Control 1.2: Agent Registry and Integrated Apps Management

Overview

Control ID: 1.2 Control Name: Agent Registry and Integrated Apps Management Regulatory Reference: FINRA 4511, SEC Rule 17a-3/4, OCC 2011-12 Setup Time: 1-2 hours (initial); ongoing maintenance

Purpose

A comprehensive agent registry provides the foundational inventory required for AI governance in financial services. Regulators expect firms to know exactly what AI agents are deployed, who owns them, what data they access, and their approval status. This control satisfies:

FINRA 4511: Books and records requirements for electronic systems
SEC 17a-3/4: Record-keeping for broker-dealers including AI systems
OCC 2011-12: Model inventory for AI/ML systems in banks
Examination Readiness: Rapid response to regulatory inquiries about AI deployments

Prerequisites

Primary Owner Admin Role: Power Platform Admin Supporting Roles: Dataverse System Admin, Entra App Admin, SharePoint Site Owner

Required Licenses

Microsoft 365 E3 or E5 (M365 Admin Center access)
Power Platform per-user or per-app license (for Copilot Studio agents)
Power Platform Admin Center access

Required Permissions

Microsoft 365 Global Administrator or Application Administrator (Integrated Apps)
Power Platform System Administrator (Copilot Studio agent inventory)
SharePoint Site Owner (for registry SharePoint list)

Dependencies

Control 2.1 (Managed Environments): Provides environment structure for agent categorization
Control 1.1 (Restrict Publishing): Ensures only approved agents are published

Pre-Setup Checklist

[ ] Define agent metadata schema (see below)
[ ] Create security groups for registry access
[ ] Identify all existing agents across environments
[ ] Establish agent naming convention
[ ] Create SharePoint site for registry (recommended)

Governance Levels

Baseline (Level 1)

Centralized inventory (spreadsheet or SharePoint list) of agents, updated at least monthly.

Recommended (Level 2-3)

Automated registry with ownership, data sources, connectors, approval status; weekly review.

Regulated/High-Risk (Level 4)

Real-time inventory with automated drift detection; daily monitoring for production agents.

Setup & Configuration

Step 1: Create Agent Registry Metadata Schema

Before building the registry, define the required metadata fields for FSI compliance:

Field Name	Required	Description	Example
Agent ID	Yes	Unique identifier	`AGT-2025-001`
Agent Name	Yes	Display name	`Customer Service Bot`
Description	Yes	Purpose and function	`Handles retail banking inquiries`
Owner	Yes	Responsible individual	`jane.smith@contoso.com`
Business Unit	Yes	Owning department	`Retail Banking`
Zone Classification	Yes	Governance zone	`Tier 3 - Enterprise`
Environment	Yes	Deployment location	`Production-Enterprise`
Data Sources	Yes	Connected data	`SharePoint, CRM`
Connectors Used	Yes	External integrations	`SharePoint, Dataverse`
Sensitivity Level	Yes	Data classification	`Confidential-FSI`
Approval Status	Yes	Governance approval	`Approved`
Approval Date	Yes	When approved	`2025-01-15`
Approver	Yes	Who approved	`AI Governance Committee`
Review Frequency	Yes	How often reviewed	`Quarterly`
Last Review Date	Yes	Most recent review	`2025-01-01`
Next Review Date	Yes	Scheduled review	`2025-04-01`
Risk Rating	Yes	Risk assessment	`Medium`
Status	Yes	Current state	`Active`

Step 2: Configure Integrated Apps in M365 Admin Center

Portal Path: Microsoft 365 Admin Center → Settings → Integrated Apps

Sign in to the Microsoft 365 Admin Center
Navigate to Settings → Integrated Apps
Review the current list of integrated applications
For each Copilot Studio agent:
Click the agent name to view details
Verify Publisher and Permissions information
Check User access configuration
Note the App ID for registry tracking

Configure User Consent Settings:

Navigate to Settings → Org settings → Services → User consent to apps
For FSI environments, set to Do not allow user consent
This ensures all agents must go through IT/Governance approval

