From c75e48d8dc061a630b64c1a0177395f7817ea8e3 Mon Sep 17 00:00:00 2001 From: denise-msft Date: Fri, 27 Mar 2026 00:52:08 -0700 Subject: [PATCH] docs: clarify Compliance Hub prerequisites and security role requirements Resolves confusion about whether System Administrator role is required for ongoing Compliance Hub access (#633). The System Administrator role is only needed for initial setup/installation. Day-to-day Compliance Hub access is controlled by the CSK - Administrator security role, which grants full Organization-level access to all compliance tables. Changes: - Split permissions into setup vs ongoing use sections - Add reference to CSK - Administrator role and SECURITY_ROLES.md - Clarify Administrator persona has org-level compliance table access - Clarify Maker persona has no compliance table access Fixes #633 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- COMPLIANCE_HUB.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/COMPLIANCE_HUB.md b/COMPLIANCE_HUB.md index 0d920f2f..ea73f987 100644 --- a/COMPLIANCE_HUB.md +++ b/COMPLIANCE_HUB.md @@ -19,10 +19,12 @@ The Compliance Hub enables organizations using Copilot Studio to balance innovat Before setting up the Compliance Hub, ensure you have: - **Copilot Studio Kit prerequisites**: All [prerequisites for the Copilot Studio Kit](PREREQUISITES.md) -- **Permissions (for admin)**: - - System Administrator role in the target environment +- **Permissions (for setup)**: + - System Administrator role in the target environment (required for initial installation and configuration) - Ability to create and configure cloud flows - Microsoft Entra ID (Azure AD) permissions to retrieve group IDs +- **Permissions (for ongoing use)**: + - **CSK - Administrator** security role for managing compliance cases, thresholds, and enforcement actions (see [Security Roles](./SECURITY_ROLES.md) for full details) - **Dependencies**: - [Agent Inventory](./AGENT_INVENTORY.md) must be installed and configured first - Microsoft Teams for notification functionality @@ -42,7 +44,7 @@ There are two main personas involved in the main agent compliance workstream: ag ### Administrator -The scope of the agent admin depends on the organization, however, the admin responsibilities for managing compliance commonly falls under the responsibility of either Microsoft tenant admin, Power Platform admin or the Agent/AI Center Of Excellence team. +The scope of the agent admin depends on the organization, however, the admin responsibilities for managing compliance commonly falls under the responsibility of either Microsoft tenant admin, Power Platform admin or the Agent/AI Center Of Excellence team. Users with the **CSK - Administrator** security role have full Organization-level access to all compliance tables (Compliance Case, Agent Fact Row Counts, Threshold Config, and Action Policy). - Configure compliance thresholds, risk levels, enforcement actions, and SLA timers. - Monitor agent inventory and compliance posture. @@ -51,7 +53,7 @@ The scope of the agent admin depends on the organization, however, the admin res ### Maker -Any user who has created a Copilot Studio agent in the organization's tenant. This agent creator is identified as the owning maker of the agent. +Any user who has created a Copilot Studio agent in the organization's tenant. This agent creator is identified as the owning maker of the agent. Users with the **CSK - Maker** security role do not have access to the Compliance Hub dashboard or compliance tables. - Receives notifications when compliance thresholds are breached. - Provides business justification and confirms ownership for non-compliant agents.