Maester Copilot AI Governance
Findings for how AI agents, agent identities, and the Copilot agent catalog are governed in Microsoft 365: sponsor/owner coverage, unused agents and tools, assignment-group ownership, broad Graph write permissions on agent identities, unclear agent and blueprint names, classic Copilot Studio servic…
| ID | Title | Severity | Product |
|---|---|---|---|
MP.AIGOV.1001 | Agent catalog adoption is below a configurable threshold over the D90 report period | Low |  |
MP.AIGOV.1002 | Blocked package has an open pending install or consent request | Low | |
MP.AIGOV.1003 | Agent is assigned directly to users instead of via a groupLong running | Low | |
MP.AIGOV.1004 | Agent identity, blueprint, or blueprint principal has exactly one sponsor and zero owners (Preview) | Low | |
MP.AIGOV.1005 | Classic Copilot Studio service principal has no corresponding Agent ID registration (Preview) | Info | |
MP.AIGOV.1006 | Agent display name or description is empty or a placeholder value | Info | |
MP.AIGOV.1007 | Custom or external package is available or deployed tenant-wide | High | |
MP.AIGOV.1008 | MCP server endpoint should not be reachable over plain HTTPLong running | High | |
MP.AIGOV.1009 | Agent Identity Blueprint credential should not be nearing expirationLong running | Low | |
MP.AIGOV.1010 | MCP server should be hosted on an allowlisted domainLong running | Medium | |
MP.AIGOV.1011 | MCP tool with a destructive or open-world effect should not be in a tenant-wide packageLong running | High | |
MP.AIGOV.1012 | Agent skill should have a clear description, and should not be exposed to Copilot tenant-wide without reviewLong running | Medium | |
MP.AIGOV.1013 | Enabled spending policy should have a credit ceiling | Medium | |
MP.AIGOV.1014 | Group backing a spending policy should have owners and a description | Low | |
MP.AIGOV.1015 | Spending policy cap should not be overridden by a more permissive overlapping policy | Medium | |
MP.AIGOV.1016 | MCP server should not use weak or no authenticationLong running | High | |
MP.AIGOV.1017 | Conditional Access should cover agent identities | High | |
MP.AIGOV.1018 | Agent identity currently at risk should be remediated or dismissed | High | |
MP.AIGOV.1019 | Agent identity should not have user-consented delegated permissionsLong running | Medium | |
MP.AIGOV.1020 | Custom agent or tool that nobody uses should be blocked or removedLong running | Medium | |
MP.AIGOV.1021 | Group an agent or tool is assigned to should exist, have two owners and a descriptionLong running | Medium | |
MP.AIGOV.1022 | Agent identity should not hold broad Microsoft Graph write permissions | High | |
MP.AIGOV.1023 | Agent identity and blueprint should have a clear name and description | Medium | |
MP.AIGOV.1024 | Classic Copilot Studio service principal should have an owner and be in use | Medium | |
MP.AIGOV.1025 | Spending policy should be scoped to a group and fully configured | High | |
MP.AIGOV.1026 | Enabled spending policy should alert at least two active recipients | Medium | |
MP.AIGOV.1027 | Group behind a spending policy should be a populated security group without nesting | Medium | |
MP.AIGOV.1032 | Spending policy groups should contain only enabled, active, licensed members | Medium | |
MP.AIGOV.1033 | Copilot connectors users can search should only take content from apps you govern | Medium | |
No test matches your search and filters.
Install
Install-MtPack chadmcox/maester-ai-governance-pack/packAssumes Maester is installed. New to Maester? Get started.
Next: connect and run
Connect
Connect-Maester Run
Invoke-Maester -Pack AIGOV