# Control 1.7: Comprehensive Audit Logging and Compliance

**Control ID:** 1.7<br>
**Pillar:** Security<br>
**Regulatory Reference:** FINRA 4511, FINRA 3110, FINRA RN 24-09, SEC 17a-4, SOX 302/404, GLBA 501(b), OCC Bulletin 2026-13 (formerly OCC 2011-12), Fed SR 26-2 (formerly SR 11-7), CFTC 1.31<br>
**Last UI Verified:** April 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated<br>

---

!!! info "Agent 365 Architecture Update"
    Agent 365 Observability consolidates agent activity logs from all platforms into Application Insights using the OpenTelemetry standard. This simplifies eDiscovery, regulatory reporting, and examination evidence collection by providing a unified audit trail. See [Unified Agent Governance](../../framework/agent-identity-architecture.md) for observability architecture and audit trail consolidation details.

## Objective

Implement comprehensive audit logging to capture Microsoft 365 Copilot and Microsoft Copilot Studio agent interactions, providing an evidence trail for regulatory examinations, security investigations, and compliance monitoring. For broker-dealers, this includes guidance supporting SEC 17a-4(f) compliance through either WORM storage or the audit-trail alternative (per October 2022 amendments, compliance date May 2023).

---

## Why This Matters for FSI

- **FINRA 4511:** Requires retention of books and records per regulatory timelines. The FINRA 2026 Annual Regulatory Oversight Report emphasizes that firms must retain not just agent outputs but also prompts, model state, and reasoning chains to enable reconstruction of how the agent reached its conclusion. Audit logs alone capture metadata; verbatim content retention requires eDiscovery / Communication Compliance / DSPM for AI in addition.
- **SEC 17a-4(b)(4):** Communications records require 3-year retention (first 2 years readily accessible). Agent conversation logs typically qualify as communications.
- **SEC 17a-4(a):** Financial / accounting records require 6-year retention.
- **SEC 17a-4(f):** October 2022 amendments (compliance date May 3, 2023) allow either WORM storage or an audit-trail alternative for records preservation.
- **SEC 17a-3:** Record creation requirements — distinct from 17a-4 preservation. Audit logs help evidence the *creation* events for required books and records.
- **SOX 302/404:** Internal controls over AI system logging require audit trails sufficient to support management certification.
- **GLBA 501(b):** Security safeguards including audit trails for non-public personal information access.
- **OCC Bulletin 2026-13 (formerly OCC Bulletin 2011-12) / Fed SR 26-2 (formerly SR 11-7):** Model risk management — model identity, version, and use must be auditable. For Microsoft 365 Copilot, audit captures `ModelProviderName` only; full model identification requires the model-card store referenced in Control 2.16.
- **CFTC 1.31:** 5-year retention of regulatory records (including AI-generated communications) for FCMs, swap dealers, and CPOs in tamper-evident format with complete metadata.

!!! info "Updated February 2026"
    FINRA 2026 examination priorities include validation that AI agent logs support complete decision reconstruction, not just output capture.

!!! warning "Agent Logs Are Typically Communications"
    Agent conversation logs (prompts, responses, interactions) typically qualify as **communications** under SEC 17a-4(b)(4), requiring 3-year retention, not the 6-year financial records period. If agent interactions generate or modify financial records, those outputs follow the applicable 6-year period.

---

!!! tip "Automation Available"
    Companion solutions in [FSI-AgentGov-Solutions](https://github.com/judeper/FSI-AgentGov-Solutions):

    - [Deny Event Correlation Report](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/deny-event-correlation-report) — daily deny event correlation across Purview Audit, DLP, and Application Insights
    - [FINRA Supervision Workflow](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/finra-supervision-workflow) — automated supervision queue for AI agent outputs supporting FINRA Rule 3110 compliance
    - [RAG Source Validator](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/rag-source-validator) — integrity validation for RAG knowledge sources with change detection
    - [Audit Compliance Manager](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/audit-compliance-manager) — automated validation, drift detection, and remediation of audit configurations


## Control Description

Microsoft Purview Audit provides the activity-capture foundation for Copilot and agent recordkeeping, but Control 1.7 governs the broader architecture required to capture, retrieve, and preserve those records for FSI obligations. The sections below distinguish capture in Microsoft 365 Audit from content retrieval tooling and the separate preservation layer that should follow the applicable record-class retention schedule.

