open/ms-ai-architect
1
0
Fork 0
Code Issues Releases 4 Activity

chore(ms-ai-architect): refresh KB high-bucket — 49 files [skip-docs]

Browse source 
KB-currency refresh (high priority, 2026-06-19) via /architect:kb-update.
49 high-prioritets governance/security/monitoring-filer re-verifisert mot
Microsoft Learn (MCP) — delegert til 8 parallelle Opus-subagenter gruppert
etter delt kilde, verifisert i hovedkontekst (diff-review + tester).

Hovedendringer (faktuelle korreksjoner + currency):
- MITRE ATLAS-IDer korrigert (supply-chain): AML.T0050 -> AML.T0018.000
  (Poison AI Model); AML.T0020 = Poison Training Data; T1195 Supply Chain
  Compromise. Gamle IDer var utdaterte (verifisert mot MCSB v2 AI-1).
- OTel-sampling presisert (distributed-tracing): adaptive sampling = klassisk
  App Insights SDK; OTel-distroen sampler IKKE by default (fixed-rate/
  rate-limited maa konfigureres); Functions parent-based sampling er default.
- MCSB v2 AI-kontroller AI-1 -> AI-7 (risk-taxonomy three-pillar, scoring-
  framework, rubrics, red-team, adversarial); Defender for Cloud AI threat
  protection + AI-SPM (GA).
- AI gateway (APIM) multi-provider: Anthropic Messages API v2-tiers, Google
  Vertex, unified model API (preview), MCP/A2A, Foundry-integrasjon; eksakte
  policy-navn (llm-emit-token-metric maks 5 dims, llm-semantic-cache-*,
  score-threshold = avstand, MS-eks. 0.15).
- Purview Enterprise AI apps inkl. Anthropic Claude (Enterprise) + ChatGPT
  Enterprise; Security Dashboard for AI (Agent 365-inventar, MCP-servere,
  tredjepartsmodeller; Security Reader minimumsrolle).
- Entra Agent ID: CA-lisenskrav (Entra ID P1/P2 + Agent 365), CA-scoping per
  tilgangsmoenster (on-behalf-of/app-only/agent-as-user), CA-grenser,
  connector-permissions som API-permissions.
- Copilot DLP: Block SITs in web search (GA, Performing Web Searches) + Block
  external email (preview) som prompt injection-vern.
- Azure AI Language PII: tre feature-typer, GA-API 2026-05-01; NOIdentityNumber
  bekreftet dedikert kategori for norske foedselsnummer.
- Foundry Tools-rename forsterket paa tvers; alle 49 Last updated -> 2026-06-19.

Discovery: 500 kandidater (alle Databricks-stoey) -> kun registry-kandidater,
ingen nye skills/-filer -> 389-telling uendret. validate 239 PASS,
kb-integrity 115/115 (262 orphan-warnings uendret), gitleaks clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01REiKFhP4w6xGXXqWKpPCJJ
This commit is contained in:
Kjell Tore Guttormsen 2026-06-19 11:09:54 +02:00
commit 25bcb74d9a
49 changed files with 304 additions and 235 deletions
Download patch file Download diff file Expand all files Collapse all files

37
skills/ms-ai-governance/references/monitoring-observability/compliance-monitoring-ai-governance.md
View file

