AIAGENT-003: Published Copilot agents are maintained (not dormant)
- Plataforma
- Entra ID / M365
- Categoría
- AI Agent Governance
- Severidad
- Low
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 4
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
A published Copilot Studio agent that has not been modified in a long time continues to expose functionality and access while nobody is maintaining its configuration, permissions, or connected tools. Dormant published agents accumulate risk silently. This check flags published agents whose last modification is older than the dormancy threshold (default 90 days) for review or retirement.
Valor recomendado
Published agents are actively maintained; stale published agents are reviewed or retired
Remediación
Review each dormant published agent. Retire agents that are no longer needed (unpublish and delete), and for agents still in use, confirm their access controls, authentication, and connected tools are still appropriate, then update them to reset the maintenance clock.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| dormant | WARN |
| draft-only | PASS |
| maintained | PASS |
| not-assessed | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-8, SA-9