# Control 3.7: PPAC Security Posture Assessment

**Control ID:** 3.7<br>
**Pillar:** Reporting<br>
**Regulatory Reference:** FINRA 3110, FINRA RN 24-09, OCC Bulletin 2026-13 (formerly OCC 2011-12), GLBA 501(b), SOX 404<br>
**Last UI Verified:** April 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated<br>

---

## Objective

Leverage the Power Platform Admin Center Security page to assess, monitor, and improve the security posture of your Power Platform tenant. This control provides visibility into security configurations, actionable recommendations, and compliance tracking for AI agent environments.

---

## Why This Matters for FSI

- **FINRA RN 24-09 / Rule 3110:** Supervisory procedures require documented security assessments
- **OCC Bulletin 2026-13 (formerly OCC 2011-12):** Third-party risk management extends to platform security posture
- **GLBA 501(b):** Safeguards rule requires ongoing security evaluation
- **SOX 404:** IT general controls must be assessed and documented
- **Examination Readiness:** Documented posture assessments demonstrate due diligence

---

!!! info "No companion solution by design"
    Not all controls have a companion solution in [FSI-AgentGov-Solutions](https://github.com/judeper/FSI-AgentGov-Solutions); solution mapping is selective by design. This control is operated via native Microsoft admin surfaces and verified by the framework's assessment-engine collectors. See the [Solutions Index](../../reference/solutions-index.md#coverage-scope) for the catalog and coverage scope.


## Control Description

The Power Platform Admin Center (PPAC) **Security** area provides a centralized location to view a tenant security score, act on system-generated recommendations, and manage proactive policies for governance and security. Regular review helps support FSI security expectations under FINRA, OCC, GLBA, and SOX.

The **Security** node in PPAC navigation contains four pages, plus a related **Actions** page (formerly Power Platform Advisor) that surfaces actionable recommendations across the tenant:

| PPAC Page | Purpose | Typical FSI Use |
|------------|---------|-----------------|
| **Security > Overview** | Security score (Preview), top recommendations, environment-management conversion entry point | Weekly posture review and score trending |
| **Security > Data protection and privacy** | DLP policies, customer-managed keys, IP firewall, Azure VNet, customer lockbox | Configuration review for data-handling controls |
| **Security > Identity and access management** | Tenant isolation, security groups, guest access, admin counts, client app access control, IP cookie binding | Identity boundary and least-privilege review |
| **Security > Compliance** | Auditing posture, Managed Environment conversion, compliance settings | Audit-readiness and supervisory evidence |
| **Actions** (formerly Advisor) | All system-generated recommendations across Apps, Sites, Tenant settings; severity, refresh frequency, inline actions, history, dismiss/snooze | Day-to-day remediation queue and audit history |

!!! note "Prerequisite: Tenant-level analytics"
    The Security score and most recommendations are populated only after **tenant-level analytics** is turned on. After enabling, expect up to **24 hours** before data appears; until then, Security > Overview shows "Calculating security score." See [How do I turn on tenant-level analytics?](https://learn.microsoft.com/en-us/power-platform/admin/tenant-level-analytics).

### Security Posture Scoring

!!! warning "Security Score is in Preview"
    Microsoft has stated they **do not plan to invest in changes to the current preview implementation** of the security score logic, and recommend using the score "for evaluation purposes only at this time." Behaviour may change without notice. FSI organizations should **not** rely on the numeric score as a sole compliance metric. Use it as a directional indicator and base supervisory evidence on documented review of individual recommendations and underlying configuration.

The score is expressed as a percentage and mapped to a qualitative label. The score is recalculated every 24 hours and considers all environments (Managed and unmanaged):

| Score Range | Qualitative Label | Suggested FSI Response |
|-------------|-------------------|------------------------|
| **0–50** | Low | Treat as elevated risk; remediate High-severity items immediately and document compensating controls |
| **51–80** | Medium | Schedule remediation within zone-aligned SLA; document accepted exceptions |
| **81–100** | High | Maintain; continue cadence; investigate any score regression |

**Calculation formula:** `(Your score ÷ Total possible score) × 100`. As Microsoft adds new scored features, the **Total possible score** can change, which may shift your displayed score even when your tenant configuration is unchanged. Document this in your monthly posture report so reviewers can distinguish configuration drift from scoring-model changes.

