Sitemap

Agent Identity Security controls …

--

From a Security perspective it is recommended to provide Security Controls for AI Agents as if they where humans entities like a manager, life-cycle management, least-privilege access, authentication & authorization, etc.

Owner & Sponsor

The Agent Identity Blueprint is the template for Agent Identities. It also serves as a container for IT management of all associated Agent Identities.

Press enter or click to view image in full size
Owner & Sponsor

Owner

The owner is a technical role (e.g., IT admin) who is responsible for IT management of the Agent Blueprint and Agent Identities. The owner role is set at the Agent Blueprint level (recommended, not on the Agent Identity level).

The owner is required on the Agent Identity Blueprint level

Press enter or click to view image in full size
Agent Identity Blueprint — Owner

Sponsor

The sponsor is a business role (e.g., department manager) who is financially responsible and accountable for the agent. This role is set on the Agent Blueprint and the Agent Identity (no inheritance).

The sponsor is required (at least) on the Agent Identity level

Press enter or click to view image in full size
Agent Identity-Sponsor

Manager

The manager is a day-to-day (optional) operations role (e.g., team lead) who handles operational tasks such as requesting access packages for users who need agent access. This role is only for Agent Users (Agent Identities with user attributes like UPN or mailNickname).

Press enter or click to view image in full size
Agent User-Manager

Security

The Entra ID — Agent ID portal provides an overview of all Agents.

Press enter or click to view image in full size
Entra Agent ID — Agent Overview
  • Agent identities (with no user) ✅Modern Agent Identity
  • Agent identities (with user) ✅ Modern Agent User
  • Agent with service principals ⚠️Classic Agent
  • Agents with no identities ⚠️Agent without an Agent Identity

An agent without an identity is a asset that introduces risk to the environment because it cannot authenticate to Entra and access control is not possible (e.g. Conditional Access)

Entra Portal

An agent identity without an owner or sponsor is a rogue asset that introduces risk to the environment.

Press enter or click to view image in full size
Unmanaged Agents

In the overview page, section Unmanaged provides the number of Agents without owner or manager.

Defender Portal

If Microsoft Copilot Studio is connected to the Defender for Cloud Apps — AI Agent inventory, the AIAgentsInfo table is added to the Advanced hunting table and provides the option to search (at-scale) for agents without owner. See blog for setup details.

AIAgentsInfo  
| where AgentStatus == "Published"
| where isempty(OwnerAccountUpns)
| project AgentCreationTime, AIAgentName, AIAgentId, AgentStatus, CreatorAccountUpn, OwnerAccountUpns

Permissions

Permissions are Microsoft Graph API permissions set for the agent to access resources in the Microsoft tenant. Delegated permissions are used for AI assistants, while Application permissions are used for autonomous agents.

Press enter or click to view image in full size
Graph API Permissions

Agent Blueprint permissions are inherited as base permissions by all Agent Identities. Custom permissions can be added per Agent Identity.

Privileged Microsoft Graph API permissions require admin consent. Highly privileged permissions are not allowed due to the risks posed by autonomous agents.

Permissions of the Agent Identity Blueprint or Agent Identity can be viewed via the Entra portal-Agent ID.

Press enter or click to view image in full size

Credentials

Credentials (app-only authentication) are used to authenticate Agents securely to Entra ID / Microsoft Graph to access resources and/or APIs without user interaction.

Press enter or click to view image in full size
Client Credentials Types

There are three types of client credentials, ordered from the most secure to the least secure.

  • Federated Identity Credentials (FIC) — A more modern approach that enables workload identity federation.
  • Certificates — X.509 certificates that provide stronger security than secrets. Self-signed certificates or certificates can be used.
  • Client Secrets — Password-based credentials that are strings generated. These have expiration dates and need to be rotated periodically.

Advise to use client secrets only in lab / demo environment and not in production

Security

The PowerShell script below provides an overview of all Agent Identity Blueprints configured with secret credentials. Agent Identities themselves do not have credentials. See the next chapter Authentication for more details.

