Govern AI agent identities (ownership, sponsors, credentials and privileges)

Description

Agent identities, agent identity blueprints, blueprint principals and agent users in Microsoft Entra Agent ID are reviewed at least every 90 days against these rules:

• every agent identity has an existing, enabled blueprint principal, every blueprint principal has an existing blueprint, and every agent user has an existing parent agent identity;
• every agent identity, blueprint and blueprint principal has at least one enabled owner and a sponsor;
• enabled agent identities with no sign-in for {{ agent_inactivity_days }} days are disabled;
• blueprints have no expired or long-lived client secrets (CB-M365-APPS-006, CB-M365-APPS-007 apply), and no wildcard or plain http redirect URI (CB-M365-APPS-013);
• no agent identity, blueprint principal or agent user holds a privileged directory role or membership in a role-assignable group, and foreign (multitenant) agents hold no directory role at all;
• agent identities hold no high-risk Microsoft Graph permission (CB-M365-APPS-011 list);
• blueprints do not use the allAllowed inheritance pattern for delegated scopes or app roles, and blueprint principals require assignment for the app roles they expose.

Microsoft Entra Agent ID features are partly in preview. Copilot Studio agent hygiene in Power Platform is covered in the POWER domain.

Rationale

Agents multiply quickly and are often created by business users through Copilot Studio or third parties. Without an accountable human (sponsor) and regular review, agents keep permissions after their project ends, inherit everything their blueprint allows, and become an unattended path to data. A privileged agent is as dangerous as a privileged service principal, and harder to spot.

Impact

Sponsors must be named and must answer reviews. Disabling a dormant agent stops automations that run rarely; confirm with the sponsor first.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Agent ID > All agent identities (and the blueprint and agent user views) and review for each object: blueprint link, owners, sponsors, last sign-in, credentials, assigned roles and granted permissions.
3. Browse to Entra ID > Roles & admins and filter assignments on agent identities and agent users.
4. In Microsoft Graph (beta, scopes Application.Read.All, Directory.Read.All, AuditLog.Read.All), list agent identities and blueprints, their owners and sponsors, credentials, app role assignments and role assignments.
5. The Maester tests MT.1200 to MT.1213 and MT.1223 automate these checks and can be run in read mode as a reference.
6. Fail if any rule of the description is broken without a documented exception.

Remediation

1. Assign a sponsor and at least one owner to every agent identity and blueprint (My Account portal for sponsors and owners, or the admin center as Agent ID Administrator).
2. Delete orphaned agent identities, blueprint principals and agent users whose parent no longer exists.
3. Disable agent identities inactive for {{ agent_inactivity_days }} days after confirming with their sponsor.
4. Remove privileged directory roles and role-assignable group memberships from agents; remove high-risk Graph permissions or replace them with scoped ones.
5. On blueprints, remove secrets in favour of federated credentials or certificates, fix redirect URIs, replace allAllowed inheritance with an explicit list, and require assignment on exposed app roles.
6. Roles required: Agent ID Administrator; Privileged Role Administrator to remove role assignments and Graph app roles.

Rollback

Re-enable a disabled agent or restore a removed permission after review.

References

• Agent identity governance overview Microsoft, vendor-doc, accessed 2026-10-24
• What is Microsoft Entra Agent ID Microsoft, vendor-doc, accessed 2026-10-24
• Maester test catalogue (MT.1200 to MT.1213, MT.1223) Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-APPS-018 Block high-risk AI agents with Conditional Access
• related CB-M365-APPS-013 Remove unsafe redirect URIs from applications
• related CB-M365-TENANT-020 Restrict Copilot web search, agents and third-party AI providers
• related CB-M365-POWER-024 Govern the lifecycle of Copilot Studio agents

People and lifecycle