# Control 1.1: Restrict Agent Publishing by Authorization

**Control ID:** 1.1<br>
**Pillar:** Security<br>
**Regulatory Reference:** FINRA 4511(a), FINRA 3110(a)/(b), FINRA RN 24-09, SEC Rule 17a-4(a), SEC Rule 17a-4(b)(4), SEC Rule 17a-4(f), GLBA Safeguards Rule 16 CFR §314.4(c), SOX §404 (ICFR), OCC Bulletin 2023-17, OCC Bulletin 2026-13 (formerly OCC 2011-12), Fed SR 26-2 (formerly SR 11-7)<br>
**Last UI Verified:** April 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated

---

## Objective

Restrict who can publish AI agents to production environments by implementing security group-based authorization, separation of duties, and formal approval workflows.

---

## Why This Matters for FSI

- **FINRA 4511(a) — Books and Records:** Records of who created, modified, and published each agent must be preserved. Publishing-authorization controls produce the maker/publisher provenance that supports those records.
- **FINRA 3110(a)/(b) — Supervision:** Supervisory systems must designate who may deploy AI capabilities and demonstrate enforcement. Restricting publishing to a defined `Publishers` group, with logged approvals, supports this.
- **FINRA RN 24-09 / Rule 3110**: Establishes explicit expectations for AI supervision. Implementing publishing restrictions supports the firm's supervisory framework for AI deployment.
- **SEC Rules 17a-4(a), 17a-4(b)(4), and 17a-4(f) — Records Retention and Preservation:** Publish events, approval records, publisher-membership snapshots, and related change-ticket evidence must be retained according to the firm's record schedule. For most agent communications, the base preservation period is 3 years under SEC Rule 17a-4(b)(4); records that constitute financial or accounting records, supervisory/governance evidence, or other regulated books and records may require 6 years or longer under SEC Rule 17a-4(a), FINRA Rule 4511(b), or other applicable rules. Microsoft Purview Audit is the capture layer for publishing telemetry. Firms subject to SEC Rule 17a-4(f) should use the preservation architecture defined in Control 1.7 rather than treating Audit retention alone as the preservation layer.
- **GLBA Safeguards Rule 16 CFR §314.4(c)(1) — Access Controls:** Limiting who can deploy agents that may handle customer NPI is an access-control safeguard.
- **SOX §404 — Internal Controls over Financial Reporting:** Agents that touch financial data, reporting workflows, or material disclosures fall in ICFR scope. Restricting publishing supports SoD.
- **OCC Bulletin 2023-17 — Third-Party Risk:** Documented governance over third-party AI platform usage, including who can deploy.
- **OCC Bulletin 2026-13 (formerly OCC 2011-12) and Fed SR 26-2 (formerly SR 11-7) — Model Risk Management:** Generative-AI agents are models; SR 26-2 requires controlled deployment, validation, and inventory under joint OCC and Federal Reserve model-risk supervision.
- **NIST SP 800-53 AC-2 / AC-3 / AC-6:** Account management, access enforcement, least privilege.
- **NIST AI RMF 1.0 (GOVERN-1.5, GOVERN-3.2):** Documented authorization controls and accountability for AI deployment.

> **Implementation note:** No single control "guarantees compliance." This control supports the above obligations when paired with [Control 1.7 - Comprehensive Audit Logging](1.7-comprehensive-audit-logging-and-compliance.md), [Control 1.9 - Data Retention and Deletion Policies](1.9-data-retention-and-deletion-policies.md), evidence-preservation/reporting controls (3.x), and incident-response procedures. Firms must validate that their specific examination posture is met.

---

!!! info "No companion solution by design"
    Not all controls have a companion solution in [FSI-AgentGov-Solutions](https://github.com/judeper/FSI-AgentGov-Solutions); solution mapping is selective by design. This control is operated via native Microsoft admin surfaces and verified by the framework's assessment-engine collectors. See the [Solutions Index](../../reference/solutions-index.md#coverage-scope) for the catalog and coverage scope.