!!! danger "Capture vs Preservation — read first"
    Control 1.7 governs the capture, search, export, and preservation architecture for Copilot and agent records. Retention should be set by record class, not by a blanket zone default: use 3 years for communications records under SEC Rule 17a-4(b)(4), 6 years for financial/accounting or governance records under SEC Rule 17a-4(a) and FINRA Rule 4511(b), 5 years for CFTC Rule 1.31 records, and longer periods only when a specific rule or the firm's records schedule requires it. Microsoft 365 Audit, including the 10-Year Audit Log Retention add-on, extends the capture window but is not, by itself, the SEC Rule 17a-4(f) preservation layer. For broker-dealers, preservation requires one documented path: Azure immutable blob storage with a locked time-based policy, a 17a-4-attested archive vendor, or the post-October 2022 audit-trail alternative with DEO/DTP documentation and an annual independent records-management assessment.

| Capability | Description |
|------------|-------------|
| Unified audit log | Single log for all M365 activities including Copilot |
| Agent activity logging | Captures agent creation, publishing, modification, and interactions |
| Extended retention | Up to 10 years with Audit (Premium) plus the 10-year audit log retention add-on license |
| Search and export | Advanced query and export for investigations |
| SIEM integration | Export to Sentinel or third-party SIEM |

!!! warning "Non-user entity audit records have a fixed 1-year retention cap"
    Per [Microsoft Purview Audit overview](https://learn.microsoft.com/en-us/purview/audit-solutions-overview), audit records generated by **non-user entities** — service principal actions, system events, and application activities (including agent service-principal sign-ins, agent runtime telemetry events, and SPN-initiated Dataverse writes) — are retained for a **fixed period of one year**. This retention period **is not configurable**, and custom audit log retention policies (including the per-user 10-Year Audit Log Retention add-on) **do not apply** to these records. For FSI scenarios requiring multi-year retention of SPN/agent activity (e.g., FINRA Rule 4511's 6-year recordkeeping for financial records executed by agent service principals, or SOX 404 ICFR evidence of automated control activity), pair Microsoft Audit with **SIEM/SOAR export to immutable storage** (Sentinel + Log Analytics with long-term retention, Defender XDR streaming API to S3/Blob WORM, or equivalent) within the 1-year native-retention window — do **not** rely on the Audit (Premium) retention policy to extend SPN records.

### AI-Generated Communication Tagging (Per FINRA RN 24-09 + Rule 3110)

!!! info "FINRA RN 24-09 / Rule 3110 Citation"
    FINRA Regulatory Notice 24-09 (Generative AI guidance, June 2024) and FINRA Rule 3110 (Supervision) establish supervisory and recordkeeping expectations for AI-generated communications. (FINRA RN 25-07, sometimes mis-cited in this context, addresses workplace modernization rules, not AI governance — see `framework/regulatory-framework.md` for the canonical clarification.) Audit logging supports these expectations by distinguishing AI-generated communications from human-generated content in the records pipeline.

The RFC addresses recordkeeping requirements for AI-generated communications, proposing that firms distinguish AI-generated communications from human-generated content in their records. Audit logging supports this by:

| Requirement | Implementation |
|-------------|----------------|
| **AI Origin Tagging** | CopilotInteraction events contain `ApplicationId` identifying Copilot/agent source |
| **Prompt/Response Metadata** | Audit captures interaction metadata only (message IDs, timestamps, AgentId, model provider, detection flags). For verbatim prompt/response *content* retention, pair audit with eDiscovery (Control 1.19), DSPM for AI (Control 1.6), Communication Compliance (Control 1.10), and the Microsoft 365 Substrate / Copilot interactions mailbox. The unified audit log alone does **not** preserve full prompt and response text. |
| **Human vs AI Attribution** | Audit logs distinguish `UserId` (human initiator) from `AgentId` (AI responder) |
| **Modification Tracking** | If human edits AI output before sending, both versions should be retained via eDiscovery / Comm Compliance, not audit alone |

**Audit Event Types (`RecordType` values in the `OfficeActivity` table — verify against the live [AuditLogRecordType enumeration](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema) before authoring queries):**

