Stop AI Agents from Going Rogue: Conditional Access for Entra Agent ID

The Problem

Your organization is rolling out AI agents — Copilot extensions, custom agents from Copilot Studio, third-party bots. But here’s the thing: these agents call APIs, access SharePoint data, and act on behalf of users. Right now, most tenants have zero Conditional Access policies covering agent identities. You wouldn’t let a new employee access everything without MFA. Why are your agents different?

The Nugget

Microsoft Entra Agent ID introduces first-class agent identities — and you can apply Conditional Access policies to them just like you do for users and workloads.

How to Set It Up

Prerequisites

Microsoft 365 Copilot license (required for Agent 365 / Frontier access)
Entra ID P1 (P2 for risk-based policies)
Conditional Access Administrator role

Create a Conditional Access Policy for High-Risk Agents

Sign in to the Microsoft Entra admin center
Navigate to Entra ID → Conditional Access → Policies → New policy
Under Assignments → Users, agents (Preview) or workload identities, select “Agents (Preview)”
Under Include, choose “All agent identities (Preview)”
Under Conditions, select the new “Agent risk” condition — set it to High
Under Grant, select Block access
Set to Report-only first, then switch to On after validation

What Agent Risk Detections Are Available?

DetectionWhat It CatchesUnfamiliar resource accessAgent targets resources it doesn’t usually accessSign-in spikeAbnormally high sign-in frequencyFailed access attemptAgent tries to access unauthorized resourcesSign-in by risky userAgent acts on behalf of a flagged user

Key Concepts to Know

Agent Identity Blueprint — A reusable template that groups agents of the same type (e.g., all “Sales Assistant Agents”). Apply policies at the blueprint level to govern at scale.
Sponsor — Every agent identity can have a human sponsor. If a security incident hits, Entra knows who to contact.
Agent Registry — Centralized view of all agents in your tenant, including shadow agents you didn’t know existed.

Why This Matters

Zero Trust for agents: Same Conditional Access framework you already know — now extended to non-human identities
Shadow agent detection: Agent Registry surfaces unmanaged agents before they become a risk
Risk-based blocking: Entra ID Protection flags agents behaving anomalously in real time
Scale governance: Blueprint-level policies mean you don’t manage agents one by one

💡 Pro Tip: Don’t skip the assignmentRequired property on your agent identity blueprints. Set it to true via Graph API to enforce explicit role assignment — otherwise any authenticated principal can access the agent. This is the agent equivalent of leaving your front door open.

PATCH https://graph.microsoft.com/v1.0/applications/<agent-app-id>

Get Started

Agent 365 (including Entra Agent ID) is generally available May 1, 2026. You can access it today via the Frontier preview program:

M365 Admin Center → Copilot → Settings → User access → Copilot Frontier → Enable

Then head to Entra Admin Center → Conditional Access → New Policy and start with report-only mode.

📖 Full docs: Microsoft Entra Agent ID | Conditional Access for Agents

Stop AI Agents from Going Rogue: Conditional Access for Entra Agent ID means applying identity based controls to autonomous agents before they access enterprise data. The practical goal is to make Conditional Access, Entra Agent ID, permissions and monitoring part of every AI agent rollout instead of treating agent access as an afterthought.