### Recommendation Trigger Conditions

System-generated recommendations are produced when the following conditions are met (per [Security overview — Conditions that trigger feature recommendations](https://learn.microsoft.com/en-us/power-platform/admin/security/security-overview#conditions-that-trigger-feature-recommendations)):

| Feature | Scope | Trigger Condition |
|---------|-------|-------------------|
| Administrator privileges | Environment | More than 10 administrators |
| Auditing | Environment | Auditing turned off |
| Customer Lockbox | Tenant | Customer Lockbox on, but no Managed Environments |
| Client application access control | Environment | Auditing on, but client app access control not configured |
| Data policy | Tenant | No tenant-level data policy set |
| Environment Azure Virtual Network | Environment | No VNet policy |
| Environment security group | Environment | No security group assigned |
| Guest access | Environment | Restricted guest access turned off |
| IP firewall | Environment | IP firewall not configured |
| IP address-based cookie binding | Environment | Cookie binding not configured |
| Sharing | Environment | No sharing limit |
| Tenant isolation | Tenant | Tenant isolation turned off |

!!! note "Inline actions require Managed Environments"
    Inline remediation from the **Actions** page (and most score-improvement actions from Security > Overview) is available **only on Managed Environments**. For non-Managed Environments, recommendations are visible but must be applied by opening the environment **Settings** page and configuring the feature manually. After conversion to Managed, allow up to **72 hours** for the Actions page to show full affected-resource detail.

### Proactive Policy Categories

PPAC organizes proactive policies into three areas, aligned to the Security navigation pages:

| Category | Focus | Example Settings |
|----------|-------|------------------|
| **Data Protection and Privacy** | DLP, customer-managed keys, IP firewall, VNet, customer lockbox | Enable tenant-level DLP policy; configure IP firewall on Zone 2/3 environments |
| **Identity and Access Management** | Tenant isolation, security groups, guest access, admin count | Enable tenant isolation; assign security groups to all Zone 2/3 environments |
| **Compliance** | Auditing, Managed Environments, supervisory evidence | Enable Dataverse auditing; convert in-scope environments to Managed |

---

!!! danger "License deadline: 2026-07-01 — Agent 365 required for AI Agent Inventory"
    Defender for Cloud Apps AI Agent Inventory is referenced in this control's Additional Resources and portal walkthrough (Step 8). Microsoft changed AI Agent Inventory licensing requirements (May 2026):

    | Period | Licensing |
    |--------|-----------|
    | **Until 2026-07-01** (grace period) | Defender for Cloud Apps license provides AI Agent Inventory access without Agent 365 |
    | **After 2026-07-01** | **Agent 365 required.** Defender for Cloud Apps alone no longer provides AI Agent Inventory |

    Organizations without Agent 365 after 2026-07-01 **lose AI Agent Inventory visibility entirely**. Plan procurement before the deadline. Source: [AI agent inventory — Microsoft Defender for Cloud Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/ai-agent-inventory)

## Key Configuration Points

- Review Security Overview for top recommendations weekly
- Track Health recommendations by status (Not started / In progress / Completed)
- Address High-risk recommendations within 7 days
- Enable Managed Environments for Zone 2-3 (foundational security)
- Apply DLP policies to all environments
- Configure security groups for environment access control
- Generate monthly security posture reports
- Configure blocked attachment extensions to prevent upload of dangerous file types (exe, bat, cmd, js, etc.)
- Block high-risk MIME types (application/javascript, application/hta, text/javascript, etc.) per environment
- Enable inactivity timeout (≤ 120 minutes) to force re-authentication after idle periods
- Enable session expiration with custom timeout (≤ 1440 minutes) to limit total session duration
- Enable Content Security Policy (CSP) enforcement for model-driven apps to help mitigate cross-site scripting (XSS) risks

