Microsoft Entra Agent ID:
AI Agents Are Everywhere — And That’s a Problem
AI agents are no longer a future concept. Right now, they are reading your emails, analysing data, triggering workflows, and making decisions — all without a human clicking a single button.
Microsoft alone reports that more than 80% of Fortune 500 companies are deploying agents built with low-code and no-code tools. That is a staggering number, and it is growing every day.
But here’s the thing: most of those agents don’t have a proper identity. They run under shared service accounts, anonymous app registrations, or worse — nobody’s quite sure what they run under. This is what the industry calls agent sprawl, and it’s a security nightmare.
Microsoft’s answer is Microsoft Entra Agent ID — a dedicated identity framework that treats every AI agent the same way you’d treat a human employee: with its own identity, its own permissions, and its own audit trail.
| 💡 Key Stat
Microsoft itself runs 27,000 internal AI agents. Without Agent ID, governing that many non-human identities would be practically impossible. |
What Exactly Is Microsoft Entra Agent ID?
Think of Agent ID as a digital passport for your AI agents. Every agent gets a unique, trackable identity inside Microsoft Entra — the same identity platform that manages your users and devices.
Alex Simons, Microsoft’s Corporate VP for Identity Security, put it simply: it’s like a VIN number on a car — it automatically comes with every new agent and allows it to be tracked over time.
Before Agent ID, IT teams had no single place to see all agents. An agent created in Copilot Studio was managed separately from one built in Azure AI Foundry, which was totally different from a third-party tool. Visibility was fragmented, and governance was almost impossible.
Three Core Capabilities
Agent ID is built around three pillars:
- Register and Manage — Onboard every agent into a central directory, no matter where it was built.
- Govern Identities and Lifecycles — Assign owners, set access packages, and control the full lifecycle of each agent.
- Protect Agent Access — Apply Conditional Access, Identity Protection, and risk-based policies to agents, just like you do for users.
Agents built in Microsoft Copilot Studio, Azure AI Foundry, and Microsoft Security Copilot are already supported. Third-party agents can also be registered using standard protocols.
Why Traditional Identity Models Don’t Work for Agents
For decades, identity meant people and machines. A user logged in, a server authenticated — simple. AI agents don’t fit that model.
An agent can be assistive (acting on behalf of a user), autonomous (acting entirely on its own), or it can have its own user account (for accessing systems like mailboxes or Teams channels). Each pattern has its own security implications.
The deeper problem is trust. AI agents can read data, call APIs, modify records, and trigger downstream processes. They can be manipulated through prompt injection, access data far beyond their intended scope, or escalate their own privileges through a chain of multi-step actions.
Traditional service principals and app registrations weren’t designed for this. They lack the metadata, contextual attributes, and governance hooks that modern AI agents demand.
| ⚠️ The Risk Is Real
“The more access an AI agent has to corporate resources, the more powerful it becomes. Without deep identity context, there’s no way to make an informed, real-time decision about whether an agent’s action is legitimate or overreach.” — Ron Rasin, Chief Strategy Officer, Silverfort |
Conditional Access for Agents: The Policy Engine
Conditional Access is the crown jewel here. It’s an intelligent policy engine that evaluates every access request in real time — user context, agent context, device, location, session risk — and decides to allow, block, limit, or challenge the request before issuing a token.
The key insight is this: the same Conditional Access policies you already use for your human workforce now extend to AI agents. Same framework. Same intelligence. Applied to non-human identities.
How Token Evaluation Works
When an agent needs to access a resource — say, a SharePoint file or an MCP server — it requests an access token from Microsoft Entra ID. Conditional Access evaluates the configured policy requirements before any token is issued.
Every token has a subject (the identity receiving the token) and an audience (the specific resource it’s for). If an agent needs to access multiple resources, it needs separate tokens for each. This forces granular, scoped access by design.
If the policy requirements are satisfied, the token is issued. The target resource then validates the token and uses its claims to make authorization decisions. High risk signals? The agent is blocked instantly — no questions asked.
What Risk Signals Does Entra Monitor?
Conditional Access doesn’t just check identity — it evaluates live risk signals for every agent:
- Impossible travel (agent accessing from two locations simultaneously)
- Abnormal sign-in or API call patterns
- Suspicious IP addresses or tor exit nodes
- Unusual resource access attempts
- Token misuse or credential compromise indicators
- Behavioural anomalies based on historical baselines
When risk is flagged as high, the response is immediate: block the agent. No human needs to be in the loop.