!!! warning "Prerequisites & Licensing"
    Implementing this control end-to-end requires the following — verify each before starting, or expect partial enforcement:

    | Prerequisite | Why | Where to verify |
    |---|---|---|
    | **Microsoft Entra ID P1** (or higher) | Required for dynamic security groups used in maker/publisher gating | M365 Admin Center > Billing > Licenses |
    | **Power Platform Managed Environments** add-on | Required for sharing limits and "Solution checker" governance signals on the maker environment | PPAC > Environments > [env] (look for "Managed" badge) |
    | **Microsoft Copilot Studio** license (per-user or per-tenant) | Required for any agent publishing surface beyond M365 Agent Builder | M365 Admin Center > Billing |
    | **Microsoft Purview Audit (Standard)** | Captures `BotUpdateOperation-BotPublish` events; default 180-day retention | Purview portal > Audit |
    | **Microsoft Purview Audit (Premium)** + **custom retention policy** | Required for >180-day retention. Premium alone gives 1 year by default; **7–10 year retention requires an explicit Audit Retention Policy** | Purview portal > Audit > Audit retention policies |
    | **AI Administrator** role (added Mar 2025, MC1041454) | Preferred least-privilege role for agent governance — use instead of Global Administrator | Entra > Roles & administrators |
    | **Sovereign cloud (GCC / GCC-High / DoD)** awareness | PowerShell automation must explicitly target sovereign endpoints (`-Endpoint usgov`, `usgovhigh`, `dod`) — commercial defaults silently return 0 environments | See PowerShell Setup playbook |


## Control Description

This control establishes authorization controls over who can create and publish AI agents in Microsoft 365 and Power Platform. Microsoft provides native governance controls for agent authoring and publishing — including environment access, security roles, data policies, Managed Environments, and Microsoft 365 admin-center agent controls — but there is no single tenant-wide switch that covers every agent-creation surface. The governance strategy therefore combines preventive controls with containment and approval workflows:

1. **Block Publishing** - DLP policies block channel connectors
2. **Restrict Sharing** - Disable "Share with Everyone" capability
3. **Route Away** - Environment routing directs makers to governed environments

The control implements a "Sterile Default Environment Strategy" where the Default environment has all publishing channels blocked via DLP, combined with security group-based access control for designated maker environments.

---

## Key Configuration Points

### Maker Authorization

- Create security groups: `FSI-Agent-Makers-*`, `FSI-Agent-Publishers-Prod`, `FSI-Agent-Approvers-Compliance`
- Remove Environment Maker role from "All Users" in each environment
- Assign Environment Maker only to authorized security groups
- Restrict Copilot Studio agent creation to specific security groups (controls who can author agents)
- Configure agent sharing settings to control who can use published agents
- Configure Managed Environment sharing limits
- Implement release gates with approval workflows for production publishing

### M365 Admin Center Agent Governance Actions (GA)

The Microsoft 365 Admin Center provides comprehensive agent lifecycle management at **Copilot** > **Agents & connectors** > **Agents**:

| Action | Description | Governance Impact |
|--------|-------------|-------------------|
| **Publish** | Admin approval required before agents become available | Helps prevent unauthorized agent distribution |
| **Activate** | Enable agent with governance template application | Applies organizational standards at activation |
| **Deploy** | Auto-install agents for targeted user groups | Controlled rollout with scope management |
| **Pin** | Pin selected agents for organization-wide visibility (current Microsoft documentation does not specify a fixed pin limit; verify the live cap in your tenant before publishing internal guidance) | Managed discovery for approved agents |
| **Block / Unblock** | Prevent or restore agent availability | Immediate risk mitigation capability |
| **Delete** | Permanently remove agents from the tenant | Lifecycle termination control |
| **Approve Updates** | Review and approve agent version changes | Change management enforcement |
| **Reassign Ownership** | Transfer agent ownership between users | Continuity management for departing staff |
| **Manage Ownerless** | Handle agents without active owners | Orphaned agent governance |
| **Export Inventory** | Download agent inventory data | Audit and compliance reporting |

The agent inventory view also includes a **Risks column** that surfaces Entra-based risk alerts for individual agents, enabling administrators to identify and prioritize agents requiring governance review.

