Social services is publishing a new permitting status agent and must control who can use it. Which admin task comes first?

Before broad publication, social services must configure which municipal groups may use the permitting status agent. Agent administration fundamentals put audience and access configuration ahead of wide release so only intended Microsoft 365 groups or security groups can invoke the agent. Controlling who can use the agent first prevents an over-broad launch that exposes permitting status workflows to the wrong callers.

Publishing the permitting status agent to the Teams app catalog for org-wide availability fails by concept as a first step for a municipal permitting agent that needs controlled use—app-catalog availability is not access control and does not restrict who can invoke the agent. Assigning Dataverse table security roles for the permitting status agent for data access fails as the first access-control step because table permissions govern what data can be accessed, not who can invoke the agent; agent access is administered with identity and group concepts. Configuring tenant data loss prevention policies for the permitting status agent connectors fails as the first access-control step because connector policies govern which connectors and data sources may be used, they do not restrict which municipal groups can invoke the agent.

Exam caveat: AB-900 Domain 3 covers configuring user access to agents, including which groups can use an agent, as a prerequisite discipline before broad publication. Do not confuse configuring access with publishing to the Teams app catalog for org-wide availability, and do not delay access controls to configure tenant data loss prevention policies for connectors first.

Operational check: Identify the social-services and permitting groups that should invoke the status agent, configure agent access for those groups only, verify a test user inside the group can invoke and a user outside cannot, document the access decision for audit, then proceed to broader publication steps without treating Teams app-catalog publication as a substitute for access controls.