AI Agent Governance in Dynamics 365: The IT Manager's Audit Checklist

If you lived through the early days of Power Platform adoption inside a mid-to-large enterprise, this scenario will feel familiar: a sales manager spins up a canvas app over a weekend, a service team builds a flow that writes directly to a production environment, and before IT has issued a single policy document, there are 47 ungoverned apps touching customer data. Fast forward to 2025, and the same pattern is playing out — only this time, the actors are AI agents built in Copilot Studio, and the stakes are considerably higher.

Dynamics 365 AI agent governance is no longer a future concern; it is a present operational requirement. This post gives IT Managers and architects a practical, checklist-driven framework — covering role-based access control, DLP policies, audit logging with Microsoft Purview, and a four-stage governance maturity model — to bring AI agent deployments under the same rigorous control you apply to the rest of your Dynamics 365 estate.

Mapping the Governance Gap: Why Copilot Studio Agent Sprawl Happens

Copilot Studio dramatically lowers the barrier to building conversational AI agents. A functional agent that answers customer enquiries, qualifies leads, or routes service cases can be assembled in hours by a business analyst with no formal development background. That accessibility is genuinely powerful — and genuinely dangerous when governance structures lag behind adoption.

The sprawl dynamic mirrors early Power Platform growth almost exactly:

• Low-friction creation: Makers can publish agents to Teams, web, or Dynamics 365 without raising an IT ticket.
• Environment ambiguity: Agents default to whichever environment the maker has access to, often a shared development or even production environment.
• Connector promiscuity: A single agent can invoke custom connectors, HTTP actions, and Power Automate flows that reach ERP systems, external APIs, and sensitive Dataverse tables.
• Invisible data flows: Unlike a traditional integration, an agent's data access path is conversational and non-linear, making it hard to trace without dedicated tooling.
• Accountability vacuum: Without an assigned owner and lifecycle policy, agents that were built for a pilot live indefinitely in production, accumulating permissions and technical debt.

The organisations that successfully governed Power Platform did so by treating the platform as enterprise infrastructure — not a sandbox. The same mindset shift is required for AI agents today.

The IT Manager's Governance Checklist

1. Environment Strategy for AI Agents

Your environment architecture is the first line of defence. At minimum, enforce a three-tier separation:

• Development environments: Per-maker or per-team, no production data, agents cannot be published externally.
• Test/UAT environments: Managed by IT, anonymised or synthetic data only, used for security review and performance validation before promotion.
• Production environments: Change-controlled, DLP-enforced, Purview-monitored. Only agents that have passed a formal review gate are deployed here.

Use environment groups in the Power Platform Admin Center to apply consistent policies across all production environments simultaneously. Assign a dedicated environment admin for each tier and document the promotion process in your internal runbook.

2. Role-Based Access Control (RBAC) for Copilot Studio

Copilot Studio uses a distinct set of security roles layered on top of Dataverse security. Audit and enforce the following assignments:

• Copilot Studio Maker: Grants the ability to create and edit agents. Restrict this role to named individuals who have completed mandatory AI ethics and data handling training.
• Environment Maker: Required to publish agents. Should require manager approval before assignment in production environments.
• System Administrator / System Customizer: Agents that invoke Dataverse actions inherit the permissions of their configured connection. Audit every agent's connection credentials — service accounts must follow least-privilege principles.
• Agent User roles: Control which end-user groups can invoke a published agent. Use Azure AD security groups rather than individual assignments to keep access scalable and auditable.

Conduct a quarterly RBAC review. Export the full list of Copilot Studio makers per environment using the Power Platform Admin Center > Environments > Settings > Users + Permissions screen, cross-reference against your HR system, and revoke stale access immediately.

3. Data Loss Prevention (DLP) Policies Tailored for AI Agents

Standard DLP policies govern connector usage. For AI agents, the configuration requires extra attention because a single agent can chain multiple connectors across a single conversation turn. Key controls:

• Place all external, non-Microsoft connectors in the Blocked category by default in production environments. Promote connectors to the Business tier only after security review.
• Review the HTTP with Azure AD and HTTP Request connectors specifically — these are frequently used in agent actions and can exfiltrate data if misconfigured.
• Use connector action control (now generally available) to allow a connector at the environment level but block specific high-risk actions — for example, permitting SharePoint read operations while blocking write and delete.
• Apply DLP policies at the tenant level as a baseline, then layer more restrictive environment-level policies for your Dynamics 365 production environments. Remember: environment policies cannot be less restrictive than the tenant policy.

# PowerShell: List all DLP policies and their environments
Get-DlpPolicy | Select-Object DisplayName, CreatedTime, Environments | Format-Table -AutoSize

# Export DLP policy details for audit
Get-DlpPolicy -PolicyName "Production-AI-Agent-Policy" | ConvertTo-Json -Depth 10 | Out-File .\dlp_audit_export.json

Run this export monthly and store it in your compliance documentation repository. Any change to a DLP policy should trigger a review notification to the IT governance team.

4. Audit Logging and Monitoring with Microsoft Purview

Visibility into what your AI agents are actually doing at runtime is non-negotiable. Microsoft Purview, integrated with the Power Platform audit log, provides the backbone for this capability.