### Enhanced Security Posture Features (GA)

- **Dismiss recommendations:** Administrators can now dismiss security recommendations that are false positives or not applicable, cleaning up the security score view without implementing the recommendation
- **Environment group-level security settings:** Security settings (sharing restrictions, IP firewall, cookie binding) can now be configured at the environment group level, providing consistent security posture across grouped environments
- **Bulk managed environment conversion:** Convert multiple environments to managed status simultaneously, accelerating governance deployment across large tenants

### Configuration Drift Monitoring

Beyond the native PPAC security recommendations, organizations should maintain a configuration hardening baseline to detect drift in security-critical settings. The following checklist consolidates key configuration points across multiple controls into a single reviewable posture:

| Setting Category | Configuration Check | Portal Path | Control Reference | Review Frequency |
|-----------------|--------------------|--------------|--------------------|------------------|
| **Agent Authentication** | All agents require authentication (not "No Authentication") | Microsoft Copilot Studio > Agent > Settings > Security | [1.1](../pillar-1-security/1.1-restrict-agent-publishing-by-authorization.md) | Weekly |
| **Agent Authentication** | Authentication set to "Always" (not "As Needed") | Copilot Studio > Agent > Settings > Security | [1.1](../pillar-1-security/1.1-restrict-agent-publishing-by-authorization.md) | Weekly |
| **Agent Sharing** | No agents shared with unrestricted access | Copilot Studio > Agent > Channels > Share Settings | [1.1](../pillar-1-security/1.1-restrict-agent-publishing-by-authorization.md) | Weekly |
| **Audit Logging** | Dataverse auditing enabled per environment | PPAC > Environment > Audit and logs | [1.7](../pillar-1-security/1.7-comprehensive-audit-logging-and-compliance.md) | Monthly |
| **Audit Retention** | Retention ≥ 180 days per environment | PPAC > Environment > Audit settings | [1.7](../pillar-1-security/1.7-comprehensive-audit-logging-and-compliance.md) | Monthly |
| **Content Moderation** | Level set to High for Zone 2/3 agents | Copilot Studio > Agent > Settings > Generative AI | [1.27](../pillar-1-security/1.27-ai-agent-content-moderation-enforcement.md), [1.8](../pillar-1-security/1.8-runtime-protection-and-external-threat-detection.md) | Weekly |
| **Agent Tools** | User consent required before execution | Copilot Studio > Agent > Tools | [1.18](../pillar-1-security/1.18-application-level-authorization-and-role-based-access-control-rbac.md) | Weekly |
| **Connected Agents** | Inter-agent connectivity disabled unless approved | Copilot Studio > Agent > Settings > Connected agents (verify the literal menu label at apply-time — may surface as 'Agents' depending on UI release ring; A2A reached GA in April 2026 but per-agent toggle may still show Preview — [Learn](https://learn.microsoft.com/en-us/microsoft-copilot-studio/authoring-add-other-agents)) | [1.18](../pillar-1-security/1.18-application-level-authorization-and-role-based-access-control-rbac.md) | Monthly |
| **Environment Creation** | Restricted to authorized admins only | PPAC > Tenant Settings > Environment assignments | [2.1](../pillar-2-management/2.1-managed-environments.md) | Monthly |
| **Tenant Isolation** | Cross-tenant connections restricted | PPAC > Security > Tenant Isolation | [2.1](../pillar-2-management/2.1-managed-environments.md) | Monthly |
| **Security Groups** | Assigned to all Zone 2/3 environments | PPAC > Environment > Security group | [2.1](../pillar-2-management/2.1-managed-environments.md) | Monthly |
| **AI Feature Toggles** | AI Prompts, Generative Actions, File Analysis, Model Knowledge, Semantic Search disabled unless approved | PPAC > Copilot > Settings (previously under Environment > Settings > Features); Copilot Studio > Agent > Settings | [3.8](3.8-copilot-hub-and-governance-dashboard.md) | Weekly |
| **Transcript Access** | Restricted to authorized personnel | PPAC > Copilot > Settings (previously under Environment > Features > Copilot Studio Agents) | [3.8](3.8-copilot-hub-and-governance-dashboard.md) | Monthly |
| **Blocked Attachments** | Dangerous file extensions blocked (ade, adp, app, exe, etc.) | PPAC > Environment > Settings > Privacy + Security | [3.7](#) | Monthly |
| **MIME Type Restriction** | High-risk MIME types blocked (application/javascript, application/hta, etc.) | PPAC > Environment > Settings > Privacy + Security | [3.7](#) | Monthly |
| **Inactivity Timeout** | Inactivity timeout enabled and set to ≤ 120 minutes (Zone 3: ≤ 60 minutes) | PPAC > Environment > Settings > Privacy + Security | [2.22](../pillar-2-management/2.22-inactivity-timeout-enforcement.md), [3.7](#) | Monthly |
| **Session Expiration** | Custom session timeout enabled and set to ≤ 1440 minutes (Zone 3: ≤ 720 minutes) | PPAC > Environment > Settings > Privacy + Security | [2.22](../pillar-2-management/2.22-inactivity-timeout-enforcement.md), [3.7](#) | Monthly |
| **Content Security Policy** | CSP enforcement enabled for model-driven apps | PPAC > Environment > Settings > Privacy + Security | [3.7](#) | Monthly |

