Entra Agent ID Portal explained
The Entra Agent Registry is the source of authority for Agent IDs in the Microsoft Tenant.
Agents can be created by Copilot Studio*, Azure AI Foundry*, Security Copilot, Agent 365 and Custom. The products with * requires an action to go from Classic to Modern Agents (advised).
The Agent ID | Overview portal provides an overview of all Agent ID information in the Microsoft Tenant.
❗I think there’s a bug in the Types of agents overview where the Agents with no identities are included in the Agents with service principals❗due to the creation of Agents in Copilot Studio > [Agent (Microsoft Copilot Studio] > All agent identities and the name after creation Copilot Studio == Agent Registry.
In this blog, we will explore each item in more detail.
Classic Agents are Agents created as Service Principals [App Registration] before the Entra Agent ID platform was released and/or enabled.
Modern Agents are Agent created from an Agent Identity Blueprint on the Agent ID platform.
See my previous blogs about how to enable Modern Agents or more in-depth architecture of the Agent Identity.
Agents in your tenant
Agents in your tenant [48] provides an overview of 1) all classic & modern Agents discovered in the Microsoft Tenant [22+4+13=39] both Active [38] and Disabled [1], and 3) with identity [39] and without identity [9].
The View all agent identities [39] shows all Agent identities (with no user) [22], Agent identities (with user) [4] and Agents with service principals [13].
The Agents without identities are not visible in this portal.
Recently created
Recently created [17] are all Agents created in the last 30 days.
Unmanaged
Unmanaged [5] are Agents without an Owner or Sponsor which is required for accountability of the Agent.
Classic Agents can only have an Owner while a Modern Agent can have an Owner and/or Sponsor (preferred). More info about owner or sponsor, see my previous blog.
At the time of writing there is no easy method to provide an overview of all Agents without Owner or Sponsor. I created a PowerShell script to provide an overview of all Modern agents without owner or sponsor.
This script does not support Classic agents (on purpose due to Security risk written in this blog), only Modern agents are supported.
Classic Studio Copilot Agents have the Power Virtual Agent Service & the user who created the agent as Owner. Classic AI Foundry Agents are ownerless by default.
Active
Active [38] are all the Agents in the All agent identities portal with status Active.
No identities
No identities [9] are Agents registered in the Agent Registry without an Identity. These Agents are referred as registry-only Agents.
Agent without identity are visible in the Agent registry with Has Agent ID = ❗No. See section Agents with service principals for more information.
Agent identities (with no user)
Agent identities (with no user) [22] are Modern Agents without an Agent User connected.
Agent identities (with user)
Agent identities (with user) [4] are Modern Agents with Agent User connected. More about Agent Users in my previous blog.
Agents with service principals
Agents with service principals [13] are Classic Agents. These type of Agents can be found in the App Registration / Enterprise Application section of Entra ID.
It is possible to rename the Enterprise Application which will reflect the name of the Agent in the All agent identities portal
Classic Agents cannot be protected by the Entra ID Agent ID Security products like ID Protection for Agents and Conditional Access for Agents. See my previous blog for more information.
Microsoft will provide a ‘migration / conversion’ tool in the future to migrate Classic Agents to Modern Agents with an Agent Identity and Agent Blueprint
An alternative solution is to enable the use of Modern Agents in Copilot Studio via the Power Platform Admin center, recreate the Agent and if all works as expected delete the old / classic agent.
Agent with no identities
See No identities section above which is exactly the same as Agents with no identities [9].
Agent blueprints
Agent blueprints [23] are the templates for one or more Agent Identities / Users [250 maximum Agent Identities per Blueprint].
Agent Identities inherit the base settings of the Blueprint like [Graph API] Access permissions and Roles / scopes. Also the Client Credentials [FIC, Certificate or Secret] are set on the Blueprint. More about Agent Blueprints in my previous blog.
Agent collections overview
Agent collections is a method of grouping Agents for ease of management, think of them like Security groups.
Disclaimer: only Agents from the Agent registry can be added to a collection.
The default groups are:
- Global is the Default, system-wide collection for organization-wide policies and governance rules
- Quarantined is the collection for agents that have been isolated due to security concerns or policy violations
- Custom collection(s) are optional and can be tailored to specific needs like business context or security requirements per country, department or function.
Agent Registry
Agent Registry is the central registration of all Agents.
The Agent Registry has the same overview of Agents as the Copilot Studio portal with information if the Agent is Modern (Has Agent ID ✅Yes) or Classic (Has Agent ID❗No).
When I look at the Agent 365 portal or the Security Dashboard for AI, I see very inconsistent numbers of Agents so I asked the Microsoft Product Groups for explanation.
16–02–2025 Answer Microsoft: Hard work is in progress, and eventual consistency will ensure an accurate source of truth across all Agent portals. 🙂
I hope this blog will help shine light on the complex world of Microsoft Agent IDs 🙏