- `CopilotInteraction` — M365 Copilot interactions
- `ConnectedAIAppInteraction` — Connected AI app interactions. Coverage is **mixed**: per Microsoft Learn (April 2026), Microsoft-built Copilot Studio agents and other Microsoft AI applications are included in Audit (Standard) at no incremental cost, while **some** scenarios under this RecordType — specifically interactions with non-Microsoft AI apps surfaced via Connected AI App — fall under [Audit pay-as-you-go (PAYG) billing](https://learn.microsoft.com/en-us/purview/purview-billing-models) and must be explicitly enabled. Verify scope per workload before assuming default coverage.
- `AIAppInteraction` — Non-Microsoft AI assistance events captured via network/browser DLP under the `AIApp` workload. **PAYG-only**; explicit enablement required; 180-day retention for PAYG-captured records.
- `MicrosoftCopilotStudio` — Copilot Studio admin / agent lifecycle activity
- `PowerPlatformAdminEnvironment`, `PowerPlatformAdministratorActivity`, `MicrosoftFlow`, `PowerAppsApp` — Power Platform admin and runtime telemetry

!!! danger "`PowerPlatformAdminActivity` is NOT a valid RecordType"
    Earlier drafts of FSI playbooks used `-RecordType PowerPlatformAdminActivity`; that name is **not** in the `AuditLogRecordType` enumeration. Some Exchange Online module versions silently return zero rows for invalid RecordType values, producing **false-clean evidence**. Use the names listed above and verify them at runtime via `[Enum]::GetNames([Microsoft.Office.CompliancePolicy.PSCmdlets.AuditRecordType])`.

**Agent-Specific Audit Properties (CopilotInteraction schema — verify nesting before writing KQL):**

| Property | Schema location | Description | Use Case |
|----------|-----------------|-------------|----------|
| `AgentId` | Top-level | Prefixed identifier (`CopilotStudio.Declarative.{guid}` or `CopilotStudio.CustomEngine.{guid}`); the prefix distinguishes declarative vs custom-engine agents | Agent-level activity correlation, FINRA 3110 supervisory segmentation |
| `AgentName` | Top-level | Display name of the agent | Human-readable identification |
| `AgentVersion` | Top-level | Version at interaction time | Change tracking and regression analysis |
| `Messages[].JailbreakDetected` | **Nested inside the `Messages` array** — per individual message, not per interaction | Boolean flag if jailbreak attempt detected on that message | Security monitoring; query as `Messages[].JailbreakDetected`, not as a top-level property |
| `AccessedResources[].XPIADetected` | **Nested inside the `AccessedResources` array** — per resource, not per interaction. XPIA = "Cross Prompt Injection Attack" (per Microsoft Learn — not "cross-domain") | Boolean flag if a referenced resource attempted prompt injection | Security monitoring; query as `AccessedResources[].XPIADetected` |
| `ModelTransparencyDetails.ModelProviderName` | Nested under `ModelTransparencyDetails` | Provider name (e.g., `OpenAI`, `AzureOpenAI`) | Model attribution |
| `ModelTransparencyDetails.ModelName` / `ModelVersion` | Nested under `ModelTransparencyDetails` | **Not available in Microsoft 365 Copilot scenarios** per Learn — only `ModelProviderName` is populated for M365 Copilot. Available for Copilot Studio custom-engine agents. | Bank examiner Fed SR 26-2 (formerly SR 11-7) model inventories cannot be satisfied by audit logs alone for M365 Copilot — supplement with the model-card store in Control 2.16 |

!!! warning "Audit Record vs Conversation Content — Where the Text Actually Lives"
    The `CopilotInteraction` audit **record** carries interaction metadata: timestamps, `UserId`, `AgentId`, accessed-resource references, model provider, detection flags (`JailbreakDetected`, `XPIADetected`), and `Messages[]` entries containing message IDs (`Messages[].ID`) and `IsPrompt` booleans — **not** the prompt or response body.

