Control 2.13: Plugin and Graph Connector Security — Verification & Testing

Test cases and evidence collection for validating plugin and connector security.

Test Cases

Objective: Confirm external agents and unapproved plugin tools are blocked by default
Steps:
Confirm the external-publisher setting under Microsoft 365 Admin Center > Agents > Settings > Allowed agent types
As a standard Copilot user, attempt to install an external partner agent or use an agent with an unapproved plugin
Capture the policy or portal denial and export the corresponding Agent Registry or Agent Tools scope
Expected Result: The external agent or unapproved tool is unavailable to the user
Evidence: Agent setting, tool scope, and block notification. Do not use an operation-only EnablePlugin search as proof of Microsoft 365 Copilot state.

Objective: Verify user consent is disabled and admin consent is required
Steps:
Run Script 3 and confirm UserConsentDisabled and AdminConsentWorkflowEnabled are both True
As a standard user, access an app requiring consent — verify admin consent is required
Submit an admin consent request and verify it routes correctly
Review existing grants separately and confirm unauthorized grants have been revoked
Expected Result: Users cannot self-consent; the request reaches an authorized reviewer; no unauthorized legacy grant remains
Evidence: Script 3 output, request-workflow record, and existing-grant review

Objective: Confirm Graph connector ACLs correctly restrict content access
Steps:
Under Microsoft 365 Admin Center > Copilot > Connectors > Your Connections, verify each connection's access permission
Test with a user who should not have access — verify content is not returned by Copilot
Test with an authorized user — verify content is returned
Expected Result: Connections configured for source ACLs show Only people with access to this data source, and access tests match the source system
Evidence: Access test results for authorized and unauthorized users

Objective: Confirm plugin usage evidence cannot include Security Copilot or an unapproved application or plugin
Steps:
Populate Script 4 with exact AppIdentity and CopilotEventData.AISystemPlugin.ID values from the approved inventory
Invoke an approved plugin from an approved Microsoft 365 Copilot host
Run Script 4 after audit ingestion completes
Confirm the paged 30-day retrieval completes without a paging-safety or 50,000-record segment-limit error; if the limit is reached, shorten the segment duration and rerun
Confirm every output row has Workload = Copilot, an exact approved AppIdentity, and an exact approved plugin ID
Confirm AppHost and plugin fields came from AuditData.CopilotEventData
Confirm Copilot.Security.SecurityCopilot, unknown application identities, and unapproved plugin IDs do not appear; retain rejected values separately for investigation
Expected Result: The evidence set contains only inventory-matched Microsoft 365 Copilot plugin usage
Evidence: Script 4 accepted and rejected CSVs, the application and plugin allow-lists, retrieval interval and segment duration, and the matching approval records

Evidence Item	Format	Storage Location	Retention
Plugin permission audit	CSV	Compliance evidence repository	7 years
Workload-scoped plugin usage audit	CSV plus application/plugin allow-lists	Compliance evidence repository	7 years
Connector security audit	CSV	Compliance evidence repository	7 years
Consent policy verification	PowerShell output and workflow record	Compliance evidence repository	7 years
ACL test results	PDF	Compliance evidence repository	7 years

Regulation	Requirement	How This Control Supports It
12 CFR part 30, appendix D (OCC Heightened Standards)	Third-party risk management	Plugin security supports compliance with third-party technology risk requirements
FINRA Rule 3110	Technology oversight	Plugin governance supports compliance with supervisory technology controls
NIST CSF	PR.IP-1 Baseline configuration	Plugin restrictions help establish and maintain secure baseline configurations
- Back to Control 2.13