AIAGENT-002: Copilot agents require authentication
- Plataforma
- Entra ID / M365
- Categoría
- AI Agent Governance
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 4
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
A Copilot Studio agent with user-authentication type 'None' accepts anonymous interaction; an agent that authenticates only 'As Needed' leaves authentication optional. Either lets unauthenticated users reach an agent that can surface organizational data or invoke tools, enabling abuse, data exfiltration, and prompt-injection. This check FAILs agents with no authentication and WARNs agents whose authentication is only triggered as-needed.
Valor recomendado
Every published agent requires authentication (user-authentication type is not 'None' and authentication is always enforced, not 'As Needed')
Remediación
In Copilot Studio, set each agent's authentication to require sign-in (Microsoft Entra ID authentication) rather than 'No authentication', and ensure authentication is always enforced rather than triggered only as needed. Re-publish after the change.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| noauth | FAIL |
| not-assessed | Not Assessed |
| optional | WARN |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-2, AC-3, AC-14