!!! tip "Advanced Implementation: Configuration Hardening Baseline"
    For a comprehensive implementation guide including automated verification scripts, manual attestation procedures, and evidence collection workflows, see [Configuration Hardening Baseline](../../playbooks/advanced-implementations/configuration-hardening-baseline/index.md).

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Quarterly review; document exceptions | Lower risk, proportionate oversight |
| **Zone 2** (Team) | Monthly review; all high-risk addressed | Shared data increases exposure |
| **Zone 3** (Enterprise) | Weekly review; 100% recommendations addressed; automated reporting | Customer-facing requires strict posture |

---

## Roles & Responsibilities

| Role | Responsibility |
|------|----------------|
| Power Platform Admin | Review recommendations, implement remediations |
| Entra Security Admin | Validate security controls, approve configurations |
| AI Governance Lead | Track posture scores, report to leadership |
| Compliance Officer | Include in regulatory examination evidence |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [1.5 - DLP Policies](../pillar-1-security/1.5-data-loss-prevention-dlp-and-sensitivity-labels.md) | Key recommendation category |
| [2.1 - Managed Environments](../pillar-2-management/2.1-managed-environments.md) | Foundational security control |
| [1.7 - Audit Logging](../pillar-1-security/1.7-comprehensive-audit-logging-and-compliance.md) | Monitor tab integration |
| [3.8 - Copilot Hub](3.8-copilot-hub-and-governance-dashboard.md) | Complementary governance view |
| [1.1 - Restrict Agent Publishing](../pillar-1-security/1.1-restrict-agent-publishing-by-authorization.md) | Agent authentication and access posture |
| [1.8 - Runtime Protection](../pillar-1-security/1.8-runtime-protection-and-external-threat-detection.md), [1.27 - Content Moderation Enforcement](../pillar-1-security/1.27-ai-agent-content-moderation-enforcement.md) | Content moderation posture |
| [1.18 - RBAC](../pillar-1-security/1.18-application-level-authorization-and-role-based-access-control-rbac.md) | Agent action consent and connected agent posture |
| [2.1 - Managed Environments — Customer Lockbox & Data Residency Posture](../pillar-2-management/2.1-managed-environments.md#customer-lockbox-data-residency-posture) | Audit-logging coverage gaps and Lockbox approval evidence surface in the PPAC posture review pack — see the Agent 365 audit-logging caveat in the 2.1 sub-section |

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/3.7/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/3.7/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/3.7/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/3.7/troubleshooting.md) — Common issues and resolutions

!!! tip "Advanced Implementation: Configuration Hardening Baseline"

    This control is covered by the [Configuration Hardening Baseline](../../playbooks/advanced-implementations/configuration-hardening-baseline/index.md), which consolidates SSPM-detectable settings across all 7 mapped controls into a single reviewable checklist with automation classification and evidence export procedures.