Step 3: Create SharePoint Registry List

Recommended: Create a SharePoint list for centralized agent tracking

Portal Path: SharePoint Admin Center or SharePoint site

Create a new SharePoint site or use existing governance site
Create a new list named AI Agent Registry
Add columns matching the metadata schema from Step 1
Configure views:
All Agents: Complete inventory
Active Agents: Status = Active
Pending Review: Next Review Date <= Today + 30 days
By Zone: Grouped by Zone Classification
By Business Unit: Grouped by Business Unit
Set permissions:
Full Control: AI Governance Team
Contribute: Agent Owners (their items only)
Read: Compliance, Audit, Security Teams

Step 4: Discover Existing Agents

Portal Path: Power Platform Admin Center → Environments

For each environment:
Click the environment name
Navigate to Resources → Power Apps or Copilot Studio agents
Export the list of all applications/agents
Document each agent's:
Name and ID
Owner (Created By)
Last Modified Date
Connectors used (visible in app details)

Using Copilot Studio:

Navigate to Copilot Studio
Select each environment from the environment picker
Review Copilots list
Click each agent to view:
Topics and Knowledge sources
Channels published to
Analytics and usage data

Step 5: Configure Agent Publishing Requirements

Portal Path: Power Platform Admin Center → Policies → Publishing

Ensure all new agents must be registered before publishing:

Navigate to Environments → Select production environment
Go to Settings → Features
Under AI-generated content:
Enable Require admin approval for publishing
Document the approval workflow:
Agent must be registered in SharePoint list
Zone classification must be assigned
Risk assessment must be completed
Approval documented before publishing enabled

Step 6: Set Up Automated Inventory Refresh

Option A: Power Automate Flow

Create a scheduled flow to refresh the registry:

Navigate to Power Automate
Create a Scheduled cloud flow
Set schedule: Weekly (or daily for Tier 3)
Add actions:
Connect to Power Platform Admin connector
List all apps in target environments
Compare with SharePoint registry
Flag new unregistered agents
Send notification email for discrepancies

Option B: PowerShell Scheduled Task

# See PowerShell Configuration section below

PowerShell Configuration

# Agent Registry Automation Script
# Requires: Power Platform Admin PowerShell module

# Install required module
Install-Module -Name Microsoft.PowerApps.Administration.PowerShell -Force

# Connect to Power Platform
Add-PowerAppsAccount

# Get all Copilot Studio agents across environments
$AllEnvironments = Get-AdminPowerAppEnvironment
$AgentInventory = @()

foreach ($Env in $AllEnvironments) {
    Write-Host "Scanning environment: $($Env.DisplayName)" -ForegroundColor Cyan

    # Get Canvas Apps (includes Copilot Studio agents)
    $Apps = Get-AdminPowerApp -EnvironmentName $Env.EnvironmentName

    foreach ($App in $Apps) {
        $AgentInventory += [PSCustomObject]@{
            AgentName = $App.DisplayName
            AgentID = $App.AppName
            Environment = $Env.DisplayName
            EnvironmentID = $Env.EnvironmentName
            Owner = $App.Owner.displayName
            OwnerEmail = $App.Owner.email
            CreatedTime = $App.CreatedTime
            LastModifiedTime = $App.LastModifiedTime
            AppType = $App.AppType
        }
    }
}

# Export to CSV
$ExportPath = "C:\Governance\AgentInventory-$(Get-Date -Format 'yyyyMMdd').csv"
$AgentInventory | Export-Csv -Path $ExportPath -NoTypeInformation
Write-Host "Exported $($AgentInventory.Count) agents to $ExportPath" -ForegroundColor Green

# Compare with registered agents (from SharePoint list export)
$RegisteredAgents = Import-Csv "C:\Governance\RegisteredAgents.csv"
$RegisteredIDs = $RegisteredAgents.AgentID

$UnregisteredAgents = $AgentInventory | Where-Object { $_.AgentID -notin $RegisteredIDs }

if ($UnregisteredAgents.Count -gt 0) {
    Write-Host "WARNING: Found $($UnregisteredAgents.Count) unregistered agents!" -ForegroundColor Red
    $UnregisteredAgents | Format-Table AgentName, Owner, Environment

    # Send alert email
    $EmailBody = "The following agents are not registered in the AI Agent Registry:`n`n"
    $EmailBody += ($UnregisteredAgents | ForEach-Object { "- $($_.AgentName) in $($_.Environment) (Owner: $($_.Owner))" }) -join "`n"

