Control 4.9 — Portal Walkthrough: Embedded File Content Governance

Playbook Type: Portal Walkthrough Control: 4.9 — Embedded File Content Governance Audience: M365 Administrators, SharePoint Admins, Compliance Officers Estimated Time: 30–60 minutes (initial setup); 20–30 minutes (quarterly audit cycle) Last UI Verified: April 2026

Critical IB Limitation — Read Before Proceeding

Microsoft Purview Information Barriers are NOT enforced on SharePoint Embedded containers. Any user with access to an agent can receive content from embedded knowledge files regardless of IB policy assignments. Complete the IB assessment steps in this walkthrough (Section 4) before approving any agent with embedded files for Zone 2 or Zone 3 deployment. See Control 4.9 for the full compliance risk analysis.

Overview

This walkthrough covers all portal-based administrative procedures for Control 4.9, including:

Identifying all agents that use embedded file knowledge sources
Reviewing per-agent embedded file metadata (file names, sensitivity labels, container IDs)
Performing the quarterly sensitivity label audit
Auditing SharePoint Embedded containers via SharePoint Admin Center
Conducting an IB boundary assessment before file uploads
Configuring the default sensitivity label policy for unlabeled files
Configuring SharePoint container creation alerts

Section 1: Identify All Agents Using Embedded Files

This step produces the complete list of agents that require Control 4.9 governance attention. Run this procedure at the start of every quarterly audit cycle and whenever a new agent is created.

Step 1.1 — Open the All Agents Page

Navigate to the Microsoft 365 Admin Center: https://admin.microsoft.com
In the left navigation, select Copilot (you may need to expand the navigation panel).
Select Agents.
Select All Agents from the sub-navigation.

Portal path: M365 Admin Center › Copilot › Agents › All Agents

Step 1.2 — Apply the Embedded Files Filter

On the All Agents page, locate the Filter control above the agent list.
Click Filter and select or search for the "Embedded files" filter option.
Apply the filter.

The page now displays only agents that have at least one embedded file knowledge source.

Filter Scope

This filter shows agents created via Agent Builder that have files stored in SharePoint Embedded containers. Agents built in Copilot Studio or agents that use SharePoint site knowledge (not uploaded files) will not appear under this filter. If you expect an agent to appear and it does not, see the Troubleshooting playbook Section 1.

Step 1.3 — Export the Agent List for Audit Records

Use the Export option on the All Agents page (if available in your tenant) to export the filtered list to CSV.
If export is not available, manually record: Agent Name, Agent Owner, Creation Date, Last Modified Date, for each agent in the filtered view.
Save the exported file as: embedded-file-agents-audit-YYYY-QN.csv (e.g., embedded-file-agents-audit-2026-Q1.csv).
Store in your designated audit evidence repository.

Section 2: Review Per-Agent Embedded File Metadata

For each agent identified in Section 1, review the detailed embedded file information. This step validates that files are labeled and provides the container ID for cross-referencing with SharePoint Admin Center.

Step 2.1 — Open the Agent Detail View

From the filtered All Agents list, click the agent name to open the agent detail panel or page.

Step 2.2 — Review the Data & Tools Tab

Select the Data & tools tab in the agent detail view.
Review the following fields for each embedded file:

Field	What to Check
File name	Record each file name. Does the name suggest IB-restricted content (e.g., "deal-pipeline-Q1.pdf", "research-report-AAPL.docx")? Flag for IB review.
File sensitivity	Is a sensitivity label present? If blank or "None", this is a gap — flag for remediation.
SharePoint Container ID	Record the container ID (GUID format). This is used to cross-reference in SharePoint Admin Center.

Record findings in your audit worksheet.

Step 2.3 — Review the Overview Tab for Agent-Level Sensitivity Label

Select the Overview tab in the agent detail view.
Locate the Sensitivity label field.
Verify the label reflects the most restrictive label of the embedded files (per Microsoft's label inheritance behavior).
If the field is blank, the agent has no sensitivity label — this is a compliance gap requiring remediation.