The Three Agent Access Patterns
Understanding how your agents authenticate is critical for applying the right policies. Entra Agent ID defines three distinct patterns:
1. Delegated Access (On Behalf of a User)
The agent acts on behalf of a signed-in user. It holds delegated permissions and is effectively ‘wearing’ the user’s access for a specific task. Common in interactive assistants like customer support bots.
2. Application-Only (Autonomous Agent)
The agent is the subject. It authenticates directly with Entra ID using its own identity and the client credentials flow. This is the most powerful access model — and the one that demands the tightest controls.
3. Agent’s User Account
For agents that need to access systems designed for human users — like a shared mailbox, a Teams channel, or a document library — an optional 1:1 user account can be paired with the agent identity. Crucially, both must exist; one doesn’t replace the other.
Custom Security Attributes: Metadata That Powers Policy
One of the most powerful features of Agent ID is the ability to attach custom security attributes to any agent. These are key-value pairs you define — things like Environment: Production, Owner: HR-Team, or RiskClass: High.
These attributes then become the basis for Conditional Access policies. You can create a policy that says: any agent tagged with RiskClass: High must be blocked from production data unless it’s been explicitly approved by a named sponsor.
This is governance at scale — you’re not managing individual agents manually, you’re managing them through policy metadata. As your agent population grows to thousands, the framework scales with you.
Agent 365: The Bigger Picture
Agent ID is the identity foundation, but Microsoft has built an entire ecosystem around it — collectively called Agent 365. At Microsoft Build 2026, the company made several major moves in this space.
- Agent 365 SDK (GA) — Lets developers embed observability, access controls, and compliance enforcement directly into how an agent is designed, across any AI platform.
- Agent Registry — Uses Microsoft Defender, Entra, and Intune together to surface unmanaged local agents. Recognises 20+ agent types including MCP servers and coding agents.
- Microsoft Execution Containers (MXC) — OS-level runtime sandboxing for AI agents. Every agent is bound to a strong Entra identity so all actions can be attributed and audited.
- Windows 365 for Agents (GA) — Runs agents inside isolated, policy-governed Cloud PCs.
- Microsoft Purview DLP for Agents (Preview) — Catches sensitive data in agent prompts before it reaches a model.
Microsoft’s Corporate VP for Security, Vasu Jakkal, summed it up best: “In just the way we have been protecting humans for eons, we need to extend the same protection from a security standpoint to agents. And it starts with great observability, great security, and great governance.”
What IT Professionals Need to Do Now
If you’re responsible for security in a Microsoft environment, here’s the practical playbook:
1. Audit Your Agent Footprint
Use the Enterprise Applications view in the Entra admin center with the “Agent ID (Preview)” filter. Find out how many agents you actually have. You may be surprised.
2. Require Agent 365 Licenses
Conditional Access for agents requires Microsoft Entra ID P1 or P2 plus a Microsoft Agent 365 license per user. Network controls additionally require Microsoft Entra Internet Access. Plan your licensing accordingly.
3. Define Custom Security Attributes
Create a taxonomy for your agents. At minimum: environment (dev/test/prod), risk class, owning team, and purpose. These attributes drive your Conditional Access policies.
4. Build Conditional Access Policies for Agents
Start with a policy that blocks all high-risk agent sign-ins. Then layer in more nuanced controls: restrict production access to specific agents, require human approval for sensitive actions, enforce network location constraints.
5. Assign Sponsors
Every agent should have a named human sponsor — an accountable owner in the org. This is not just good hygiene; it’s your audit lifeline when something goes wrong.
The Bottom Line
AI agents are becoming as numerous — and as privileged — as your human workforce. The old approach of anonymous service principals and shared automation accounts simply doesn’t scale to this new reality.
Microsoft Entra Agent ID brings the same zero-trust identity principles that protect your people to your digital workers. It’s not just a product feature — it’s a foundational shift in how enterprise security needs to think about identity.
The organisations that get ahead of agent sprawl now will have a dramatically easier time governing AI at scale. The ones that wait will be chasing down orphaned agents with elevated privileges for years.
Agents are the new endpoints. Treat them like it.
