docs(architect): weekly KB update — 66 files refreshed (2026-04)

Updated 66 stale knowledge base reference files (10 critical, 56 high)
across all 5 skills using Microsoft Learn MCP research.

Key factual updates:
- Groundedness Detection API: `correction` → `mitigating` param,
  `correctedText` → `correctionText` (breaking change)
- Copilot Studio: GPT-4.1 mini now default (was GPT-4o mini);
  Claude Sonnet 4.5 + Opus 4.5 added (experimental, 200K ctx)
- Agentic Retrieval: still public preview; 50M free tokens/month
- Azure security baselines: "Cognitive Services" → "Foundry Tools"
- Databricks: Delta Live Tables → Lakeflow Spark Declarative Pipelines
- MLflow 3 GenAI: new Feedback/Expectation data model
- Token tracking doc: "Azure OpenAI in Foundry Models through a gateway"
- Agent Registry: Risks column (M365 E7), Graph API (preview)
- Copilot DLP: new Entra AI Admin + Purview Data Security AI Admin roles
- ISO/IEC 42001: scope expanded to M365 Copilot, Foundry, Security Copilot
- Zero Trust: CAE now via Conditional Access, Strict Location Enforcement
- Purview: new Fabric Copilots/agents governance section
- AG-UI HITL: ApprovalRequiredAIFunction (C#), @tool approval_mode (Python)

All files: Last updated → 2026-04, *(Verified MCP 2026-04)* markers added.
Build registry: 1341 URLs from 387 files (+2 new URLs).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

skills/ms-ai-security/references/ai-security-engineering/data-leakage-prevention-ai.md

@@ -1,7 +1,7 @@
 # Data Leakage Prevention in AI Contexts
 
 **Kategori:** AI Security Engineering
-**Sist oppdatert:** 2026-02-05
+**Sist oppdatert:** 2026-04
 **Målgruppe:** Enterprise AI architects og security teams
 
 ## Oversikt
@@ -47,16 +47,17 @@ New-DlpComplianceRule `
   -NotifyPolicyTipDisplayOption "Dialog"
 ```
 
-**Støttede lokasjoner:**
-- Microsoft 365 Copilot
-- Copilot Chat
+**Støttede lokasjoner:** *(Verified MCP 2026-04)*
+- Microsoft 365 Copilot og Copilot Chat (inkludert pre-built agents)
 - Copilot in Word, Excel, PowerPoint
-- Pre-built agents i Microsoft 365 Copilot og Copilot Chat
+- Policy location er kun tilgjengelig i **Custom**-policymalen
+- Alle andre lokasjoner i policyen deaktiveres når denne lokasjonen velges
 
 **Begrensninger:**
 - Kan ikke kombinere "Content contains sensitive info types" og "Content contains sensitivity labels" i samme regel
 - Policy-oppdateringer tar opptil 4 timer å tre i kraft
 - Admin units støttes ikke
+- DLP kan ikke scanne innholdet i filer som lastes opp direkte i prompts — kun prompt-teksten selv evalueres *(Verified MCP 2026-04)*
 
 **Brukeropplevelse:**
 Når en bruker forsøker å sende en prompt med blokkert SIT, vises en melding: *"The request can't be completed because it contains sensitive information that the organization has blocked Microsoft 365 Copilot from using."*
@@ -108,10 +109,11 @@ $advRule = @{
 New-DLPComplianceRule -Name "Exclude Confidential Content" -Policy "Copilot Sensitivity Label Policy" -AdvancedRule $advRule -RestrictAccess @(@{setting="ExcludeContentProcessing";value="Block"})
 ```
 
-**Støttede filtyper:**
-- File items (stored og actively open) — se [file types supported by sensitivity labels](https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-onedrive-files)
+**Støttede filtyper:** *(Verified MCP 2026-04)*
+- File items (stored og actively open): Word (.docx/.docm), Excel (.xlsx/.xlsm/.xlsb), PowerPoint (.pptx/.ppsx), og PDF-filer (ved aktivert PDF-støtte)
 - Emails sent on or after January 1, 2025
 - Kun filer i SharePoint Online og OneDrive for Business
+- Labels med bruker-definerte tillatelser støttes nå for search, DLP og eDiscovery (kun nyopplastede/redigerte filer)
 
 **Begrensninger:**
 - Calendar invites støttes ikke
@@ -419,10 +421,11 @@ New-DlpComplianceRule `
 - Network Security Perimeter
 - VNet integration
 
-**Lag 2: Identity & Access**
+**Lag 2: Identity & Access** *(Verified MCP 2026-04)*
 - Microsoft Entra ID RBAC
-- Managed Identity med least privilege
+- Managed Identity (for sikker autentisering uten lagrede credentials — per CAF Secure AI)
 - Separation of duties (developers, reviewers, operators)
+- Virtual networks for isolering av AI-kommunikasjonskanaler
 
 **Lag 3: Data protection**
 - Microsoft Purview DLP (prompt + file/email blocking)
@@ -487,13 +490,14 @@ New-DlpComplianceRule `
 
 ### 6.3 Enterprise AI Gateway Pattern
 
-**Konsept:** Centralize all AI traffic gjennom Azure API Management som AI Gateway.
+**Konsept:** Centralize all AI traffic gjennom Azure API Management som AI Gateway. Azure API Management kan nå også sikre Model Context Protocol (MCP) server-endepunkter. *(Verified MCP 2026-04)*
 
 **Fordeler:**
 - **Unified security policies:** Enforce authentication, DLP, rate-limiting på ett sted
 - **Traffic monitoring:** Log all API usage for audit
 - **Cost control:** Track token usage per team/project
 - **Model versioning:** Route requests til ulike model versions basert på policy
+- **MCP endpoint security:** Deploy Azure API Management for å sikre MCP server-endepunkter (ny kapabilitet) *(Verified MCP 2026-04)*
 
 **Arkitektur:**