    # Requires Exchange Online connection
    # Send-MailMessage -To "ai-governance@contoso.com" -Subject "Unregistered Agents Detected" -Body $EmailBody
}

# Get Integrated Apps from M365 (Graph API)
# Requires Microsoft.Graph module
Install-Module Microsoft.Graph -Force
Connect-MgGraph -Scopes "Application.Read.All"

$IntegratedApps = Get-MgServicePrincipal -Filter "tags/any(t:t eq 'WindowsAzureActiveDirectoryIntegratedApp')" -All
$IntegratedApps | Select-Object DisplayName, AppId, PublisherName, CreatedDateTime |
    Export-Csv "C:\Governance\IntegratedApps-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# Generate Registry Report
$ReportPath = "C:\Governance\AgentRegistryReport-$(Get-Date -Format 'yyyyMMdd').html"
$HTML = @"
<!DOCTYPE html>
<html>
<head>
    <title>Agent Registry Report - $(Get-Date -Format 'yyyy-MM-dd')</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        table { border-collapse: collapse; width: 100%; }
        th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }
        th { background-color: #0078d4; color: white; }
        tr:nth-child(even) { background-color: #f2f2f2; }
        .warning { background-color: #fff3cd; }
        .error { background-color: #f8d7da; }
    </style>
</head>
<body>
    <h1>AI Agent Registry Report</h1>
    <p>Generated: $(Get-Date -Format 'yyyy-MM-dd HH:mm')</p>
    <h2>Summary</h2>
    <ul>
        <li>Total Agents Discovered: $($AgentInventory.Count)</li>
        <li>Registered Agents: $($RegisteredAgents.Count)</li>
        <li>Unregistered Agents: $($UnregisteredAgents.Count)</li>
    </ul>
</body>
</html>
"@
$HTML | Out-File $ReportPath
Write-Host "Report generated: $ReportPath" -ForegroundColor Green

Financial Sector Considerations

Regulatory Alignment

Regulation	Registry Requirement
FINRA 4511	Maintain books and records for all electronic tools including AI agents
SEC 17a-3	Record-keeping for customer interaction systems
SEC 17a-4	Retention of system records for 3-6 years
OCC 2011-12	Model inventory for all AI/ML systems
Fed SR 11-7	Comprehensive inventory of models with risk ratings

Zone-Specific Configuration

Zone 1 (Personal Productivity)

Registry Update Frequency: Monthly
Metadata Required: Basic (Name, Owner, Zone, Status)
Approval Level: Automatic (self-service with guardrails)
Risk Assessment: Not required
Retention: 1 year after decommission

Zone 2 (Team Collaboration)

Registry Update Frequency: Weekly
Metadata Required: Full metadata schema
Approval Level: Team lead + IT approval
Risk Assessment: Simplified checklist
Retention: 3 years after decommission

Zone 3 (Enterprise Managed)

Registry Update Frequency: Real-time (automated)
Metadata Required: Full metadata + audit trail
Approval Level: AI Governance Committee
Risk Assessment: Full risk assessment document
Retention: 7 years after decommission (SEC 17a-4)

FSI Configuration Example: Regional Bank

Scenario: A regional bank with 50+ Copilot Studio agents across retail, commercial, and wealth divisions.

Registry Structure:

SharePoint Site: AIGovernance.sharepoint.com/sites/AgentRegistry
Lists Created:
AgentMasterRegistry - Primary inventory
AgentApprovals - Approval workflow tracking
AgentReviews - Periodic review documentation
AgentIncidents - Issue/incident tracking
Views Configured:
Customer-Facing Agents (Tier 3)
Internal Tools (Tier 1-2)
Pending Quarterly Review
By Line of Business
Recently Modified
Automation:
Power Automate flow scans environments weekly
Email alert for unregistered agents within 24 hours
Quarterly review reminders 30 days in advance
Automatic status change to "Review Overdue" if missed
Reporting:
Weekly summary to IT leadership
Monthly report to Risk Committee
Quarterly full inventory to Compliance
Annual attestation for regulatory examination