!!! tip "Governance Script: Publishing Restriction Validation"

    `restrict-agent-publishing.ps1` validates 6 publishing restriction criteria against your tenant configuration: Environment Maker role removal, authorized security groups, Share with Everyone disabled, DLP connector blocking, Managed Environment sharing limits, and approval workflow status — with SHA-256 evidence export for audit readiness.

    **Script Location:** `scripts/governance/restrict-agent-publishing.ps1`

---

## Verification Criteria

Confirm control effectiveness by verifying:

1. Tenant-level analytics turned on; Security > Overview displays a current security score (not stuck on "Calculating")
2. PPAC > Security navigation pages (Overview, Data protection and privacy, Identity and access management, Compliance) and the Actions page are accessible to the Power Platform Admin role
3. High-severity recommendations on the Actions page addressed within the zone-aligned SLA
4. Managed Environments enabled for all Zone 2-3 environments
5. DLP policies applied to 100% of environments
6. Monthly posture report generated with trend analysis
7. Configuration hardening baseline checklist reviewed per documented frequency
8. No configuration drift detected in agent authentication, content moderation, or AI feature settings
9. Evidence of configuration baseline review archived for audit readiness
10. Blocked attachment extensions configured per environment to prevent dangerous file uploads
11. High-risk MIME types blocked per environment to help mitigate code injection risks
12. Inactivity timeout enabled and set to ≤ 120 minutes per environment
13. Session expiration enabled with custom timeout ≤ 1440 minutes per environment
14. Content Security Policy enforcement enabled for model-driven apps per environment

---

## Additional Resources

- [Security in Power Platform Admin Center](https://learn.microsoft.com/en-us/power-platform/admin/security)
- [Managed Environments Overview](https://learn.microsoft.com/en-us/power-platform/admin/managed-environment-overview)
- [Power Platform DLP Policies](https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention)
- [Power Platform Security Best Practices](https://learn.microsoft.com/en-us/power-platform/admin/governance-considerations)

### Agent 365 Security Posture (Preview)

> **Note:** The following guidance reflects preview capabilities that may evolve.

Agent 365 introduces additional security posture considerations for Blueprint-registered agents:

**Microsoft Defender Integration:**

| Capability | Description | FSI Relevance |
|------------|-------------|---------------|
| **AI Agent Inventory** | **Agent 365 license required after 2026-07-01.** During grace period (until 2026-07-01), Defender for Cloud Apps license provides visibility. After 2026-07-01, Agent 365 is required or inventory access is lost. | Complements PPAC inventory; plan Agent 365 procurement before deadline |
| **Attack Path Analysis** | Identifies potential attack vectors involving agent identities | Supports NYDFS cybersecurity requirements |
| **Security Exposure Management** | Correlates agent permissions with sensitive data exposure | Helps meet GLBA 501(b) safeguards |

**Agent 365 Security Metrics:**

When available, incorporate these metrics into security posture reporting:

| Metric | Source | Target |
|--------|--------|--------|
| Blueprint registration compliance | M365 Admin Center | 100% Zone 3 agents |
| Agent identity provisioning status | Entra Admin Center | All enterprise agents |
| Observability SDK coverage | Application Insights | 100% Zone 2-3 agents |
| DLP policy coverage for Agent 365 | Purview Compliance | 100% production agents |

**Integration with PPAC Security Page:**

1. PPAC Security Overview surfaces Agent 365-related recommendations
2. Controls tab links to Agent 365 governance settings (when GA)
3. Monitor tab includes Agent 365 audit events via unified audit log

**Zone-Specific Agent 365 Security Requirements:**

| Zone | Requirement |
|------|-------------|
| **Zone 1** | Basic inventory tracking via PPAC |
| **Zone 2** | Blueprint registration recommended; DLP policy coverage required |
| **Zone 3** | Blueprint registration required; Defender integration for attack path analysis |

- [Microsoft Learn: AI Agent Inventory (Defender for Cloud Apps)](https://learn.microsoft.com/en-us/defender-cloud-apps/ai-agent-inventory) - Discover AI agents in your tenant
- [Microsoft Learn: Agent 365 Security Overview (Preview)](https://learn.microsoft.com/en-us/security/security-for-ai/agent-365-security) - Security guidance for Agent 365 deployments

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current*