Sensitivity Label Gap — Remediation Required

If an agent shows no sensitivity label on the Overview tab, either the uploaded files were unlabeled and no default label policy is configured, or the label policy has not yet applied. See Section 6 (Configure Default Sensitivity Label Policy) and the Troubleshooting playbook for remediation steps.

Section 3: Audit SharePoint Embedded Containers

This step provides a view of all SharePoint Embedded containers across the tenant associated with the Declarative Agent application. Use this as a secondary inventory check and to verify container health.

Step 3.1 — Access SharePoint Admin Center

Navigate to the SharePoint Admin Center: https://admin.microsoft.com/sharepoint or via M365 Admin Center › SharePoint.
In the left navigation, select More features or navigate directly to the appropriate SharePoint Admin URL for your tenant.

Direct URL pattern: https://[tenant]-admin.sharepoint.com

Step 3.2 — Filter for Declarative Agent Containers

In SharePoint Admin Center, locate the Active sites section or the container management view (this may appear under Content services depending on your admin center version).
Apply a filter or search for application name: "Declarative Agent".
The resulting list shows all SharePoint Embedded containers associated with M365 Copilot agents that use embedded file knowledge sources.

Step 3.3 — Reconcile Containers Against the Agent Inventory

For each container in the SharePoint Admin Center list, record:
Container ID (GUID)
Application name ("Declarative Agent")
Container creation date
Storage used
Cross-reference each Container ID against the container IDs recorded from agent metadata in Section 2.
Identify any containers that do not match a known active agent — these may be orphaned containers from deleted agents that did not follow proper deletion workflow.

Orphaned Containers

Orphaned containers (containers with no associated active agent) may contain residual file content. These containers should be documented and reviewed by the compliance team before any remediation action. Do not delete containers without confirming there is no active agent dependency. See the Troubleshooting playbook for the correct recovery procedure if a container was accidentally deleted.

Step 3.4 — Verify No Containers Were Directly Deleted

Review the SharePoint audit log for any container deletion events.
Navigate to: Microsoft Purview Compliance Portal › Audit and search for audit operations on SharePoint Embedded containers.
If any container deletion events appear outside of agent deletion workflows, investigate immediately and escalate to the agent owner and compliance team.

Section 4: IB Boundary Assessment Before File Uploads (Zone 2 and Zone 3)

This section must be completed before any file is uploaded to an agent operating in Zone 2 (team/departmental) or Zone 3 (enterprise). This is a procedural control that compensates for the platform-level IB limitation.

Step 4.1 — Identify the Agent's User Population

Determine who will have access to the agent. Review:
Agent sharing settings (who the agent is shared with)
Group memberships for shared groups
Anticipated user base as documented by the agent owner
Identify the business lines represented by the user population. Examples:
Sales and Trading
Investment Banking / Capital Markets
Equity Research
Asset Management
Retail Banking
Compliance / Legal

Step 4.2 — Identify the Content of Each File to Be Uploaded

For each file the agent owner proposes to upload, determine:
What business function created the file
Whether the file contains information that is subject to an IB wall (e.g., deal pipeline data, research pre-publication, material non-public information)
The file's current sensitivity label (if any)

Step 4.3 — Assess for IB Wall Conflicts

Using the firm's current IB segment map (maintained by Compliance), determine whether any IB wall exists between:
The business line that owns/created the file content, and
Any business line represented in the agent's user population
If an IB wall conflict is identified:
Zone 2: Block the file upload. Notify the agent owner that the file cannot be embedded without a compliance review.
Zone 3: Block the file upload. The entire embedded files capability must be prohibited for this agent unless the compliance officer provides Zone 3 exception sign-off (see Step 4.4).
If no IB wall conflict is identified:
Document the assessment result: "No IB wall conflict identified between content source [Business Line A] and agent user population [Business Lines B, C]."
Store the assessment in the agent inventory record (Control 3.1).

Step 4.4 — Zone 3 Exception Process (If Required)

If the agent owner requires embedded files for a Zone 3 agent and the compliance team determines all content is genuinely IB-exempt for the full user population:

Agent owner submits a written request to the Compliance Officer documenting:
Agent name and ID
Each file proposed for embedding (name, sensitivity label, content summary)
Each IB segment in the agent's user population
Justification that the content is IB-exempt for all segments
Compliance Officer reviews and, if approved, provides written sign-off stating:
All listed files are IB-exempt for the stated user population
The approval date and any conditions or expiration (recommend annual renewal)
Store the signed exception document in the agent inventory record (Control 3.1) and in the examination-ready compliance file.