    The prompt and response **text** for Microsoft 365 Copilot interactions is preserved in the Microsoft 365 Substrate (the per-user Copilot interaction history mailbox, surfaced to compliance tooling via the Substrate). Per the April 2026 [Microsoft Learn: Audit logs for Copilot and AI activities](https://learn.microsoft.com/en-us/purview/audit-copilot) page, that content is retrievable through:

    - **DSPM for AI** (Control 1.6) — Compliance managers can view chat transcripts for `CopilotInteraction` events directly from the DSPM for AI experience.
    - **eDiscovery (Premium)** (Control 1.19) — Legal hold, collection, and review of Copilot interactions across custodians.
    - **Communication Compliance** (Control 1.10) — Policy-based supervisory review of AI-generated communications (FINRA Rule 3110 alignment).

    Compliance design implication: the audit log is the **evidence trail and join key**; the Substrate (via DSPM / eDiscovery / Comm Compliance) is the **content store**. A 17a-4(b)(4) communications retention program for Copilot must address both, and (for broker-dealers) export/journal the content tier into the firm's 17a-4(f) preservation layer.
    The CopilotInteraction audit schema captures **interaction metadata** (message IDs, timestamps, model info, detection flags, accessed resources), not the actual prompt and response text. To retrieve full conversation content, use:

    - **eDiscovery tools** (Control 1.19) - For legal hold and investigation
    - **DSPM for AI** (Control 1.6) - For data security monitoring and content review
    - **Communication Compliance** (Control 1.10) - For policy-based content review

    This distinction is critical for compliance design: audit logs provide the evidence trail; eDiscovery/DSPM provides content retrieval.

!!! note "Querying AI Audit Events"
    These are **RecordType** values, not table names. Query via the `OfficeActivity` table
    in Log Analytics or use `Search-UnifiedAuditLog` PowerShell cmdlet with the
    `-RecordType` parameter.

---

## Key Configuration Points

### Tenant-Level Audit Configuration

- Enable unified audit logging at tenant level
- Configure retention policies and preservation procedures to the firm's record-class schedule (3 years for communications, 6 years for financial/accounting or governance records, 5 years for CFTC Rule 1.31 records, and longer only where a specific rule or the firm's records schedule requires it); use the 10-Year Audit Log Retention add-on only when the firm intentionally extends the capture window beyond 1 year
- Search for agent-related activities: CopilotInteraction, AgentPublished, ConnectorAdded
- Export logs regularly for WORM storage (broker-dealers)
- Integrate with SIEM for real-time monitoring (Zone 2-3)
- Retain complete prompt/response pairs per FINRA RN 24-09 / Rule 3110 supervisory expectations (no summaries)
- Implement adversarial pattern detection in audit log analysis

!!! warning "Dataverse Purview Audit Event Changes — May 2026"
    Starting May 2026, Dataverse will no longer include before-and-after field change values in audit events sent to Microsoft Purview. Organizations requiring detailed field-level change data for regulatory recordkeeping should retrieve this data directly from Dataverse APIs.

    This change may affect SEC 17a-4 / FINRA 4511 compliance programs that rely on Purview audit integration for Dataverse field-level change records. Organizations should begin transitioning to Dataverse API-based audit retrieval before May 2026.

    See [Regulatory Mappings](../../reference/regulatory-mappings.md) for detailed regulatory impact on recordkeeping requirements.

### Dataverse Environment-Level Audit Configuration

- **Enable environment-level auditing:** In Power Platform Admin Center, select each environment > Settings > Audit and logs > enable "Start Auditing" to capture Dataverse entity changes, user sign-ins, and security events
- **Configure audit log retention period:** In PPAC > Environment > Settings > Audit and logs > Audit settings > set "Retain these logs for" to a minimum of 180 days (Zone 1), 365 days (Zone 2), or 730+ days (Zone 3). Select "Custom" for specific day counts or "Forever" for indefinite retention
- **Enable tenant-level Dataverse auditing policy:** In PPAC > Security > Compliance > Auditing > enable "Turn on Auditing" and additionally enable "User Sign-In" and "Activity" checkboxes to capture sign-in events and entity-level activity across all Dataverse environments

### Agent Sign-In and Activity Audit Logs (Preview)

!!! info "Preview Feature"
    The `agentSignIn` resource type and `MicrosoftServicePrincipalSignInLogs` diagnostic stream are currently in preview. Configuration and field names may change before general availability. Verify availability against your tenant's Entra Admin Center surface — at the time of writing, Microsoft Learn does not document a Frontier-program gate on `agentSignIn`; treat any "Frontier required" claim in third-party documentation as unverified until confirmed in your tenant.

