chore(ms-ai-architect): KB checkpoint refresh — 30 files (critical 9 + high batch 1) [skip-docs]

- Critical bucket (9 files): substantive content updates basert på MCP-fetch
  - enterprise-governance: DSPM front door, AI-app-kategorier (3), single-tenant Entra ID
  - rag-cost-optimization, observability, ai-services-enterprise, multi-model-strategy: dato-bump
  - deterministic-cost: Copilot Credits offisiell common currency (2025-09-01), CCCU prepurchase
  - gpt5-gpt41-pricing: utvidet Copilot Studio modell-lineup (GPT-5.2, GPT-5.3, Claude 4.6, Grok 4.1)
  - vector-storage, request-batching: dato-bump (DS allerede dekkende)

- High batch 1 (21 files, 10-30): Last updated 2026-04→2026-05 dato-bump
  Substantive Microsoft Learn-endringer var marginale per fetch — kosmetiske oppdateringer.

Resterende: high batch 2 (filer 31-53, 23 filer) i ny sesjon. Se NEXT-SESSION-PROMPT.local.md.
This commit is contained in:
Kjell Tore Guttormsen 2026-05-05 14:28:35 +02:00
commit 82bd665ba0
30 changed files with 61 additions and 35 deletions

View file

@ -1,6 +1,6 @@
# Data Loss Prevention and Governance in Copilot
**Last updated:** 2026-04
**Last updated:** 2026-05
**Status:** GA (DLP for sensitivity labels), Preview (DLP for sensitive prompts)
**Category:** Copilot Extensibility & Integration

View file

@ -1,6 +1,6 @@
# Prompt Engineering and Governance for Copilot
**Last updated:** 2026-04
**Last updated:** 2026-05
**Status:** GA
**Category:** Copilot Extensibility & Integration

View file

@ -1,6 +1,6 @@
# Enterprise Governance and Deployment Controls
**Last updated:** 2026-04
**Last updated:** 2026-05
**Status:** GA
**Category:** Copilot Extensibility & Integration
@ -177,6 +177,8 @@ New-DLPComplianceRule -Name "Copilot Rule" -Policy "Copilot Policy" -AdvancedRul
- Agent authentication: None, Microsoft, Manual (custom OAuth)
- Role-based access control (RBAC) via Dataverse security roles
- Microsoft Entra ID group-based security
- **Single-tenant Entra ID app registration for nye agenter (Verified 2026-05):** Copilot Studio oppretter én app-registrering per custom agent for å identifisere og sikre kommunikasjon med kanaler/skills. Eksisterende agenter har multitenant-registrering; nye agenter får single-tenant. Microsoft undersøker migrasjon av eksisterende agenter til single-tenant. App-registreringen aksesserer ikke kundedata.
- **Tenant isolation:** Ikke støttet by default i Copilot Studio. Cross-tenant connections er tillatt med Entra ID-credentials. Admin kan slå PÅ tenant isolation for å begrense kun til godkjente tenants (cross-tenant-restrictions). (Verified 2026-05)
---
@ -427,10 +429,15 @@ Start
- Audit logs for all Copilot activities (interactions, agent deployments, policy changes)
**Compliance:**
- Microsoft Purview Data Security Posture Management for AI
- Insider risk management (detect abnormal agent usage patterns)
- **DSPM for AI som "front door"** — Data Security Posture Management for AI er nå anbefalt startpunkt for å oppdage, sikre og anvende compliance-kontroller på tvers av AI-bruk i tenantet (Verified 2026-05)
- **Tre AI-app-kategorier i Purview:**
1. **Copilot experiences and agents** — M365 Copilot, Security Copilot, Copilot in Fabric, Copilot Studio, Microsoft Facilitator, Channel Agent in Teams
2. **Enterprise AI apps** — Entra-registered AI apps, Microsoft Foundry, ChatGPT Enterprise
3. **Other AI apps** — Tredjepart-LLMs (ChatGPT consumer, Google Gemini, DeepSeek) detektert via Defender for Cloud Apps
- **Microsoft Agent 365** har dedikert Purview-side (`ai-agent-365`) for security & compliance
- **Risky AI usage policy template** i Insider Risk Management — detekterer prompt injection-angrep og tilgang til beskyttet materiale, integrert med Microsoft Defender XDR (Verified 2026-05)
- Communication compliance (monitor agent responses for compliance violations)
- eDiscovery (search agent conversation transcripts for legal holds)
- eDiscovery (search agent conversation transcripts for legal holds — bruk `Copilot activity` query condition)
- Retention policies (auto-delete agent conversations etter retention period)
**PowerShell-eksempel for Purview collection policy:**