Enable the following in Microsoft Purview Compliance Portal:

• Navigate to Audit > Audit Search and confirm audit logging is enabled for your tenant. If it shows as disabled, enable it immediately — historical logs are not retroactively generated.
• Filter for PowerApps and Power Virtual Agents activity types to capture agent creation, modification, publishing, and invocation events.
• Set up Audit Retention Policies — for organisations subject to GDPR or industry-specific compliance, retain audit logs for a minimum of 12 months (E5 licence) or export to Azure Log Analytics for longer retention.

In Power Platform Admin Center, configure:

• Dataverse Activity Logging: Enable per-table audit logging for the tables your agents access. For a Dynamics 365 Sales deployment, this means at minimum: Account, Contact, Lead, Opportunity, and any custom entities the agent reads or writes.
• Agent conversation transcripts: Copilot Studio stores conversation transcripts in Dataverse by default. Implement a retention and review policy — who can access transcripts, how long they are kept, and how they are disposed of.

Alerting architecture: Export Power Platform audit events to Azure Monitor / Log Analytics via the Power Platform diagnostic settings. Build alerts for high-risk events:

// KQL Query: Alert on agent published to production environment without change ticket tag
PowerPlatformAdminActivity
| where ActivityType == "AgentPublished"
| where EnvironmentTier == "Production"
| where isempty(CustomProperties.ChangeTicketId)
| project TimeGenerated, ActorUpn, AgentName, EnvironmentName
| order by TimeGenerated desc

Route these alerts to your IT Service Management tool (ServiceNow, Jira Service Management) to create automatic review tasks for any out-of-process deployment.

5. Agent Inventory and Lifecycle Management

You cannot govern what you cannot enumerate. Establish and maintain a living agent inventory:

• Use the CoE Starter Kit's Bot Inventory component — it automatically harvests all Copilot Studio agents across your tenant into a single Dataverse table with owner, environment, last modified date, and channel information.
• Tag every production agent with: Owner, Business Unit, Data Classification, Review Date, and Change Ticket reference.
• Implement a 90-day auto-quarantine rule: any agent that has not been reviewed or modified in 90 days is automatically suspended pending owner confirmation. This mirrors the app quarantine capability now available in Power Platform and applies the same discipline to agents.

AI Agent Governance Maturity Model

Governance is not a binary state — it is a maturity journey. Use this four-stage model to benchmark your current position and prioritise investment:

Stage 1 — Ad-Hoc (Reactive)

Agents are created on demand with no formal process. No DLP policies specific to agents exist. Audit logging may be enabled at the tenant level but is not actively monitored. No agent inventory. Risk: High.

Stage 2 — Managed (Foundational Controls)

Environment strategy is documented and enforced. Basic DLP policies are in place. Purview audit logging is enabled and retention is configured. An agent inventory exists but is manually maintained. RBAC assignments are reviewed annually. Risk: Medium.

Stage 3 — Defined (Proactive Governance)

A formal agent promotion process (Dev > Test > Prod) exists with documented review gates. DLP policies use connector action controls. Audit log alerts are configured and routed to ITSM. The CoE Starter Kit Bot Inventory is operational. RBAC is reviewed quarterly. Agent lifecycle policies (90-day review, auto-quarantine) are enforced. Risk: Low-Medium.

Stage 4 — Optimised (Enterprise-Certified)

All agents carry a formal certification: data classification, security review sign-off, business owner acknowledgement, and change ticket linkage. Automated compliance checks run on every deployment pipeline. Purview audit data feeds a real-time governance dashboard visible to the CISO and CIO. AI-specific DLP controls are reviewed with every Microsoft platform update cycle. Agent performance and safety metrics (hallucination rate, escalation rate, sensitive data exposure events) are tracked as KPIs. Risk: Low.

Quick-Reference IT Manager Checklist

• ☐ Three-tier environment strategy documented and enforced in Admin Center
• ☐ Copilot Studio Maker role restricted to trained, approved personnel only
• ☐ All agent connection credentials use least-privilege service accounts
• ☐ DLP policy blocks external connectors by default in production
• ☐ Connector action control enabled for high-risk connector/action combinations
• ☐ Microsoft Purview audit logging enabled with minimum 12-month retention
• ☐ Dataverse table-level auditing enabled for all tables agents access
• ☐ Audit alerts configured for out-of-process agent deployments
• ☐ CoE Starter Kit Bot Inventory deployed and current
• ☐ 90-day agent review and auto-quarantine policy active
• ☐ Quarterly RBAC access review scheduled and assigned
• ☐ Agent promotion checklist (security review, data classification, change ticket) documented

Conclusion

The organisations that will extract genuine business value from Dynamics 365 AI agents are not the ones that deploy the most agents — they are the ones that deploy governed agents. Shadow IT cost enterprises years of remediation effort and significant compliance exposure. Dynamics 365 AI agent governance, implemented proactively using the controls available today in Microsoft Purview, Power Platform Admin Center, and Copilot Studio itself, gives IT Managers the visibility and control to let the business move fast without moving recklessly.

If your organisation is currently at Stage 1 or 2 of the maturity model, the checklist above gives you a concrete starting point. If you are already at Stage 3, the gap to enterprise-certified deployment is smaller than it looks — it is primarily a process and tooling integration exercise, not a technology rebuild.

At CRMONCE, we help Dynamics 365 customers in Hyderabad and across India build governance frameworks that scale with their AI ambitions — from initial environment strategy through to full Purview integration and CoE deployment. If you are ready to bring your AI agent programme under proper governance control, contact our team to start the conversation.

Source references: Microsoft Copilot Studio — Security and Governance | Power Platform Governance Considerations | Microsoft Purview Audit Solutions Overview