#### agentSignIn Resource Type (Preview)

The `agentSignIn` resource type is a category within Entra sign-in logs dedicated to authentication events performed by AI agent identities. This is the source for attributing authenticated actions to a specific agent identity during audit investigations.

!!! warning "Verify the Entra sign-in filter against the live UI"
    Earlier drafts referenced an `Is Agent = Yes` filter chip on the Sign-in logs page. As of the April 2026 verification window, the published Entra sign-in logs UI exposes four sign-in *types* (Interactive user / Non-interactive user / Service principal / Managed identity) plus a separate Agent activity log entry on the Monitoring & health page. **Verify the actual filter affordance in your tenant before documenting it in tenant-specific runbooks.**

| Property | Value |
|---|---|
| Log resource type | `agentSignIn` |
| Event scope | Authentication events performed by a registered AI agent identity |
| Primary FSI use | Attributing agent-initiated actions to a specific agent identity in audit investigations and evidence packages |
| Availability | Preview |

Every Zone 2 and Zone 3 agent authentication event should be captured in this log and forwarded to the SIEM or Log Analytics workspace with retention aligned to applicable regulatory minimums.

#### Sign-In Attributes Relevant to Agent Correlation

The following Entra sign-in log fields support agent-specific audit correlation. **`AppOwnerTenantId`, `ResourceOwnerTenantId`, `SessionId`, and `ASN` are long-standing fields in the Entra sign-in log schema** (present on every user, service principal, and managed identity sign-in for years) — they are not agent-specific or new. Confirm with your SIEM team that they are already in the ingestion schema before adding new mappings.

| Attribute | Status | Purpose | FSI Use Case |
|---|---|---|---|
| `AppOwnerTenantId` | Long-standing field | Tenant that owns the agent application | Cross-tenant agent attribution |
| `ResourceOwnerTenantId` | Long-standing field | Tenant that owns the resource being accessed | Data residency verification |
| `SessionId` | Long-standing field | Correlates events within a single agent execution session | Session-level audit reconstruction |
| `SourceAppClientID` | Newer in agent on-behalf-of (OBO) context | Originating application that initiated the agent action | Agent identity chain mapping |
| `ASN` | Long-standing field | Autonomous system number for the originating network | Geolocation and routing audit review |

!!! warning "Include agent correlation attributes in SIEM ingestion schema"
    If the SIEM or Log Analytics workspace uses a custom ingestion schema or field mapping, verify that `AppOwnerTenantId`, `ResourceOwnerTenantId`, `SessionID`, `SourceAppClientID`, and `ASN` are included in the ingested field set. These fields are required for agent-specific alert rules and investigation queries.

#### MicrosoftServicePrincipalSignInLogs (Preview)

`MicrosoftServicePrincipalSignInLogs` is an opt-in diagnostic log stream that captures first-party Microsoft service-to-service token requests, including interactions such as Teams requesting resources from Word, Copilot requesting agent APIs, and M365 service orchestration calls.

!!! warning "High-volume stream - review before enabling"
    This log stream can generate significantly higher event volume than standard sign-in logs. Enable it only after assessing ingestion-cost impact on the Log Analytics workspace and SIEM.

**Enable Path:**

```text
Microsoft Entra admin center
  > Monitoring & health
    > Diagnostic settings
      > Add diagnostic setting
        > Check: MicrosoftServicePrincipalSignInLogs
        > Destination: Log Analytics workspace / Storage account / Event Hub
```

| Property | Value |
|---|---|
| Stream name | `MicrosoftServicePrincipalSignInLogs` |
| Activation model | Opt-in; not enabled by default |
| Availability | Preview |
| Recommended for | Tenants with complex M365 service orchestration or regulated Zone 3 agent workloads |

