audit row to a Dataverse table agent_sod_decisions (Requestor, Approver, Decision, Timestamp, Justification, AgentSolutionId).
  10. Set the flow owner to a service account (not the maker) and grant SG-Agent-PlatformAdmins co-owner via PIM for Groups.

Step 8 — Conditional Access and CAE for the privileged path

  1. Entra Admin Center → Protection → Conditional Access → Policies → New policy.
  2. Create policy CA-Agent-Privileged-Path:
  3. Users: SG-Agent-Approvers, SG-Agent-ReleaseManagers, SG-Agent-PlatformAdmins
  4. Target resources: Microsoft Admin Portals, Power Platform admin app (a8f7a65c-f5ba-4859-b2d6-df772c264e9d), Microsoft Graph PowerShell, Copilot Studio
  5. Conditions: Sign-in risk = Medium and above; client apps = browser + modern auth
  6. Grant: Require phishing-resistant MFA, require compliant device
  7. Session: Sign-in frequency 4 hours; persistent browser = Never
  8. Protection → Continuous access evaluation: confirm Migrate is set to Enabled for the tenant. CAE will revoke tokens on disabled-user, password-change, and high-risk events for the policies above.

Configuration by Governance Level

Setting Baseline (Zone 1) Recommended (Zone 2) Regulated (Zone 3)
Role separation Self-service Creator ≠ Approver Creator ≠ Reviewer ≠ Approver ≠ Release Manager
PIM for Roles Optional Recommended for Power Platform Admin Required for all admin roles
PIM for Groups Not required Recommended for Approvers Required for Approvers, Release Managers, Platform Admins
Access Reviews Annual Quarterly Monthly (privileged) + Quarterly (operational)
Approval workflow Optional Required for shared agents Required with mechanical SoD reject
Conditional Access Baseline tenant policy Risk-based MFA Phishing-resistant MFA + compliant device + CAE
Break-glass procedure Not required Documented Documented, tested annually, monitored alert

Validation (Portal-Side)

After completing the walkthrough, verify in the portal:

  • All 5 SG-Agent-* groups exist with named owners and the privileged three are role-assignable.
  • Each Dataverse environment in Zone 2/3 shows the four custom security roles bound to the group teams.
  • PIM for Roles shows zero Active assignments for Power Platform Admin, AI Administrator, and Entra Global Admin.
  • PIM for Groups shows the three privileged groups onboarded and configured.
  • Access Reviews shows the four review series scheduled with the correct cadence and auto-apply enabled.
  • Power Automate shows the Agent Production Publish — SoD Approval flow as On and owned by the service account.
  • Conditional Access policy CA-Agent-Privileged-Path is On for the three privileged groups.

Now run the PowerShell Setup to lock the same state in code and emit evidence; then run Verification & Testing.

Back to Control 2.8 | PowerShell Setup | Verification & Testing | Troubleshooting