Security publish gate

Run a fixed security check before every publish, and treat it as a gate, not a suggestion. Verify "Require users to sign in" is On. Turn Connected Agents off unless you deliberately need them; the feature is on by default for new agents. Calls from other agents leave no trace in the called agent's Activity tab. Check every connector and channel you use against your DLP policies. Spot-check the audit log: documented gaps and a regression mean logging must be verified, not assumed.

• Before every publish, without exception.
• After every platform update, to re-verify that audit events still get logged.
• When you inherit an agent whose security settings nobody can vouch for.

1. Open the agent's authentication settings and confirm "Require users to sign in" is On.
2. Open the setting for Connected Agents.
3. Turn the feature Off unless another agent must call this one.
4. If it stays On, treat the agent as reachable by every agent in the same environment. Keep shared knowledge, tools, and topics minimal.
5. Ask your admin to check every connector and channel against the DLP policies in the Power Platform admin center.
6. Have the unauthenticated chat connector blocked by DLP if you do not use it.
7. Perform one audited action, such as a publish or a share, and confirm it appears in the audit log.
8. Publish only after every check passes.