#### Agent Log Coverage Checklist

| Configuration Item | Zone Applicability | Status Field |
|---|---|---|
| `agentSignIn` log type enabled and forwarded to SIEM | Zone 2, Zone 3 | [ ] |
| Entra sign-in log filter affordance for agent identities verified in tenant UI (filter chip naming has shifted across recent UI revisions — confirm the live label before adding it to a runbook) | Zone 2, Zone 3 | [ ] |
| `AppOwnerTenantId` field included in SIEM ingestion schema | Zone 2, Zone 3 | [ ] |
| `ResourceOwnerTenantId` field included in SIEM ingestion schema | Zone 2, Zone 3 | [ ] |
| `SessionID` field included in SIEM ingestion schema | Zone 2, Zone 3 | [ ] |
| `SourceAppClientID` field included in SIEM ingestion schema | Zone 2, Zone 3 | [ ] |
| `ASN` field included in SIEM ingestion schema | Zone 3 | [ ] |
| `MicrosoftServicePrincipalSignInLogs` evaluated for activation | Zone 3 | [ ] |
| Agent sign-in log retention policy set to the approved minimum | Zone 2, Zone 3 | [ ] |

!!! info
    For implementation guidance on combining these log types with custom telemetry correlation, see **Control 3.14 - Agent 365 Observability SDK and Custom Agent Telemetry**.

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Baseline logging; 180-day retention; monthly review | Low risk, standard coverage |
| **Zone 2** (Team) | 1+ year retention; weekly review; SIEM recommended | Shared agents require accountability |
| **Zone 3** (Enterprise) | Record-type-based retention and preservation: use 3 years for communications records, 6 years for financial/accounting or governance records, 5 years for CFTC Rule 1.31 records, and longer only where a specific rule or the firm's records schedule requires it; if the firm extends the Audit capture window beyond 1 year, assign the per-user 10-Year Audit Log Retention add-on only to users in that documented over-retention scope (note this add-on **does not apply to service-principal / system / application audit records, which are capped at 1 year by Microsoft and require SIEM long-term-retention export to meet >1-year FSI record-keeping obligations for SPN-initiated activity** — see the non-user-entity admonition above); daily review; WORM storage or audit-trail alternative for broker-dealer environments per SEC 17a-4(f); SIEM required | Highest regulatory risk; per-user license alignment is mandatory for any documented 10-year capture-window extension, and preservation still requires a separate 17a-4(f) path |

---

## Roles & Responsibilities

| Role | Responsibility |
|------|----------------|
| Purview Audit Admin | Configure unified audit logging; enable PAYG record types where applicable |
| Purview Compliance Admin | Search audit logs for examinations; export evidence to immutable storage |
| Organization Configuration role (Exchange Online) | Author audit retention policies (per Microsoft Learn — `Compliance Admin` alone is **not** sufficient for retention policy create/modify) |
| SOC Analyst | SIEM integration, Sentinel rule authoring, daily review |
| Entra Security Admin | Configure `agentSignIn` log forwarding and diagnostic settings |
| Power Platform Admin | Configure Dataverse environment audit settings and per-table audit on the Copilot Studio entities |
| Azure Storage Account Owner / Contributor | Configure Azure immutable blob storage container and time-based retention policy (if WORM export used) |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [1.6 - DSPM for AI](1.6-microsoft-purview-dspm-for-ai.md) | AI interaction visibility |
| [1.19 - eDiscovery](1.19-ediscovery-for-agent-interactions.md) | Legal discovery |
| [3.2 - Usage Analytics](../pillar-3-reporting/3.2-usage-analytics-and-activity-monitoring.md) | Activity monitoring |
| [3.9 - Sentinel Integration](../pillar-3-reporting/3.9-microsoft-sentinel-integration.md) | SIEM integration |
| [3.14 - Agent 365 Observability SDK](../pillar-3-reporting/3.14-agent-365-observability-sdk.md) | Extends Entra audit logging with custom agent telemetry and session correlation |
| [Windows 365 for Agents reference](../../reference/windows-365-for-agents.md) | Cloud PC audit evidence for agent execution sessions supplements Purview Audit and Agent 365 audit correlation. |

!!! tip "Automated Validation: Deny Event Correlation Report"
    For daily operational reports correlating deny events across Purview Audit, DLP, and Application Insights with anomaly detection and zone-based alerting, see the **Deny Event Correlation Report** solution.

    **Capabilities:**

    - Multi-source deny event extraction (RAI telemetry, Purview Audit, Purview DLP)
    - Daily correlation engine with 7-day trend analysis and volume anomaly detection
    - Zone-based alerting with Teams adaptive cards and email notifications
    - Dataverse persistence with zone-based retention (90d/365d/730d)
    - SHA-256 integrity-hashed evidence export with regulatory alignment mapping

    **Deployable Solution:** [deny-event-correlation-report](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/deny-event-correlation-report) provides PowerShell extraction scripts, Dataverse infrastructure, Power Automate orchestration flow, and evidence export pipeline.

