Skip to content

Control 2.9: Defender for Cloud Apps — Copilot Session Controls — Verification & Testing

Test cases and evidence collection for validating session controls.

Test Cases

Test 1: Session Monitoring Activation

  • Objective: Confirm Copilot sessions are monitored by Defender for Cloud Apps
  • Steps:
  • As a test user, perform several Copilot interactions in Word and Teams
  • Navigate to Defender > Investigate > Activity Log
  • Filter for the test user and verify Copilot activities appear
  • Confirm activity details include interaction context
  • Expected Result: Copilot activities appear in the Defender activity log
  • Evidence: Activity log entries for test user

Test 2: Content Inspection Detection

  • Objective: Verify content inspection detects sensitive data in sessions
  • Steps:
  • Use Copilot to interact with a document containing test sensitive data
  • Verify the session policy content inspection triggers
  • Confirm the alert is generated with the correct severity
  • Verify the detection details include the sensitive information type
  • Expected Result: Content inspection detects and alerts on sensitive data
  • Evidence: Alert record with detection details

Test 3: Alert Generation and Delivery

  • Objective: Confirm alerts are generated and delivered to the security team
  • Steps:
  • Trigger a session policy condition (e.g., sensitive data detection)
  • Verify an alert appears in Defender portal > Alerts
  • Confirm email notification is delivered to configured recipients
  • Verify alert severity matches the policy configuration
  • Expected Result: Alerts generated and delivered within expected timeframe
  • Evidence: Alert notification and email confirmation

Test 4: Generative AI App Catalog Coverage

  • Objective: Verify the organization has reviewed and governed generative AI app usage via the MDCA catalog
  • Steps:
  • Navigate to Defender portal > Cloud Apps > Cloud app catalog > filter by Generative AI category
  • Confirm the catalog loads and displays generative AI apps
  • Check the "Discovered apps" view to identify any generative AI apps used in the organization that are not Microsoft 365 Copilot
  • Verify that high-risk discovered generative AI apps have governance policies applied (blocked, unsanctioned, or explicitly approved)
  • Confirm Microsoft 365 Copilot is marked as "Sanctioned" in the catalog
  • Expected Result: Generative AI catalog has been reviewed; high-risk apps are governed; sanctioned apps are documented
  • Evidence: App catalog screenshot with discovered apps; governance policy configuration for high-risk apps

Test 5: Agent Threat Detection Verification

  • Objective: Confirm agent threat detection is operational for Copilot agent deployments
  • Steps:
  • Navigate to Defender portal > Incidents & alerts and filter for agent-related alerts
  • Confirm that agent monitoring is active for organizational Copilot agent deployments
  • Review any existing agent-related incidents to verify the detection is surfacing actionable intelligence
  • Verify at least one custom agent anomaly detection rule is configured
  • Confirm agent threat alert routing: alerts should reach the SOC or security team within the defined SLA
  • Expected Result: Agent threat detection is active, alerts are routing correctly, and custom rules are configured
  • Evidence: Agent alert configuration; sample agent incident records; alert routing confirmation

Evidence Collection

Evidence Item Format Storage Location Retention
Session policy configuration Screenshot/PDF Compliance evidence repository 7 years
Activity log samples CSV Compliance evidence repository 7 years
Alert records CSV Compliance evidence repository 7 years
Content inspection test results PDF Compliance evidence repository 7 years

Compliance Mapping

Regulation Requirement How This Control Supports It
FINRA Rule 3110 Supervisory system monitoring Session controls support compliance with AI interaction monitoring requirements
SEC Rule 17a-4 Electronic communication monitoring Session logging helps meet communication monitoring obligations
FFIEC Handbook Security monitoring Real-time session controls support compliance with security monitoring requirements
NIST CSF DE.CM-1 Network monitoring Session controls provide monitoring for AI workloads