A practical guide for identity and security teams responsible for agentic AI in Microsoft environments
Copilot agents, Microsoft Foundry agents, and third-party agents are arriving in Microsoft tenants faster than most identity teams can register, review, or restrict them. Each of them reads data, calls APIs, and acts for people or on its own, often with permissions nobody has looked at since the agent was created. Microsoft now provides two complementary building blocks to change that, and they work on different layers.
Microsoft Agent 365, generally available since May 1, 2026, is the control plane: a central registry that shows which agents exist across Microsoft, third-party, and custom platforms.
Microsoft Entra Agent ID is the identity layer: it gives agents their own identity type, with sponsors, owners, and access policies that Entra can enforce. In short, Agent 365 tells you which agents you have, and Entra Agent ID makes them governable.
This article explains how to inventory the agents already running in your tenant, whose ownership model keeps them accountable, and which guardrails belong on agent and non-human identity access. It builds on our webinar « Securing Agentic AI with Microsoft Entra » with Sebastian Schuck, Head of CoE Microsoft Europe at iC Consult.
Why Agents in Your Tenant Are Hard to Govern
Agents are rarely hidden on purpose. People create them quickly, across platforms, and the identity processes that govern employees and applications weren’t designed for them. Five patterns come up in almost every tenant we look at:
Agent sprawl: Anyone with a Copilot Studio license can build and share an agent. Without shared standards for naming, metadata, and review, the number of agents grows faster than anyone can track.
Mixed identity types: Depending on when and where an agent was built, it may run under an Entra agent identity, a classic app registration or service principal, or the delegated permissions of a user. Older Copilot Studio agents, for example, often still authenticate through conventional service principals.
Missing ownership: The person who built an agent is not necessarily the person who operates it, and neither of them may be accountable for its business purpose. When the creator changes teams, the agent usually stays.
Standing permissions: Agents often receive broad application permissions during a pilot. Those permissions are rarely reduced once the pilot turns into production.
Controls built for people: Agents authenticate machine-to-machine. There is no interactive sign-in, no MFA prompt, and no device context, so many Conditional Access policies written for employees do not apply.
For security and audit teams, this leaves a growing number of identities that can act on sensitive data without a clear answer to three basic questions. What is this agent, who is responsible for it, and what can it access?
How Do You Inventory the Agents in Your Tenant?
Governance starts with a baseline. Microsoft Agent 365 provides a central agent registry that discovers agents built in Copilot Studio and Microsoft Foundry, along with agents from third-party platforms and custom frameworks. During the preview, Microsoft reported tens of millions of agents in the Agent 365 registry across participating customers, which shows how quickly this population grows. Third-party and custom agents typically need to be registered, synchronized, or instrumented before they appear with full detail and controls.
A registry entry is not the same as a governed agent
One distinction is easy to miss. An agent that appears in the registry does not automatically have a Microsoft Entra Agent ID identity, and Entra’s identity controls only apply to agents that do. A useful first step in your agent inventory is therefore to sort every discovered agent into three groups (registered but running under conventional identities, not managed at all, and already governed through Entra Agent ID). That split shows where controls already work and where migration has to come first. Microsoft publishes migration guidance for custom app registrations and Copilot Studio agents.
Autonomous or on behalf of a user?
For each agent, find out how it reaches resources. In autonomous mode, an agent uses its own application permissions, such as Microsoft Graph application permissions or Azure RBAC assignments, and runs without a signed-in user. In on-behalf-of mode, it uses delegated permissions and can only reach what the signed-in user can reach. The risk profiles differ considerably, because an autonomous agent with tenant-wide Graph permissions needs far tighter review than an assistant limited to one person’s mailbox. Record the access mode together with the purpose, the data in scope, and the platform each agent runs on.
The Microsoft Building Blocks for Agent Governance
AI agent governance in Microsoft environments does not sit in a single product. Agent 365 and Entra Agent ID are the two anchors, but they are not interchangeable: Agent 365 shows which agents exist, and Entra Agent ID provides the identity that the other Entra controls build on. The table below shows which capability answers which governance question.
| Capability | What it does for agents | Governance question it answers |
|---|---|---|
| Microsoft Agent 365 | Central registry and control plane for Microsoft, third-party, and custom agents | Which agents exist in the tenant? |
| Microsoft Entra Agent ID | Dedicated identities for agents. Agent identity blueprints hold credentials and shared settings, agent identities are what the agent runs as, and optional agent users cover agents that need a mailbox or Teams presence. | What is this agent, and who is accountable for it? |
| Microsoft Entra ID Governance | Access packages for agent identities, access reviews, and lifecycle workflows that hand over sponsorship when a sponsor leaves | Should this agent still have this access? |
| Conditional Access and Microsoft Entra ID Protection | Risk detection for agent identities and policies built for agents, including templates that block high-risk agents and separate autonomous from on-behalf-of access | Under which conditions may the agent get a token? |
| Global Secure Access | Network-level control of agent traffic, including the MCP firewall (in preview) and discovery of unsanctioned AI apps through Entra Internet Access | Which tools and endpoints may the agent reach? |
| Microsoft Purview | Data security posture management (DSPM) for AI, data loss prevention, audit, and retention for agent interactions | Which data may flow into and out of the agent? |
| Microsoft Defender XDR | Threat detection for AI workloads and agent activity in security investigations | Is the agent behaving as expected? |
Licensing boundaries matter here. Agent 365 is available as a standalone license or as part of Microsoft 365 E7, while other capabilities sit in Entra ID P2, Entra ID Governance, or Entra Internet Access. Our article on Microsoft Entra ID license models explains the differences. Always confirm current entitlements with Microsoft or your licensing partner.
A Practical Governance and Ownership Model
Tools alone do not create accountability. A governance model for agents must work across people, process, and technology, and it should be short enough that teams follow it.
People: separate sponsors from owners
Entra Agent ID distinguishes two roles. Owners are the technical administrators who configure an agent and its access. Sponsors carry the business accountability: they can explain why the agent exists, which data it may touch, and when it should be retired. Because a sponsor is required when an agent identity or blueprint is created, ownership becomes the default rather than an afterthought. Keep the two roles with different people where possible, so accountability stays in place when a developer moves on.
Process: from registration to retirement
- Registration at creation: Every new agent is registered with a minimum set of metadata, covering a one-sentence purpose, sponsor, owner, environment, access mode, and data scope.
- Risk tiering: Agents with autonomous access to sensitive data get stricter approval and more frequent review than an on-behalf-of assistant.
- Expiry and renewal: Access ends by default unless the sponsor renews it.
- Periodic review: Sponsors confirm purpose and permissions in regular access reviews.
- Retirement: When an agent is no longer needed, its identity, permissions, and credentials are removed, not just disabled.
Technology: make the model enforceable
The model only holds if Entra enforces it. Agent identity blueprints let you apply policy once to every agent created from the same template. Access packages give agents time-bound access with an approval step instead of direct role assignments. Sponsor lifecycle workflows notify managers and co-sponsors and transfer sponsorship when a sponsor changes roles or leaves the company, which prevents orphaned agents. Agent users deserve particular care: they behave like people in the tenant, with group memberships and licenses, so they should be the exception and come with tighter scope and more frequent review.
Guardrails for Agent and Non-Human Identity Access
Once you know which agents exist and who is responsible for them, you can restrict what they are allowed to do. Most of the following guardrails apply to other non-human identities as well, such as service principals and managed identities.
Least privilege through access packages
Remove direct, standing role assignments from agents and move their permissions into access packages with expiration dates. Every permission then becomes a decision with an owner and an end date. It also produces the evidence auditors ask for, namely who approved the access, when, and for how long.
Conditional Access for agents, report-only first
Conditional Access now covers agent identities, with templates for blocking high-risk agents and for treating autonomous and on-behalf-of access differently. Microsoft Entra ID Protection assigns risk levels to agents based on signals such as unusual token or API activity. Start these policies in report-only mode, review the logs for a few weeks, and enforce them once you understand the impact. Custom security attributes help you target stricter policies at agents that reach sensitive resources.
Treat credentials as a security control
Microsoft advises against client secrets for agents in production. Certificates or federated identity credentials avoid long-lived secrets that end up in pipelines and scripts. Since the blueprint holds the credentials for all agent identities created from it, good credential hygiene at blueprint level covers many agents at once.
MCP security: control what agents can call
The Model Context Protocol (MCP) is how many agents connect to tools and data sources, and every MCP server an agent can reach extends what that agent can do. The Global Secure Access MCP firewall, in preview as of October 2026, inspects MCP traffic between agents and remote MCP servers. It can allow or block entire servers, individual tools, resources, or prompt templates, outdated protocol versions, and unencrypted connections, enforced through Conditional Access. The feature requires Microsoft Entra Internet Access and TLS inspection. Locale MCP servers that run on a device and do not communicate via MCP (HTTP) are not visible to it, so an approved list of MCP servers and controls on developer endpoints remain necessary.
Data protection, detection, and response
Identity controls limit what an agent may access. Data and detection controls limit the damage if something goes wrong anyway. Purview DSPM for AI shows where agents expose or overshare sensitive data, and Entra Internet Access helps uncover unsanctioned AI apps through traffic inspection. Connect agent activity to your identity threat detection and response (ITDR), Defender XDR, and SIEM, so your SOC can investigate an agent the same way it investigates a compromised account. A practical detail for your SIEM team: Entra audit logs record agent events under the Application Management category by default, so queries need to filter by object type to find them.
Where to Start
You do not need every control in place before agents can go live. A sequence that works in most tenants looks like this:
Inventory all agents with Agent 365, then check which of them already have an Entra Agent ID identity and which still run under conventional identities or are not managed at all.
Assign a sponsor and an owner to every blueprint and agent identity.
Move standing permissions into access packages with expiration dates.
Deploy Conditional Access for agents in report-only mode, then enforce.
Add MCP, data, and detection controls as the number of agents grows.
iC Consult: Your Partner for AI Agent Governance and Security
Microsoft provides the building blocks. Bringing them together in a tenant with hundreds of existing agents, mixed identity types, and several platforms is a project in its own right, and this is where our AI Agent Governance & Security engagement comes in. Delivered as an assessment and workshop over 20 to 50 days, it covers the full agent lifecycle:
- Discover: every agent in your tenant, from Microsoft, third-party platforms, and edge environments, using the Agent 365 registry
- Govern: each agent with Entra Agent ID and Conditional Access, with clear ownership
- Enforce: security at the MCP layer
- Protect: agent data and traffic with DLP, DSPM, and Global Secure Access
- Detect and respond: agent activity connected to ITDR, XDR, and SIEM
You get a full agent registry, managed identities with clear ownership, enforced access policy, and continuous monitoring. Moreover, you get a repeatable framework for onboarding future agents safely. We are one of the first partners to run hands-on Entra Agent ID pilots with clients, with a direct line to Microsoft’s product team. As a Microsoft Solutions Partner for Security and Modern Work with an Advanced Specialization in Identity and Access Management, we combine that product knowledge with experience from complex enterprise identity environments. Your identity team can then support the board’s AI agenda instead of being seen as the blocker.
Ready to bring the agents in your tenant under control?
Missed the webinar with Sebastian Schuck? Watch the recording for a walkthrough of agent discovery, the governance model, and MCP security in practice. If you want to know where your tenant stands today, talk to our Microsoft team.
