microsoft/Data-and-Agent-Governance-and-Security-Accelerator

microsoft/Data-and-Agent-Governance-and-Security-Accelerator

Description: Automate end-to-end AI governance with Microsoft Purview DSPM for AI and Defender for AI. Configure DLP, sensitivity labels, audit logging, and threat detection across M365 Copilot, Microsoft Foundry, Microsoft Fabric, and custom agentic solutions.

Language: PowerShell

License: MIT

Stars: 71

Forks: 31

Open issues: 4

Created: 2025-11-03T13:57:30Z

Pushed: 2026-08-19T11:23:08Z

Default branch: main

Fork: no

Archived: no

README:

Data Agent Governance and Security Accelerator

Enable Microsoft Purview Data Security Posture Management (DSPM) for AI across Microsoft 365 Copilot, Microsoft Foundry, Microsoft Fabric, and custom AI solutions with a spec-driven deployment and governance workflow.

Includes Fabric lakehouse Sensitivity Labels configuration and application through the spec.local.json workflow.

---

Important Security Notice

This template, the application code and configuration it contains, has been built to showcase Microsoft Azure specific services and tools. We strongly advise our customers not to make this code part of their production environments without implementing or enabling additional security features.

For a more comprehensive list of best practices and security recommendations for Intelligent Applications, visit our official documentation.

---

Start Here

This accelerator is designed for security, compliance, and data governance teams that need to onboard AI workloads faster, apply consistent controls, and export evidence for audit or regulatory review.

What this accelerator does

• Configures Microsoft Purview DSPM for AI onboarding and governance automation
• Governs Microsoft Foundry resources with Defender for Cloud, diagnostics, tagging, and Content Safety integration
• Supports Fabric workspace and lakehouse sensitivity workflows through spec.local.json
• Exports audit and compliance evidence for downstream review

What to expect

• The repo is optimized for governance automation rather than application-only samples
• The fastest path still includes validation and a few manual follow-up steps in Microsoft Purview and Defender for Cloud
• Some scenarios require Azure, Purview, and Microsoft 365 permissions that may involve more than one operator

Recommended first path

For a first run, use the default azd up experience from a local VS Code environment, devcontainer, or Codespaces session.

Use a different path only when you have a clear reason:

| Situation | Better path | | --- | --- | | You only want to rerun specific modules | pwsh ./run.ps1 -Tags ... -SpecPath ./spec.local.json | | You need Microsoft 365 compliance steps with MFA | Run the m365 tag from a desktop PowerShell 7 session | | You are productionizing after a successful manual run | Use CI/CD or GitHub Actions |

---

Solution overview

This accelerator orchestrates Azure and Microsoft 365 governance artifacts through PowerShell and Azure Developer CLI hooks:

• Automates Purview DSPM for AI onboarding, policy configuration, scans, and exports
• Applies Fabric lakehouse sensitivity labels from spec.local.json after validating label resolution
• Governs Microsoft Foundry projects with Azure Policy, Defender for Cloud, diagnostics, tagging, and Content Safety controls
• Ships telemetry to Log Analytics and exports auditable evidence for downstream teams

Features

• Spec-driven DSPM for AI enablement — Use spec.local.json to drive Purview onboarding, scans, policies, tagging, and evidence export
• Cross-cloud posture telemetry — Stream diagnostics to Log Analytics and connect Defender for AI telemetry with governance workflows
• Microsoft Foundry governance — Apply Azure Policy, Defender for Cloud, diagnostics, tagging, and Content Safety controls to Foundry resources
• Fabric sensitivity labels — Configure and apply sensitivity labels to Fabric lakehouse and workspace assets
• CI and desktop friendly automation — Run azd up for the standard path or run.ps1 for narrower or replayable execution
• Extensible evidence exports — Reuse audit export, compliance inventory, and tagging flows for downstream regulator or SIEM scenarios

Getting Started

Quick deploy

Deploy this solution to your Azure subscription using the Azure Developer CLI.

> Note: This solution accelerator requires Azure Developer CLI (azd) version 1.9.0 or higher. Please ensure you have the latest version installed before proceeding with deployment. Download azd here.

> Note: This solution accelerator also requires Bicep CLI version 0.33.0 or higher for compiling infrastructure templates. Install Bicep.

[Click here to launch the deployment guide](./docs/DeploymentGuide.md)

| --- | --- |

Before you deploy

Make sure you have:

• Azure CLI 2.58.0+
• Azure Developer CLI (azd) 1.9.0+
• PowerShell 7.x with Az modules
• Bicep CLI 0.33.0+
• Access to the target Azure subscription and Purview account
• Microsoft 365 compliance permissions if you plan to run m365

Review [Cost Guidance](./docs/CostGuidance.md) before deployment if you need to estimate Defender, Log Analytics, Purview, or Foundry-related spend.

How to install or deploy

1. Sign in to Azure

az login
azd auth login
Connect-AzAccount -Tenant -Subscription
Set-AzContext -Subscription

2. Prepare the spec file

azd up runs a preprovision hook that creates spec.local.json if it does not exist. The scaffold includes the minimum run parameters from your current azd and Azure CLI context and leaves optional sections empty so they can be filled in only when needed.

For a complete reference example, see [docs/spec-example.json](./docs/spec-example.json).

If you prefer to scaffold manually:

Copy-Item ./spec.dspm.template.json ./spec.local.json

# Bash command
cp ./spec.dspm.template.json ./spec.local.json

Then update spec.local.json with the values required for your scenario:

• tenant ID
• subscription ID
• resource group and location
• Purview account details
• Microsoft Foundry resource IDs if governing Foundry resources
• Fabric workspace or lakehouse label settings if using Fabric workflows

Use...