@ -1,6 +1,6 @@
# Compliance Monitoring and AI Governance Dashboards
**Last updated:** 2026-05
**Last updated:** 2026-06-19
**Status:** GA
**Category:** Monitoring & Observability
@ -64,18 +64,20 @@ Unified view av AI-security posture på tvers av Microsoft Entra, Defender, Purv
| Seksjon | Metrikker | Alerts |
|---------|-----------|--------|
| **AI Agent Inventory** | Totalt antall agents, managed vs. unmanaged, shadow AI | Nye uregistrerte agents oppdaget |
| **AI Agent Inventory** | Totalt antall agents (registrert i Microsoft Agent 365), modeller, MCP-servere og tredjeparts AI-apper (Gemini, ChatGPT); managed vs. unmanaged, shadow AI | Nye uregistrerte agents oppdaget |
| **Threat Detection** | Jailbreak-forsøk, prompt injection, abuse patterns | High-severity AI-threats (real-time) |
| **Data Security** | Sensitive data i prompts/responses, oversharing risks | PII-lekkasje via AI-interaksjoner |
| **Access Control** | Conditional access policies, privileged access reviews | Over-privileged AI agent identities |
| **Compliance Status** | % av agents med required policies, policy drift | Non-compliant agents etter 24t grace period |
**Supported products:**
- **Microsoft Entra**: Agent identity platform, conditional access for AI apps
- **Microsoft Defender for Cloud**: AI workload discovery, posture management, threat protection
- **Microsoft Purview**: Data classification, DLP for AI prompts, insider risk detection
- **Microsoft Entra**: Agent identity platform (Agent Registry), conditional access for AI apps
- **Microsoft Defender**: AI model/MCP/app-discovery, posture management, AI threat protection (real-time blokkering for støttede agenter)
- **Microsoft Purview**: Data classification, DLP for AI prompts, insider risk detection (DSPM for AI)
- **Security Copilot**: Prompt-basert exploration av AI-risikoer
> Minimumsrolle for full innsikt: **Security Reader** (Microsoft Entra). Agent-inventar dekker agenter registrert i Microsoft Agent 365; modeller/MCP-servere/øvrige AI-apper oppdages av Defender.
---
## Arkitekturmønstre
@ -248,11 +250,14 @@ async with DefaultAzureCredential() as credential, \
### Azure API Management (AI Gateway)
**Modell-/endepunktdekning:** OpenAI Chat Completions/Responses, **Anthropic Messages API** (støttet i API Management v2-tiers), **Google Vertex AI**, modeller i Microsoft Foundry og Amazon Bedrock, samt remote **MCP-servere** og **A2A agent-APIer**. En **unified model API (preview)** eksponerer flere backends gjennom ett OpenAI-kompatibelt endepunkt med felles governance-policyer. AI gateway kan nå integreres direkte i **Microsoft Foundry (preview)**.
**Governance capabilities:**
- **Token consumption metrics**: Emit til Application Insights med custom dimensions (user ID, cost center, API ID)
- **Quota enforcement**: Rate limits per user/tenant
- **Logging**: Prompts, completions, token usage → Azure Monitor Logs
- **Policy enforcement**: Input validation, content filtering, max token caps
- **Token consumption metrics**: Emit til Application Insights med custom dimensions (user ID, cost center, API ID) via `llm-emit-token-metric` (maks 5 custom dimensions inbound)
- **Quota enforcement**: Rate limits / token-kvoter per consumer (`llm-token-limit`)
- **Semantic caching**: `llm-semantic-cache-store` / `llm-semantic-cache-lookup` mot Azure Managed Redis (RediSearch); `score-threshold` er et distanse-mål (lavere = strengere, MS-eksempel 0,15)
- **Logging**: Prompts, completions, token usage → Azure Monitor Logs + innebygd dashboard
- **Policy enforcement**: Input validation, content safety (`llm-content-safety`), max token caps
**Sample policy:**
```xml
@ -270,8 +275,14 @@ async with DefaultAzureCredential() as credential, \
- **Audit logs**: Unified audit log for AI interactions (prompts, responses, referenced files, sensitivity labels)
- **Communication Compliance**: Policy violations i AI-generert innhold (harassment, sensitive info sharing)
- **eDiscovery**: Søk og slett AI interaction data (GDPR "right to be forgotten")
- **Insider Risk Management**: `Risky AI usage`-policy fanger prompt injection-forsøk og tilgang til beskyttet materiale
- **Retention policies**: Automatisk retain/delete prompts og responses per compliance requirements
**App-dekning (Purview-kategorier):**
- **Copilot experiences and agents**: Microsoft 365 Copilot (+ Cowork), Security Copilot, Copilot in Fabric, Copilot Studio, Microsoft Facilitator, Teams Channel Agent
- **Enterprise AI apps**: Microsoft Foundry, Entra-registrerte AI-apper, **Anthropic Claude (Enterprise)**, **ChatGPT Enterprise**
- **Other AI apps** (oppdaget via browser, Defender for Cloud Apps): ChatGPT, Google Gemini, Microsoft Copilot (consumer), DeepSeek
**Collection policies:**
- `DSPM for AI - Detect sensitive info shared with AI via network`
- `DSPM for AI - Capture interactions for enterprise AI apps`
@ -459,7 +470,7 @@ AppMetrics
---
*(Verified MCP 2026-04)*
*(Verified MCP 2026-06-19)*
## Kilder og verifisering
@ -472,17 +483,17 @@ AppMetrics
- [Govern AI apps and data for regulatory compliance](https://learn.microsoft.com/en-us/security/security-for-ai/govern) — Verified 2026-02
**Microsoft Purview for AI:**
- [Microsoft Purview data security and compliance protections for generative AI apps](https://learn.microsoft.com/en-us/purview/ai-microsoft-purview) — Verified 2026-02
- [Microsoft Purview data security and compliance protections for generative AI apps](https://learn.microsoft.com/en-us/purview/ai-microsoft-purview) — Verified 2026-06-19 (Enterprise AI apps inkluderer nå Anthropic Claude Enterprise + ChatGPT Enterprise)
- [Use Microsoft Purview to manage data security & compliance for Microsoft Foundry](https://learn.microsoft.com/en-us/purview/ai-azure-foundry) — Verified 2026-02
- [Assessments for AI regulations](https://learn.microsoft.com/en-us/purview/compliance-manager-assessments#assessments-for-ai-regulations) — Verified 2026-02
**Azure Policy & monitoring:**
- [Azure Policy Regulatory Compliance controls for Azure AI Search](https://learn.microsoft.com/en-us/azure/search/security-controls-policy) — Verified 2026-02
- [Control AI model deployment with built-in policies in Microsoft Foundry portal](https://learn.microsoft.com/en-us/azure/foundry-classic/how-to/built-in-policy-model-deployment) — Verified 2026-02
- [AI gateway in Azure API Management (Observability and governance)](https://learn.microsoft.com/en-us/azure/api-management/genai-gateway-capabilities#observability-and-governance) — Verified 2026-02
- [AI gateway in Azure API Management (Observability and governance)](https://learn.microsoft.com/en-us/azure/api-management/genai-gateway-capabilities#observability-and-governance) — Verified 2026-06-19 (Anthropic Messages API v2-tiers, Google Vertex AI, unified model API preview, MCP/A2A, AI gateway i Foundry preview)
**Security & observability:**
- [Assess your organization's AI risk with Microsoft Security Dashboard for AI (Preview)](https://learn.microsoft.com/en-us/security/security-for-ai/security-dashboard-for-ai) — Verified 2026-02
- [Assess your organization's AI risk with Microsoft Security Dashboard for AI](https://learn.microsoft.com/en-us/security/security-for-ai/security-dashboard-for-ai) — Verified 2026-06-19 (Agent 365-inventar, MCP-servere, tredjepartsmodeller; Security Reader minimumsrolle)
- [Governance and security for AI agents across the organization](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization) — Verified 2026-02
- [Monitor Azure OpenAI (Dashboards)](https://learn.microsoft.com/en-us/azure/foundry-classic/openai/how-to/monitor-openai) — Verified 2026-02