What Microsoft Entra Agent ID is and how it fits into existing services

AI agents are applications that pursue a goal, decide on their own and use tools: reading email, creating files, working on tickets. They are built in Microsoft Copilot Studio, Microsoft Foundry or on other platforms, often by business units rather than IT. That raises a question long settled for users: who is this agent, what may it do, and who answers for it?

This article explains what Microsoft Entra Agent ID does, how it fits into existing services and where the documentation still has gaps. All statements reflect the status as of October 2026.

Why do AI agents need their own identities?

For the board, the core point is that an agent with far-reaching rights that is not assigned to anyone is an account nobody monitors. If it acts wrongly or is taken over, it is hard to show who set it up and why it had those rights.

Technically, agents have mostly run on app registrations and service principals, the application identities in Microsoft Entra ID, which are designed for long-lived services operated by IT. Agents are created dynamically, in large numbers and sometimes only briefly. The goals include telling agent actions apart from human ones and keeping agents away from the most critical roles.

What is Microsoft Entra Agent ID?

Microsoft Entra Agent ID is Microsoft Entra’s identity and security framework for AI agents. The platform has been generally available since April 2026 and is available to all Microsoft Entra customers. It introduces dedicated object types:

• Agent identity: the account an agent uses to obtain access tokens. With it, an agent acts on its own or on behalf of a signed-in user with that user’s delegated rights.
• Agent identity blueprint: a template for agent identities of the same kind. Policies on the blueprint apply to all agents created from it, including future ones.
• Agent’s user account: optional, when an agent has to work like an employee with a mailbox and Teams access. It is bound to exactly one agent identity.

Agents in Microsoft Foundry receive agent identities automatically; for Copilot Studio, automatic creation can be enabled (preview, as of October 2026). Agents from other platforms can be integrated through an SDK or workload identity federation, without stored secrets.

Where can you see which agents exist in your tenant?

Agent identities appear in a dedicated view in the Microsoft Entra admin center. The agent registry, the directory of all agents, now lives in Microsoft Agent 365 in the Microsoft 365 admin center; Microsoft retired the registry views in the Entra admin center on 1 May 2026. Agent 365 has been generally available since May 2026 as the central place to observe, govern and secure agents.

One point matters for the inventory: an agent that works through a classic app registration or an API key does not automatically become an agent identity.

Who is accountable for an agent?

Microsoft distinguishes owners, who manage configuration and operations, from sponsors, who decide on purpose, lifecycle and access. In Copilot Studio, the creator is recorded as sponsor. If a sponsor leaves, sponsorship transfers automatically to their manager, and Lifecycle Workflows in Microsoft Entra ID Governance notify those involved. Someone is always responsible, which is what auditors look for.

How does Agent ID fit into Conditional Access, governance and PIM?

Conditional Access. Conditional Access for agents distinguishes three access patterns, each needing its own policy:

• If the agent acts on behalf of a user, that user’s policies apply.
• If it acts on its own, the policy targets the agent identity or the blueprint.
• If it works with its own user account, the policy targets “Agent users”; policies for “all users” explicitly do not apply.

Custom security attributes group agents, for example by department. Start new policies in report-only mode. A documented boundary: if an agent uses an API key instead of an Entra token, Conditional Access does not apply.

ID Governance. Agent identities can receive access through access packages with expiry and approval; the sponsor is notified before expiry. Access reviews can include agent identities. Parts of this area are still marked as preview (as of October 2026).

Roles and PIM. Agent identities can be selected in Privileged Identity Management. Highly privileged roles such as Global Administrator cannot be assigned to agents.

Detection and logs. Sign-in and audit logs attribute actions to the specific agent identity. Microsoft Entra ID Protection detects anomalous agent behaviour; agent risk is marked as preview (as of October 2026). Global Secure Access adds network controls for Copilot Studio agents. Microsoft Purview and Microsoft Defender are part of Agent 365 protection; check how far this extends per agent type.

Which licences are required?

The platform is available to all Entra customers. Conditional Access and ID Governance for agents, however, require Microsoft 365 E7 or a Microsoft Agent 365 licence plus at least Microsoft Entra ID P1 or Microsoft 365 E3. ID Protection for agents requires Microsoft Entra ID P2 during the preview. Licensing here changes often, so check before deciding.

What is still open or not clearly documented?

• Mixed status. The platform is generally available, but some features and documentation pages still carry a preview label. Build production dependencies only on features without it.
• Registry API. Microsoft plans to replace the registry Graph API with a new Agent 365 API; agents registered through the old one must be re-registered. No date was documented at the time of writing.
• Third-party agents only benefit if actively connected. Anthropic Claude agents, for example, currently do not appear in “AI observability” in Microsoft Purview.

What should an organisation with 50 or more employees do now?

The board does not have to choose a technology, but it should set a rule: no agent without an accountable person, approval and limited rights. For IT this means five steps:

1. Inventory agent identities, agents in Copilot Studio and Foundry, and app registrations and enterprise applications with broad Graph permissions.
2. Assign accountability. Every agent and critical app registration gets an owner and a sponsor. Whatever nobody claims is disabled.
3. Limit rights. Replace broad permissions such as read access to all sites with narrow, time-limited rights.
4. Control consent. Check whether users may grant permissions to applications and agents themselves, and introduce an approval process.
5. Prepare policies. Create Conditional Access policies for agents in report-only mode and include agents in recurring access reviews.

The next step

In many organisations, agents are built faster than they are inventoried. How we make AI adoption, including agents, audit-ready is described on our AI Foundation page. The foundations in Entra ID, SharePoint and Purview that agents also rely on are covered in How to make AI adoption succeed with Entra ID, Purview, SharePoint and OneDrive.

Book an introductory call

Frequently Asked Questions

Is Microsoft Entra Agent ID generally available?

The Agent ID platform has been generally available since April 2026 and can be used by all Entra customers. Individual features, such as risk detection for agents or automatic creation of agent identities for Copilot Studio, are still marked as preview (as of October 2026).

How does an agent identity differ from a service principal?

Service principals are designed for long-lived applications with a known operator; agent identities for agents created dynamically and in large numbers. They come from blueprints, have sponsors and can be targeted specifically by Conditional Access and ID Governance.

What is a sensible first step for a mid-sized organisation?

An inventory of all agents and app registrations with their permissions and accountable owners. It shows where rights are too broad and where nobody is responsible. Most protections, such as Conditional Access for agents, also require an Agent 365 licence, which belongs in the planning.