### Agent-Level Authentication and Access Control

- **Require user authentication for all agents:** In Copilot Studio, navigate to each agent's Settings > Security and verify authentication is **not** set to "No Authentication." Use "Authenticate with Microsoft" (recommended for internal agents using Entra ID) or "Authenticate Manually" (for OAuth-based scenarios)
- **Enforce sign-in for manual authentication:** When using "Authenticate Manually," enable the "Require users to sign in" toggle to prevent anonymous interactions with the agent. For "Authenticate with Microsoft," users are already authenticated through Teams and Microsoft 365
- **Restrict agent sharing scope:** In Copilot Studio, open the agent and use **… > Share** to configure who can chat with or collaborate on the agent. Restrict access to designated Copilot Readers or Security Groups. Enforce broader sharing restrictions through Managed Environment sharing rules in Power Platform Admin Center. Do not allow unrestricted access ("Anyone" or "Any multi-tenant") for agents handling non-public data
- **Control generative AI agent publishing at tenant level:** In Power Platform Admin Center > Tenant Settings, disable the ability to publish agents that use generative AI features until governance review confirms AI feature controls are in place
- **Block unapproved shared agents:** In the M365 Admin Center, open the Copilot Control System / Agents experience and use **All agents** to review and block agents that have not been through the approval workflow

### Copilot Studio Data Policies

Use Copilot Studio data policies to enforce governance controls at the environment, environment-group, or tenant scope:

- Require maker/user authentication
- Explicitly allow or block knowledge sources, actions/connectors, skills, HTTP requests, publication to channels, triggers, and Application Insights integration

### Data Residency Verification

- Verify all Power Platform environments used for agent publishing are provisioned in US regions
- Confirm Copilot Studio geographic data residency aligns with regulatory boundaries
- Document region configuration as part of environment setup evidence

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Any licensed user can create personal agents; no approval required; authentication recommended but not enforced | Low risk, no customer data |
| **Zone 2** (Team) | Security group membership required; manager approval before production; authentication required with "Require users to sign in" enabled; sharing restricted to security groups | Internal data access requires accountability |
| **Zone 3** (Enterprise) | Strict group membership; Governance Committee + Legal review; quarterly certification; authentication required with "Require users to sign in" enabled; sharing restricted to named security groups only; generative AI publishing disabled until governance review complete | Customer-facing, regulatory examination risk |

---

## Roles & Responsibilities

| Role | Responsibility |
|------|----------------|
| **AI Administrator** *(preferred — MC1041454, Mar 2025)* | Day-to-day agent governance: configure agent-publishing controls, review M365 Admin Center agent inventory, manage block/allow decisions. Use this role in preference to Global Admin for ongoing operations. |
| Power Platform Admin | Configure environment security roles (PPAC), Managed Environment sharing limits, Copilot Studio data policies, tenant-level Copilot Studio author settings |
| Dataverse System Admin (per-environment) | Assign Dataverse security roles (Environment Maker, Copilot Author) on Dataverse-backed environments — the PowerShell `*-AdminPowerAppEnvironmentRoleAssignment` cmdlets do **not** work on Dataverse environments; assignment must be made via PPAC or the Dataverse API |
| Entra Global Admin | **Initial setup and consent only** — create the security groups (`FSI-Agent-Makers-*`, `FSI-Agent-Publishers-Prod`, `FSI-Agent-Approvers-Compliance`); thereafter delegate group ownership to a security-group owner and operate under AI Administrator |
| Compliance Officer | Approve production publishes; quarterly access review of `FSI-Agent-Publishers-Prod`; review audit logs |
| AI Governance Lead | Define approval workflow, governance-tier requirements, exception handling |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [2.1 - Managed Environments](../pillar-2-management/2.1-managed-environments.md) | Enables sharing restrictions and governance features |
| [1.2 - Agent Registry](1.2-agent-registry-and-integrated-apps-management.md) | Tracks all published agents |
| [1.7 - Audit Logging](1.7-comprehensive-audit-logging-and-compliance.md) | Logs all publishing attempts |
| [2.3 - Change Management](../pillar-2-management/2.3-change-management-and-release-planning.md) | Approval workflow for promotions |

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/1.1/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/1.1/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/1.1/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/1.1/troubleshooting.md) — Common issues and resolutions

!!! tip "Advanced Implementation: Configuration Hardening Baseline"

    This control is covered by the [Configuration Hardening Baseline](../../playbooks/advanced-implementations/configuration-hardening-baseline/index.md), which consolidates SSPM-detectable settings across all 7 mapped controls into a single reviewable checklist with automation classification and evidence export procedures.

!!! tip "Advanced Implementation: Unrestricted Agent Sharing Detector"

    For continuous detection of overly permissive agent sharing configurations, see the [Unrestricted Agent Sharing Detector](../../playbooks/advanced-implementations/unrestricted-agent-sharing-detector/index.md). This solution scans all Copilot Studio agents for organization-wide sharing, public internet links, unapproved groups, excessive individual shares, and cross-tenant access — with automated approval-based remediation and exception management.