Section 5: Register Agent in the Agent Inventory (Control 3.1)

All agents with embedded files must be registered in the enterprise agent inventory (Control 3.1) with the following embedded-file-specific metadata fields populated.

Step 5.1 — Open Agent Inventory

Navigate to your organization's agent inventory system (SharePoint list, ServiceNow catalog, or equivalent as defined in Control 3.1).

Step 5.2 — Create or Update the Agent Record

For the agent, populate or verify the following fields in the inventory record:

Field	Value
Agent Name	As shown in M365 Admin Center
Agent ID / Container ID	Container ID from Data & tools tab
Embedded Files (Y/N)	Y
Embedded File Names	Comma-separated list of all file names
Embedded File Sensitivity Labels	Labels for each file; flag any unlabeled files
Zone	1 / 2 / 3
IB Assessment Status	Assessed — No Conflict / Assessed — IB-Exempt (with sign-off reference) / Pending
IB Assessment Date	Date of last assessment
IB Exception Sign-Off Reference	Reference to exception document (Zone 3 only)
Last Container Audit Date	Date of most recent quarterly container audit

Section 6: Configure Default Sensitivity Label Policy for Unlabeled Files

Configuring a default sensitivity label policy ensures that any file uploaded to an agent without an existing sensitivity label automatically receives a baseline label — preventing unlabeled containers.

Step 6.1 — Open Microsoft Purview Information Protection

Navigate to the Microsoft Purview Compliance Portal: https://compliance.microsoft.com
In the left navigation, expand Information protection.
Select Label policies.

Portal path: Microsoft Purview › Information Protection › Label policies

Step 6.2 — Review Existing Default Label Policy

Review the list of label policies. Identify any policy that is marked as the default or global policy.
Click the policy to review its settings.
Locate the Default label settings section.
Verify that a default label is configured for documents (this applies to files uploaded to SharePoint Embedded containers).

Step 6.3 — Configure or Update Default Label

If no default label is configured for documents:

Edit the label policy.
In the Default label settings, for the Documents category, select a label appropriate for your organization's baseline classification (e.g., "Internal Use", "General").
Confirm the policy scope includes the users and groups who will be uploading files to agents.
Save the policy.

Label Policy Propagation Time

Changes to label policies may take up to 24 hours to propagate across the tenant. Plan accordingly when deploying new agents with embedded files.

Step 6.4 — Test Default Label Application

Ask a test user to upload an unclassified document to a test agent via Agent Builder.
After upload, navigate to M365 Admin Center › Copilot › Agents › [Test Agent] › Overview tab.
Verify the Sensitivity label field shows the expected default label.
Document the test result as evidence of label policy configuration effectiveness.

Section 7: Configure SharePoint Container Creation Alerts

Configuring alerts for new Declarative Agent container creation provides proactive visibility into embedded file agent deployments.

Step 7.1 — Access SharePoint Admin Center Alerts (If Available)

Depending on your tenant configuration and admin center version:

Navigate to SharePoint Admin Center.
Review available alert and notification settings under Settings or Content services.
If container creation alerts are available as a native feature, configure an alert to notify SharePoint administrators and the compliance mailbox when a new container with application "Declarative Agent" is created.

Step 7.2 — PowerShell-Based Monitoring (Alternative)

If native portal alerts are not available for container creation, use the PowerShell monitoring approach documented in the PowerShell Setup playbook, Section 4.

Step 7.3 — M365 Audit Log Alert (Recommended)

Navigate to Microsoft Purview Compliance Portal › Audit › Alert policies.
Create a new alert policy for SharePoint file and container events related to Declarative Agent application activity.
Configure the alert to notify the SharePoint admin and compliance teams.
Test the alert by creating a test agent with an embedded file.

Quarterly Audit Checklist

Use this checklist at the start of each quarterly audit cycle: