Skip to content

docs: clarify Compliance Hub prerequisites and security role requirements #667

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Denise (denise-msft) wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: clarify Compliance Hub prerequisites and security role requirements #667

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions COMPLIANCE_HUB.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,12 @@ The Compliance Hub enables organizations using Copilot Studio to balance innovat
Before setting up the Compliance Hub, ensure you have:

- **Copilot Studio Kit prerequisites**: All [prerequisites for the Copilot Studio Kit](PREREQUISITES.md)
- **Permissions (for admin)**:
- System Administrator role in the target environment
- **Permissions (for setup)**:
- System Administrator role in the target environment (required for initial installation and configuration)
- Ability to create and configure cloud flows
- Microsoft Entra ID (Azure AD) permissions to retrieve group IDs
- **Permissions (for ongoing use)**:
- **CSK - Administrator** security role for managing compliance cases, thresholds, and enforcement actions (see [Security Roles](./SECURITY_ROLES.md) for full details)
- **Dependencies**:
- [Agent Inventory](./AGENT_INVENTORY.md) must be installed and configured first
- Microsoft Teams for notification functionality
Expand All @@ -42,7 +44,7 @@ There are two main personas involved in the main agent compliance workstream: ag

### Administrator

The scope of the agent admin depends on the organization, however, the admin responsibilities for managing compliance commonly falls under the responsibility of either Microsoft tenant admin, Power Platform admin or the Agent/AI Center Of Excellence team.
The scope of the agent admin depends on the organization, however, the admin responsibilities for managing compliance commonly falls under the responsibility of either Microsoft tenant admin, Power Platform admin or the Agent/AI Center Of Excellence team. Users with the **CSK - Administrator** security role have full Organization-level access to all compliance tables (Compliance Case, Agent Fact Row Counts, Threshold Config, and Action Policy).

- Configure compliance thresholds, risk levels, enforcement actions, and SLA timers.
- Monitor agent inventory and compliance posture.
Expand All @@ -51,7 +53,7 @@ The scope of the agent admin depends on the organization, however, the admin res

### Maker

Any user who has created a Copilot Studio agent in the organization's tenant. This agent creator is identified as the owning maker of the agent.
Any user who has created a Copilot Studio agent in the organization's tenant. This agent creator is identified as the owning maker of the agent. Users with the **CSK - Maker** security role do not have access to the Compliance Hub dashboard or compliance tables.

- Receives notifications when compliance thresholds are breached.
- Provides business justification and confirms ownership for non-compliant agents.
Expand Down
Loading