Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Every access decision needs an identity to evaluate, and every investigation needs an actor to distinguish. An agent that uses only its host application's identity is harder to govern as a separate participant in organizational work. Microsoft Agent 365 uses Microsoft Entra Agent ID to give an agent a distinct identity that administrators can name, apply policies to, and recognize in activity records.
That identity is the starting point for governance. It gives security controls a specific agent to evaluate rather than relying only on the platform or application that runs it.
Give each agent a distinct identity
A Microsoft Entra Agent ID identifies the agent itself. It gives the agent a directory presence and allows it to authenticate as an agent, with permissions assigned to that identity.
An agent identity is created from an agent identity blueprint, a reusable template that defines shared properties for a class of agents. The blueprint provides a common foundation; each agent receives its own identity. Administrators can therefore govern shared properties through the blueprint and still distinguish one agent from another.
Apply policies to the agent
An identity lets access policies target the agent that requests a resource. Microsoft Entra Conditional Access evaluates relevant conditions when it issues or refreshes an access token, allowing an organization to set access requirements for agent identities and blueprints.
The policy target depends on the identity that acts in a particular access pattern. An agent can act with its own identity, with a signed-in user's delegated access, or through an optional agent user account. Administrators can use this distinction to decide which identity a policy must cover.
Make agent activity attributable
An identity gives activity a recognizable agent actor. Microsoft Entra sign-in and audit records can identify agent identity activity and associate an agent identity with its blueprint. That context helps reviewers distinguish activity involving an agent from activity involving a person or another application.
Agent 365 brings the identity into the organization's governance view, so the same named agent can be considered in access decisions and reviewed in its operational context. The record supports investigation; it doesn't replace the need to decide what access the agent should have.
An agent becomes governable when the organization can target it as an identity. By connecting that identity to policies and activity records, Agent 365 gives administrators a concrete basis for applying controls to agents as their use expands.