Feature request: Replace Global System Administrator Requirement with Distributed Satellite Collectors

Problem statement

User Story

As a Security Administrator, I want to deploy an optional satellite solution into agent environments so that inventory data can be collected using least-privilege access rather than a single over-privileged account.

Problem

Current collection architecture requires a service account with broad access across environments.

This introduces:

• Excessive permissions
• Audit concerns
• Insider risk
• Elevated breach impact
• Justification

Many enterprise security teams will not approve:

• Global System Administrator access
• Shared privileged accounts
• Broad environment-wide privileges

Least-privilege design is a security best practice.
Service Accounts in these circumstances sometimes have relaxed login methods.

Risk ⚠️

The risk is that a compromised Service Account that is used by the Agent Kit to access all the Power Platform environments with System Administrator security role has complete control over components, settings, schema, and data.

Proposed solution

Proposed Approach

Deploy: Agent Kit Satellite
Installed into each environment similar to how the Automation Kit use to work.

Solution Responsibilities:

• Read local agent metadata
• Read approved inventory tables
• Aggregate controlled data
• Publish inventory payloads back to central Agent Kit

Security Model

Create dedicated Security Role called: "Agent Kit Inventory Reader"

Role with:

• Read access only to the tables that it reads Agent Inventory & Usage details from.
• No create
• No update
• No delete
• No configuration rights

Tables with read access needed:

• 🎯TBC

Benefits

• Reduced attack surface
• Better security reviews
• Easier enterprise adoption
• Stronger compliance posture
• Most important of them all: Better chance of Power Platform admins and security team allow the Agent Kit to be setup.

Additional context

No response