!!! tip "Governance Script: Agent Authentication Enforcement"

    `Test-AgentAuthConfiguration.ps1` validates per-agent authentication configuration against 6 SSPM items with zone-based logic. Checks authentication mode, sign-in enforcement, timing settings, sharing scope, AI feature publishing, and agent approval status — with drift detection and SHA-256 evidence export.

    **Script Location:** `scripts/governance/Test-AgentAuthConfiguration.ps1`

!!! tip "Governance Script: Publishing Restriction Validation"

    `restrict-agent-publishing.ps1` validates 6 publishing restriction criteria: Environment Maker role removal, authorized security groups, Share with Everyone disabled, DLP connector blocking, Managed Environment sharing limits, and approval workflow status — with SHA-256 evidence export for audit readiness.

    **Script Location:** `scripts/governance/restrict-agent-publishing.ps1`

---

## Verification Criteria

Confirm control effectiveness by verifying:

1. Non-authorized users cannot create or publish agents (test with non-member account)
2. Authorized users can create agents in designated environments
3. Production publishing requires membership in `FSI-Agent-Publishers-Prod`
4. All publish events appear in Microsoft Purview Audit logs
5. Sharing restrictions block "Share with Everyone" attempts
6. No Copilot Studio agents are configured with "No Authentication" (Copilot Studio > Agent > Settings > Security)
7. Agents using manual authentication have "Require users to sign in" enabled
8. No agents are shared with unrestricted access ("Anyone" or "Any multi-tenant")
9. Generative AI agent publishing is disabled at tenant level or governance review is documented
10. Unapproved agents are blocked in M365 Admin Center agent inventory
11. Each production agent's Protection status is reviewed in Copilot Studio; any "Needs review" status is resolved before publish approval
12. Audit log retention is configured to meet the firm's record schedule, using the record-type model in [Control 1.7 - Comprehensive Audit Logging](1.7-comprehensive-audit-logging-and-compliance.md): 3 years for communications under SEC Rule 17a-4(b)(4), 6 years for financial/accounting or governance records under SEC Rule 17a-4(a) and FINRA Rule 4511(b), 5 years for CFTC Rule 1.31 records, and longer only where a specific rule or firm schedule requires it. **Important:** Microsoft Purview Audit (Standard) retains audit logs for 180 days; Audit (Premium) defaults to 1 year. Retention beyond 1 year requires an explicit **Audit Retention Policy** in Purview (configured separately under Purview > Audit > Audit retention policies). Verify the active retention policy covers the required period and includes the `BotUpdateOperation-BotPublish` operation
13. Publishing records (audit logs, approval records, group membership changes) are searchable and exportable via Microsoft Purview eDiscovery for regulatory examination readiness
14. All agent environments are provisioned in US regions with documented data residency confirmation

---

## Additional Resources

- [Microsoft Learn: Environment security](https://learn.microsoft.com/en-us/power-platform/admin/database-security)
- [Microsoft Learn: Security roles and privileges](https://learn.microsoft.com/en-us/power-platform/admin/security-roles-privileges)
- [Microsoft Learn: Copilot Studio security and governance](https://learn.microsoft.com/en-us/microsoft-copilot-studio/security-and-governance)
- [Microsoft Learn: Managed Environments - Limit sharing](https://learn.microsoft.com/en-us/power-platform/admin/managed-environment-sharing-limits)

### Agent Essentials

> **Note:** Agent governance features in the M365 Admin Center are rolling out progressively. Verify feature availability in your tenant.

- [Microsoft Learn: Agent Deployment Checklist](https://learn.microsoft.com/en-us/microsoft-365/copilot/agent-essentials/m365-agents-checklist) - Microsoft's 8-category deployment readiness checklist including access and availability policies
- [Microsoft Learn: Agent Visual Governance Guide](https://learn.microsoft.com/en-us/microsoft-365/copilot/agent-essentials/m365-agents-visual-map) - Visual map of agent governance decision points

---

!!! note "Implementation Note"
    Organizations should verify that their implementation meets their specific regulatory obligations. This control supports compliance efforts but requires proper configuration and ongoing validation.

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current (April 2026)*
