Exercise - Apply Conditional Access to an agent identity blueprint

  • 10 minutes

Relecloud's engineering team plans to spin up several more agents from the same blueprint as the fraud-investigation agent. Every one of them needs to be protected from the moment it's created.

Important

Prerequisites for this exercise:

  • A Microsoft 365 E7 (or Microsoft Agent 365 + Entra ID P1/E3) tenant with Conditional Access administrator access and the existing agent identity blueprint from earlier exercises.

Task 1: Apply Conditional Access at the blueprint level

  1. Sign in to the Microsoft Entra admin center at entra.microsoft.com, then go to Protection > Conditional Access > Policies, and select New policy.
  2. Name the policy Agent identities – fraud-investigation blueprint baseline.
  3. Under Users (or the agent-identity equivalent assignment), scope the policy to the agent identity blueprint itself—not to the single existing agent identity.
  4. Configure grant controls appropriate for a nonhuman identity (for example, requiring a compliant managed identity context, or blocking access when Microsoft Entra ID Protection reports elevated agent identity risk).
  5. Enable the policy and save.
  6. Reflect on the predict-before-reveal question this exercise resolves: if you'd scoped this policy to the one existing agent identity instead of the blueprint, would a brand-new agent identity created from the same blueprint next month inherit the same protection? No—only blueprint-level scoping extends the policy to every future identity the blueprint creates.

Task 2: Confirm the tenant's licensing model

  1. In the Microsoft 365 admin center, go to Billing > Your products and confirm the tenant holds either Microsoft 365 E7 (which bundles Microsoft Agent 365 and Microsoft Entra Suite together) or Microsoft Agent 365 paired with at least Microsoft Entra ID P1 or Microsoft 365 E3.
  2. Note which model your tenant uses, since it determines whether agent identity governance features—including this Conditional Access enforcement—are available at all.

You've now applied Conditional Access at the blueprint level, so every future agent identity Relecloud's engineering team creates from it inherits the same protection automatically, and confirmed the tenant's licensing model supports agent identity governance—closing the loop on the same enforcement discipline Relecloud already applies to human sign-ins, now extended to its agents.