Block high-risk AI agents with Conditional Access

Description

A Conditional Access policy targets All agent identities, with the Agent risk condition set to High, on All resources, and grants Block. A second policy with the same settings targets agents' user accounts (agent users) when the tenant has any.

Agent risk is a preview feature. Conditional Access for agents also requires an Agent 365 or Microsoft 365 E7 licence in addition to Entra ID P2; the control does not apply to a tenant without agent identities.

Rationale

AI agents act autonomously with delegated or application permissions, often across mail, files and line-of-business data. A compromised or hijacked agent (prompt injection, stolen blueprint credential, anomalous token use) can exfiltrate data at machine speed. Microsoft Entra ID Protection computes a risk level for agents; blocking high-risk agents stops the activity until an administrator investigates and dismisses or confirms the risk.

Impact

A legitimate agent flagged as high risk stops working until the risk is remediated. Agents that are not represented as agent identities in Microsoft Entra (for example agents that use a regular application registration) are not covered.

Applies when

Requires: Microsoft Entra ID P2

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State = On where:
   • Users, agents or workload identities > What does this policy apply to? = Agents, Include = All agent identities, with no exclusion;
   • Conditions > Agent risk includes High;
   • Target resources includes All resources;
   • Grant = Block access.
4. If agent users exist, check for an equivalent policy that targets agents' user accounts.
5. Alternative with Graph (scope Policy.Read.All): GET https://graph.microsoft.com/beta/identity/conditionalAccess/policies and look for a policy whose conditions target agent identities with high agent risk and whose grant control is block.
6. Fail if no such policy exists or if it is in Report-only or Off.

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Browse to Entra ID > Conditional Access > Policies and select New policy.
3. Name it, for example AGT - Block high-risk agents.
4. Users, agents or workload identities > What does this policy apply to? > Agents > Include > All agent identities.
5. Target resources > Include > All resources.
6. Conditions > Agent risk > Configure = Yes, select High.
7. Grant > Block access.
8. Set Enable policy to Report-only, review the results in the sign-in logs, then switch it to On.

Rollback

Set the policy to Report-only or Off.

References

• Target agent identities in Conditional Access policies Microsoft, vendor-doc, accessed 2026-10-24
• ID Protection for agents Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-APPS-019 Govern AI agent identities (ownership, sponsors, credentials and privileges)
• related CB-M365-TENANT-020 Restrict Copilot web search, agents and third-party AI providers
• related CB-M365-AUTH-031 Require MFA for risky sign-ins and block sign-ins at the highest risk levels

People and lifecycle