!!! tip "Automated Validation and Remediation: Audit Compliance Manager"
    For automated validation of tenant and environment audit configurations, drift detection, and approval-gated remediation of audit logging gaps, see the **Audit Compliance Manager (ACM)** solution.

    **Capabilities:**

    - Tenant-level audit validation (Unified Audit Log, mailbox audit, Purview retention)
    - Environment-level audit validation (Power Platform audit retention)
    - Zone-based retention thresholds (180d/365d/730d)
    - Daily scheduled validation with drift detection and SHA-256 evidence hashing
    - Automated detection of Purview unified audit and Dataverse audit status across all environments
    - Remediation with org-level and entity-level Dataverse audit enablement (6 Copilot Studio entities)
    - WhatIf simulation for safe remediation dry runs
    - Power Automate approval workflow for governance-gated remediation
    - Compliance tracking via Dataverse upsert pattern (one record per environment)
    - Enterprise-grade Managed Identity authentication

    **Deployable Solution:** [audit-compliance-manager](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/audit-compliance-manager) provides PowerShell validation scripts, Azure Automation runbooks with Managed Identity auth, Dataverse compliance tracking, Power Automate flows for validation and approval-gated remediation, and evidence export pipeline.

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/1.7/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/1.7/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/1.7/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/1.7/troubleshooting.md) — Common issues and resolutions

!!! tip "Advanced Implementation: Configuration Hardening Baseline"

    This control is covered by the [Configuration Hardening Baseline](../../playbooks/advanced-implementations/configuration-hardening-baseline/index.md), which consolidates SSPM-detectable settings across all 7 mapped controls into a single reviewable checklist with automation classification and evidence export procedures.

---

## Verification Criteria

Confirm control effectiveness by verifying:

1. Unified audit logging is enabled — run `Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled` from **Exchange Online PowerShell** (not Security & Compliance PowerShell, which always returns `False` per Microsoft Learn) and confirm the value is `True`
2. Audit (Premium) license entitlement is verified for every Copilot user — without an E5 / Microsoft 365 E5 / Microsoft Purview Suite / E5 eDiscovery & Audit add-on assigned to the user generating the event, retention silently falls back to 180 days regardless of policy
3. If the firm extends the Audit capture window beyond 1 year, the **per-user 10-Year Audit Log Retention add-on** is assigned to every Copilot user in that documented over-retention scope
4. Copilot and agent record types appear in audit search results (`CopilotInteraction`, `ConnectedAIAppInteraction`, `MicrosoftCopilotStudio`); `AIAppInteraction` is enabled via PAYG if non-Microsoft AI apps are in scope
5. Custom audit retention policies explicitly include the Copilot record types — the **default Audit (Premium) retention policy covers only `AzureActiveDirectory`, `Exchange`, `OneDrive`, and `SharePoint`**; Copilot record types fall back to 180 days unless a custom policy names them
6. Retention policies and preservation procedures follow the record-type schedule: 3 years for communications under SEC Rule 17a-4(b)(4), 6 years for financial/accounting or governance records under SEC Rule 17a-4(a) and FINRA Rule 4511(b), 5 years for CFTC Rule 1.31 records, and longer only where a specific rule or the firm's records schedule requires it; use the 10-Year Audit Log Retention add-on only as a documented capture-window extension where the firm chooses over-retention because Microsoft 365 Audit has no native 3-year/5-year/6-year tier
7. Export capability produces complete audit records using `Search-UnifiedAuditLog -SessionCommand ReturnLargeSet -SessionId <guid>` paginated to completion (single-shot `-ResultSize` truncates silently)
8. SIEM integration is functional with documented end-to-end ingestion latency (no fabricated SLA)
9. WORM storage or audit-trail alternative is configured for broker-dealer environments per SEC 17a-4(f) (October 2022 amendments, compliance date May 3, 2023)
10. Dataverse environment-level auditing is enabled (PPAC > Environment > Audit and logs > "Start Auditing") for all environments
11. Per-table Dataverse audit is enabled for the six Copilot Studio entities (`bot`, `botcomponent`, `botcomponentcollection`, etc.) so agent admin events surface in `ConnectedAIAppInteraction`
12. Audit log retention is set to a minimum of 180 days per environment (PPAC > Environment > Audit settings > "Retain these logs for")
13. `agentSignIn` logging is enabled or validated as available for Zone 2 and Zone 3 agent identities
14. The agent-correlation sign-in fields are confirmed present in the SIEM ingestion schema (note: `AppOwnerTenantId`, `ResourceOwnerTenantId`, `SessionId`, `ASN` are long-standing fields and likely already mapped — only `SourceAppClientID` is reliably newer in the agent OBO context)
15. `MicrosoftServicePrincipalSignInLogs` has been evaluated and documented for Zone 3 workloads
16. Evidence-pack capture procedure produces named, hashed, immutable artifacts per the verification-testing playbook

