{
  "id": "CB-M365-APPS-018",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-018",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-018.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-018.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-APPS-018",
    "title": "Block high-risk AI agents with Conditional Access",
    "finding": {
      "title": "AI agents flagged as high risk keep access to organizational resources",
      "description": "When ID Protection detects that an agent identity is likely compromised, nothing stops it from continuing to call Microsoft Graph and other resources with its permissions."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "ai-agents",
      "agent-id",
      "conditional-access",
      "identity-protection",
      "workload-identities"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P2"
      ]
    },
    "description": "A Conditional Access policy targets **All agent identities**, with the **Agent risk** condition\nset to **High**, on **All resources**, and grants **Block**. A second policy with the same\nsettings targets agents' user accounts (agent users) when the tenant has any.\n",
    "rationale": "AI agents act autonomously with delegated or application permissions, often across mail, files\nand line-of-business data. A compromised or hijacked agent (prompt injection, stolen blueprint\ncredential, anomalous token use) can exfiltrate data at machine speed. Microsoft Entra ID\nProtection computes a risk level for agents; blocking high-risk agents stops the activity until\nan administrator investigates and dismisses or confirms the risk.\n",
    "impact": "A legitimate agent flagged as high risk stops working until the risk is remediated. Agents that\nare not represented as agent identities in Microsoft Entra (for example agents that use a\nregular application registration) are not covered.\n",
    "notes": "Agent risk is a preview feature. Conditional Access for agents also requires an Agent 365 or\nMicrosoft 365 E7 licence in addition to Entra ID P2; the control does not apply to a tenant\nwithout agent identities.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies**.\n3. Find a policy with **State** = **On** where:\n   - **Users, agents or workload identities** > **What does this policy apply to?** =\n     **Agents**, **Include** = **All agent identities**, with no exclusion;\n   - **Conditions** > **Agent risk** includes **High**;\n   - **Target resources** includes **All resources**;\n   - **Grant** = **Block access**.\n4. If agent users exist, check for an equivalent policy that targets agents' user accounts.\n5. Alternative with Graph (scope `Policy.Read.All`):\n   `GET https://graph.microsoft.com/beta/identity/conditionalAccess/policies` and look for a\n   policy whose conditions target agent identities with high agent risk and whose grant control\n   is `block`.\n6. Fail if no such policy exists or if it is in Report-only or Off.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies** and select **New policy**.\n3. Name it, for example `AGT - Block high-risk agents`.\n4. **Users, agents or workload identities** > **What does this policy apply to?** > **Agents** >\n   **Include** > **All agent identities**.\n5. **Target resources** > **Include** > **All resources**.\n6. **Conditions** > **Agent risk** > **Configure** = **Yes**, select **High**.\n7. **Grant** > **Block access**.\n8. Set **Enable policy** to **Report-only**, review the results in the sign-in logs, then switch\n   it to **On**.\n",
      "rollback": "Set the policy to **Report-only** or **Off**.\n"
    },
    "references": [
      {
        "title": "Target agent identities in Conditional Access policies",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/howto-target-agent-identities",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ID Protection for agents",
        "url": "https://learn.microsoft.com/entra/id-protection/concept-risky-agents",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.9.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2(12)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      },
      {
        "framework": "mitre-attack",
        "id": "T1528"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-APPS-019",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-020",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-031",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}