Verification & Testing

Verification Steps

Confirm Registry is Complete:
Navigate to SharePoint registry list
Compare count with Power Platform discovery
EXPECTED: All agents in environments appear in registry
Verify Integrated Apps Visibility:
M365 Admin Center → Settings → Integrated Apps
Confirm all published Copilot Studio agents appear
EXPECTED: Complete list with user access details
Test Discovery Automation:
Create a test agent in sandbox environment
Wait for automated scan to run
Check for alert notification
EXPECTED: Unregistered agent flagged within scheduled interval
Validate Metadata Completeness:
Select 5 random agents from registry
Verify all required fields are populated
EXPECTED: 100% field completion for Tier 2-3 agents
Confirm Approval Workflow:
Attempt to publish agent without registration
EXPECTED: Blocked or flagged per approval policy

Verification Evidence

[ ] Screenshot: SharePoint registry list with sample entries
[ ] Export: Full agent inventory CSV
[ ] Screenshot: Integrated Apps configuration
[ ] Documentation: Metadata schema and naming convention
[ ] Export: Approval workflow documentation
[ ] Log: Automated discovery scan results

Troubleshooting & Validation

Issue: Agents Not Appearing in Integrated Apps

Symptoms: Published Copilot Studio agents don't show in M365 Admin Center

Solutions:

Verify agent is published (not just created)
Check that the agent is published to a Teams channel
Wait 24 hours for sync (can take time)
Verify agent is in a Managed Environment
Check if app registration was created in Entra ID

Issue: PowerShell Discovery Missing Agents

Symptoms: Script doesn't find all known agents

Solutions:

Verify account has Power Platform Admin role
Check all environments are accessible (not blocked by tenant isolation)
Run discovery for each environment individually to identify gaps
Some agent types may require different API calls

Issue: Registry Drift - Mismatches Between Registry and Actual

Symptoms: Registry shows different agents than discovery

Solutions:

Implement more frequent automated scans
Add workflow to require registry update before publishing
Enable Power Platform audit logging to track changes
Create reconciliation report for weekly review

Issue: Orphaned Agents (Owner Left Organization)

Symptoms: Agent owner email is invalid/disabled

Solutions:

Query Entra ID to identify orphaned agent owners
Establish ownership transfer process in offboarding
Assign backup owners for all Tier 3 agents
Flag orphaned agents for immediate reassignment

Additional Resources

Control	Relationship
Control 1.1	Publishing restrictions ensure registry compliance
Control 2.1	Environment structure informs zone classification
Control 3.1	Registry feeds inventory reporting
Control 3.6	Registry enables orphan detection

Support & Questions

For implementation support or questions about this control, contact:

AI Governance Lead: Registry policy and metadata standards
Compliance Officer: Regulatory requirements and retention
IT Operations: Technical setup and automation
Power Platform Admin: Environment and agent management

Updated: Dec 2025
Version: v1.0 Beta (Dec 2025)
UI Verification Status: ❌ Needs verification

Control 1.2: Agent Registry and Integrated Apps Management

Overview

Purpose

Prerequisites

Required Licenses

Required Permissions

Dependencies

Pre-Setup Checklist

Governance Levels

Baseline (Level 1)

Recommended (Level 2-3)

Regulated/High-Risk (Level 4)

Setup & Configuration

Step 1: Create Agent Registry Metadata Schema

Step 2: Configure Integrated Apps in M365 Admin Center

Step 3: Create SharePoint Registry List

Step 4: Discover Existing Agents

Step 5: Configure Agent Publishing Requirements

Step 6: Set Up Automated Inventory Refresh

PowerShell Configuration

Financial Sector Considerations

Regulatory Alignment

Zone-Specific Configuration

Zone 1 (Personal Productivity)

Zone 2 (Team Collaboration)

Zone 3 (Enterprise Managed)

FSI Configuration Example: Regional Bank

Verification & Testing

Verification Steps

Verification Evidence

Troubleshooting & Validation

Issue: Agents Not Appearing in Integrated Apps

Issue: PowerShell Discovery Missing Agents

Issue: Registry Drift - Mismatches Between Registry and Actual

Issue: Orphaned Agents (Owner Left Organization)

Additional Resources

Related Controls

Support & Questions