{
  "id": "CB-M365-APPS-019",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-019",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-019.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-019.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-APPS-019",
    "title": "Govern AI agent identities (ownership, sponsors, credentials and privileges)",
    "finding": {
      "title": "AI agent identities lack accountable owners or hold excessive privileges and credentials",
      "description": "Orphaned, dormant or over-privileged agent identities and blueprints give an attacker autonomous access to tenant data that nobody reviews."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "ai-agents",
      "agent-id",
      "workload-identities",
      "governance",
      "least-privilege"
    ],
    "description": "Agent identities, agent identity blueprints, blueprint principals and agent users in Microsoft\nEntra Agent ID are reviewed at least every 90 days against these rules:\n\n- every agent identity has an existing, enabled blueprint principal, every blueprint principal\n  has an existing blueprint, and every agent user has an existing parent agent identity;\n- every agent identity, blueprint and blueprint principal has at least one enabled owner and a\n  sponsor;\n- enabled agent identities with no sign-in for **{{ agent_inactivity_days }}** days are disabled;\n- blueprints have no expired or long-lived client secrets (CB-M365-APPS-006,\n  CB-M365-APPS-007 apply), and no wildcard or plain `http` redirect URI (CB-M365-APPS-013);\n- no agent identity, blueprint principal or agent user holds a privileged directory role or\n  membership in a role-assignable group, and foreign (multitenant) agents hold no directory role\n  at all;\n- agent identities hold no high-risk Microsoft Graph permission (CB-M365-APPS-011 list);\n- blueprints do not use the `allAllowed` inheritance pattern for delegated scopes or app roles,\n  and blueprint principals require assignment for the app roles they expose.\n",
    "rationale": "Agents multiply quickly and are often created by business users through Copilot Studio or third\nparties. Without an accountable human (sponsor) and regular review, agents keep permissions\nafter their project ends, inherit everything their blueprint allows, and become an unattended\npath to data. A privileged agent is as dangerous as a privileged service principal, and harder\nto spot.\n",
    "impact": "Sponsors must be named and must answer reviews. Disabling a dormant agent stops automations that\nrun rarely; confirm with the sponsor first.\n",
    "notes": "Microsoft Entra Agent ID features are partly in preview. Copilot Studio agent hygiene in Power\nPlatform is covered in the POWER domain.\n",
    "parameters": [
      {
        "name": "agent_inactivity_days",
        "type": "integer",
        "description": "Number of days without sign-in after which an enabled agent identity is disabled.",
        "unit": "days",
        "default": 180,
        "minimum": 30
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Agent ID** > **All agent identities** (and the blueprint and agent\n   user views) and review for each object: blueprint link, owners, sponsors, last sign-in,\n   credentials, assigned roles and granted permissions.\n3. Browse to **Entra ID** > **Roles & admins** and filter assignments on agent identities and\n   agent users.\n4. In Microsoft Graph (beta, scopes `Application.Read.All`, `Directory.Read.All`,\n   `AuditLog.Read.All`), list agent identities and blueprints, their owners and sponsors,\n   credentials, app role assignments and role assignments.\n5. The Maester tests MT.1200 to MT.1213 and MT.1223 automate these checks and can be run in read\n   mode as a reference.\n6. Fail if any rule of the description is broken without a documented exception.\n"
    },
    "remediation": {
      "manual": "1. Assign a sponsor and at least one owner to every agent identity and blueprint (My Account\n   portal for sponsors and owners, or the admin center as Agent ID Administrator).\n2. Delete orphaned agent identities, blueprint principals and agent users whose parent no\n   longer exists.\n3. Disable agent identities inactive for {{ agent_inactivity_days }} days after confirming with\n   their sponsor.\n4. Remove privileged directory roles and role-assignable group memberships from agents; remove\n   high-risk Graph permissions or replace them with scoped ones.\n5. On blueprints, remove secrets in favour of federated credentials or certificates, fix redirect\n   URIs, replace `allAllowed` inheritance with an explicit list, and require assignment on\n   exposed app roles.\n6. Roles required: Agent ID Administrator; Privileged Role Administrator to remove role\n   assignments and Graph app roles.\n",
      "rollback": "Re-enable a disabled agent or restore a removed permission after review.\n"
    },
    "references": [
      {
        "title": "Agent identity governance overview",
        "url": "https://learn.microsoft.com/entra/id-governance/agent-id-governance-overview",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "What is Microsoft Entra Agent ID",
        "url": "https://learn.microsoft.com/entra/agent-id/identity-platform/what-is-agent-id",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester test catalogue (MT.1200 to MT.1213, MT.1223)",
        "url": "https://maester.dev/docs/tests/",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      },
      {
        "framework": "mitre-attack",
        "id": "T1098"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-APPS-018",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-013",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-020",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-024",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}