# Lists ALL Agent Identity Blueprints that have at least 1 client secret (passwordCredential)

Connect-MgGraph -Scopes "Application.Read.All"

$uri = "https://graph.microsoft.com/beta/applications/graph.agentIdentityBlueprint?`$select=id,appId,displayName,passwordCredentials"
$all = @()

while ($uri) {
$r = Invoke-MgGraphRequest -Method GET -Uri $uri
$all += $r.value
$uri = $r.'@odata.nextLink'
}

$all |
Where-Object { $_.passwordCredentials -and $_.passwordCredentials.Count -gt 0 } |
ForEach-Object {
[pscustomobject]@{
DisplayName = $_.displayName
BlueprintId = $_.id
AppId = $_.appId
SecretCount = $_.passwordCredentials.Count
}
} |
Sort-Object DisplayName |
Format-Table -AutoSize

Authentication

Client credentials are configured on the Agent Identity Blueprint. The Agent Identity itself holds no credentials and is impersonated via the Blueprint during authentication flows.

Press enter or click to view image in full size
Authentication Flow

(1) The blueprint authenticates using its (2) credentials (secret, certificate, or FIC) to get an (3) Exchange Token [T1] from Microsoft Entra ID. The (4) agent identity presents the Token [T1] to prove “I’m an instance created from this blueprint” and (5) requests its Access Token [T2] to access (6) resources / Microsoft Graph or custom API.

The example below outputs the Exchange Token [T1]

$TenantId = "<Tenant-ID>"
$ClientId = "<Blueprint-ID>"
$clientSecret = "<secret>"

# Token endpoint
$tokenUrl = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"

# Create the request body
$body = @{
client_id = $ClientId
client_secret = $clientSecret
scope = "https://graph.microsoft.com/.default"
grant_type = "client_credentials"
}

# Get the access token
$response = Invoke-RestMethod -Method POST -Uri $tokenUrl -Body $body -ContentType "application/x-www-form-urlencoded"

$accessToken = $response.access_token
$accessToken

We can use a JWT (Java Web Token) Decoder to see the claims like aud (Microsoft Graph),d sub (Agent Identity Blueprint ID).

Press enter or click to view image in full size
Decoded JWT Token

No Authentication

Microsoft Copilot Studio has the option No authentication.

Press enter or click to view image in full size
Copilot Studio - Security - Authentication

Such (mis)configuration introduces a security risks because when the agent accesses resources requiring authentication, it authenticates as the agent’s creator, not the user interacting with it.

In the Advanced Hunting section -> Community queries, the Microsoft Product Group created some nice queries.

If AI Agent Inventory is enabled in Cloud Apps / Power Platform Admin center.

One of the queries is Copilot Studio AI agents without authentication mechanisms.

// This query identifies Copilot Studio AI agents without authentication mechanisms. Authentication is an agent-level configuration. 
// Such misconfiguration poses significant security risks because when the agent accesses resources requiring authentication, it authenticates as the agent's creator, not the user interacting with it.
// If the agent has access to sensitive information, this could allow users to access resources they shouldn`t. Additionally, it expands the attack surface: if an attacker compromises a user who can access such an agent, the attacker can also authenticate as the maker.
// This query was updated from https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/Microsoft%20365%20Defender/AI%20Agents/NoAuthenticationRequiredAIAgents.yaml
AIAgentsInfo
| summarize arg_max(Timestamp, *) by AIAgentId
| where AgentStatus != "Deleted"
| where AuthenticationTrigger == "As Needed" or UserAuthenticationType == "None"
| project-reorder AgentCreationTime, AIAgentId, AIAgentName, AgentStatus, CreatorAccountUpn, OwnerAccountUpns

That’s it for the third part of the blog series. Again, I hope it was informative and see you in the next one :-)

--

--