---

## Additional Resources

**Regulatory Guidance:**

- [FINRA 2026 Annual Regulatory Oversight Report](https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report) — Audit trail requirements for AI agents (December 2025)
- [SEC Rule 17a-4 (2022 Amendments)](https://www.sec.gov/rules-regulations/2022/10/electronic-recordkeeping-requirements-broker-dealers-security-based-swap-dealers-major-security) — Broker-dealer recordkeeping requirements including audit-trail alternative

**Microsoft Documentation:**

- [Microsoft Learn: Microsoft Purview Audit Solutions](https://learn.microsoft.com/en-us/purview/audit-solutions-overview)
- [Microsoft Learn: Search the Audit Log](https://learn.microsoft.com/en-us/purview/audit-search)
- [Microsoft Learn: Audit Log Retention Policies](https://learn.microsoft.com/en-us/purview/audit-log-retention-policies)
- [Microsoft Learn: Azure Immutable Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview)
- [Microsoft Learn: Office 365 Management Activity API](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference)

### Microsoft Audit Reporting Tools

For enterprise-scale audit data export beyond native portal limits, see:

- [Microsoft Audit Reporting Tools Playbook](../../playbooks/advanced-implementations/microsoft-audit-reporting-tools.md) - PAX (Portable Audit eXporter) for large-scale audit extraction and AI-in-One Dashboard for adoption analytics

### Environment Provisioning Audit Trail

For immutable audit logging of environment provisioning activities:

- [Environment Lifecycle Management](../../playbooks/advanced-implementations/environment-lifecycle-management/index.md) - ProvisioningLog provides complete audit trail of environment creation with Service Principal attribution

### Agent 365 Audit Events (Preview)

> **Note:** The following resources are preview documentation and may change.

Agent 365 SDK introduces additional audit event types for Blueprint-registered agents:

| Event Type | Description | Logged When |
|------------|-------------|-------------|
| **BlueprintRegistration** | Agent registered via Blueprint process | Agent manifest submitted for registration |
| **BlueprintPromotion** | Agent promoted between lifecycle phases | Design→Build, Build→Deploy transitions |
| **BlueprintDemotion** | Agent demoted to previous phase | Rollback or compliance failure |
| **AgentIdentityCreated** | New Agent ID created in Entra | First-time agent identity provisioning |
| **AgentIdentityModified** | Agent identity permissions changed | Permission scope updates |
| **AgentIdentityDeleted** | Agent identity removed from Entra | Agent decommissioning |
| **ObservabilityConfigured** | Observability SDK settings modified | Telemetry configuration changes |

**Querying Agent 365 Events:**

```kql
OfficeActivity
| where TimeGenerated > ago(7d)
| where RecordType in ("ConnectedAIAppInteraction", "CopilotInteraction")
| extend agentType = tostring(parse_json(AuditData).ApplicationType)
| where agentType == "Agent365Blueprint"
| project TimeGenerated, UserId, Operation, AuditData
```

See [Microsoft Learn: Agent 365 SDK (Preview)](https://learn.microsoft.com/en-us/microsoft-agent-365/developer/) for evolving audit capabilities.

### Observability by Agent Type

**(A) Copilot Studio Agents:**

- Power Platform Admin Center analytics
- Managed Environment insights
- Microsoft Purview Audit logs

**(B) Agent 365 SDK Agents (Preview):**

- OpenTelemetry SDK integration
- Application Insights workbooks
- Custom telemetry configuration

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current*
