Agent Identity Security controls …
From a Security perspective it is recommended to provide Security Controls for AI Agents as if they where humans entities like a manager, life-cycle management, least-privilege access, authentication & authorization, etc.
Owner & Sponsor
The Agent Identity Blueprint is the template for Agent Identities. It also serves as a container for IT management of all associated Agent Identities.
Owner
The owner is a technical role (e.g., IT admin) who is responsible for IT management of the Agent Blueprint and Agent Identities. The owner role is set at the Agent Blueprint level (recommended, not on the Agent Identity level).
The owner is required on the Agent Identity Blueprint level
Sponsor
The sponsor is a business role (e.g., department manager) who is financially responsible and accountable for the agent. This role is set on the Agent Blueprint and the Agent Identity (no inheritance).
The sponsor is required (at least) on the Agent Identity level
Manager
The manager is a day-to-day (optional) operations role (e.g., team lead) who handles operational tasks such as requesting access packages for users who need agent access. This role is only for Agent Users (Agent Identities with user attributes like UPN or mailNickname).
Security
The Entra ID — Agent ID portal provides an overview of all Agents.
- Agent identities (with no user) ✅Modern Agent Identity
- Agent identities (with user) ✅ Modern Agent User
- Agent with service principals ⚠️Classic Agent
- Agents with no identities ⚠️Agent without an Agent Identity
An agent without an identity is a asset that introduces risk to the environment because it cannot authenticate to Entra and access control is not possible (e.g. Conditional Access)
Entra Portal
An agent identity without an owner or sponsor is a rogue asset that introduces risk to the environment.
In the overview page, section Unmanaged provides the number of Agents without owner or manager.
Defender Portal
If Microsoft Copilot Studio is connected to the Defender for Cloud Apps — AI Agent inventory, the AIAgentsInfo table is added to the Advanced hunting table and provides the option to search (at-scale) for agents without owner. See blog for setup details.
AIAgentsInfo
| where AgentStatus == "Published"
| where isempty(OwnerAccountUpns)
| project AgentCreationTime, AIAgentName, AIAgentId, AgentStatus, CreatorAccountUpn, OwnerAccountUpnsPermissions
Permissions are Microsoft Graph API permissions set for the agent to access resources in the Microsoft tenant. Delegated permissions are used for AI assistants, while Application permissions are used for autonomous agents.
Agent Blueprint permissions are inherited as base permissions by all Agent Identities. Custom permissions can be added per Agent Identity.
Privileged Microsoft Graph API permissions require admin consent. Highly privileged permissions are not allowed due to the risks posed by autonomous agents.
Permissions of the Agent Identity Blueprint or Agent Identity can be viewed via the Entra portal-Agent ID.
Credentials
Credentials (app-only authentication) are used to authenticate Agents securely to Entra ID / Microsoft Graph to access resources and/or APIs without user interaction.
There are three types of client credentials, ordered from the most secure to the least secure.
- Federated Identity Credentials (FIC) — A more modern approach that enables workload identity federation.
- Certificates — X.509 certificates that provide stronger security than secrets. Self-signed certificates or certificates can be used.
- Client Secrets — Password-based credentials that are strings generated. These have expiration dates and need to be rotated periodically.
Advise to use client secrets only in lab / demo environment and not in production
Security
The PowerShell script below provides an overview of all Agent Identity Blueprints configured with secret credentials. Agent Identities themselves do not have credentials. See the next chapter Authentication for more details.
# Lists ALL Agent Identity Blueprints that have at least 1 client secret (passwordCredential)
Connect-MgGraph -Scopes "Application.Read.All"
$uri = "https://graph.microsoft.com/beta/applications/graph.agentIdentityBlueprint?`$select=id,appId,displayName,passwordCredentials"
$all = @()
while ($uri) {
$r = Invoke-MgGraphRequest -Method GET -Uri $uri
$all += $r.value
$uri = $r.'@odata.nextLink'
}
$all |
Where-Object { $_.passwordCredentials -and $_.passwordCredentials.Count -gt 0 } |
ForEach-Object {
[pscustomobject]@{
DisplayName = $_.displayName
BlueprintId = $_.id
AppId = $_.appId
SecretCount = $_.passwordCredentials.Count
}
} |
Sort-Object DisplayName |
Format-Table -AutoSizeAuthentication
Client credentials are configured on the Agent Identity Blueprint. The Agent Identity itself holds no credentials and is impersonated via the Blueprint during authentication flows.
(1) The blueprint authenticates using its (2) credentials (secret, certificate, or FIC) to get an (3) Exchange Token [T1] from Microsoft Entra ID. The (4) agent identity presents the Token [T1] to prove “I’m an instance created from this blueprint” and (5) requests its Access Token [T2] to access (6) resources / Microsoft Graph or custom API.
The example below outputs the Exchange Token [T1]
$TenantId = "<Tenant-ID>"
$ClientId = "<Blueprint-ID>"
$clientSecret = "<secret>"
# Token endpoint
$tokenUrl = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"
# Create the request body
$body = @{
client_id = $ClientId
client_secret = $clientSecret
scope = "https://graph.microsoft.com/.default"
grant_type = "client_credentials"
}
# Get the access token
$response = Invoke-RestMethod -Method POST -Uri $tokenUrl -Body $body -ContentType "application/x-www-form-urlencoded"
$accessToken = $response.access_token
$accessTokenWe can use a JWT (Java Web Token) Decoder to see the claims like aud (Microsoft Graph),d sub (Agent Identity Blueprint ID).
No Authentication
Microsoft Copilot Studio has the option No authentication.
Such (mis)configuration introduces a security risks because when the agent accesses resources requiring authentication, it authenticates as the agent’s creator, not the user interacting with it.
In the Advanced Hunting section -> Community queries, the Microsoft Product Group created some nice queries.
If AI Agent Inventory is enabled in Cloud Apps / Power Platform Admin center.
One of the queries is Copilot Studio AI agents without authentication mechanisms.
// This query identifies Copilot Studio AI agents without authentication mechanisms. Authentication is an agent-level configuration.
// Such misconfiguration poses significant security risks because when the agent accesses resources requiring authentication, it authenticates as the agent's creator, not the user interacting with it.
// If the agent has access to sensitive information, this could allow users to access resources they shouldn`t. Additionally, it expands the attack surface: if an attacker compromises a user who can access such an agent, the attacker can also authenticate as the maker.
// This query was updated from https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/Microsoft%20365%20Defender/AI%20Agents/NoAuthenticationRequiredAIAgents.yaml
AIAgentsInfo
| summarize arg_max(Timestamp, *) by AIAgentId
| where AgentStatus != "Deleted"
| where AuthenticationTrigger == "As Needed" or UserAuthenticationType == "None"
| project-reorder AgentCreationTime, AIAgentId, AIAgentName, AgentStatus, CreatorAccountUpn, OwnerAccountUpnsThat’s it for the third part of the blog series. Again, I hope it was informative and see you in the next one :-)
