Security reviews for Microsoft 365 Copilot and Copilot Studio agents keep stalling on one request: show me the control. This printable checklist gives your security and compliance team the 20 controls a reviewer in finance, healthcare, energy or the public sector checks first, each with the admin center where you set it and the license it depends on.
It’s the condensed edition of our 46-item Copilot agents security guide, which adds the mapping to HIPAA, SEC 17a-4, NERC CIP and FedRAMP and a 30-day rollout sequence. Every item has Ready, Needs work and Decision needed boxes, so the PDF can double as the agenda for your review meeting.
What the Checklist Covers
Seven domains, in the order a reviewer works through them:
- Identity & access — MFA and baseline Conditional Access before licenses are assigned, an inventory of Entra agent identities with named sponsors, and Conditional Access for agent identities
- Data protection — Purview DLP for Microsoft 365 Copilot on sensitivity labels and regulated identifiers, the SharePoint oversharing assessment, and Restricted Content Discovery for high-risk sites
- Agent governance — agent access limited to a pilot group, external-publisher agents switched off, the org-wide approval queue, and one tenant-wide Power Platform data policy
- Monitoring & audit — Purview Audit retention tiers, the CopilotInteraction audit fields that matter, and DSPM for AI
- Residency, retention & eDiscovery — a retention policy for Copilot interactions, a test eDiscovery search, and Customer Lockbox
- Human-in-the-loop & change control — ask-before-running on tools that change data, and pipelines or Git between development and production
- Vendor, model & grounding — the web search policy and the review of third-party agents and connectors
Get the Checklist
Enter your details below to download the PDF.