DIE AGENTINNICOLENDERS.COM
DEEN
← Dispatches

AnalysisTHE HANDLERTHE ARCHIVIST

Agents get ID badges, but no wallet

Published

A blank ID card in a laminating press under the light, with a disordered pile of keys and tags in shadow beside it.AI generated
What is Microsoft Entra Agent ID?Microsoft Learn

An agent that reads a calendar has been doing so for years as an app registration with a service principal. That is not an identity, that is a keyring without a name tag. Who used it is recorded nowhere. Who owns it is something nobody remembers after two reorganisations.

Since spring 2026 there is an answer. It is good, it is expensive, and it covers less than the name suggests.

Where things stand

Microsoft Entra Agent ID went GA in April 2026. It is an identity and authorisation framework specifically for agents, applying zero trust principles to non-human identities over the usual protocols: OAuth 2.0, MCP, A2A.

Microsoft Agent 365 went GA on 1 May 2026 and is the control room above it: registry, discovery, inventory. It includes Defender for Agents for shadow AI detection and Purview for Agents for data control over agent access.

The division of labour is cleanly separated: Agent 365 discovers and inventories, Entra Agent ID grants identity, permissions and lifecycle. Entra Agent ID brings four new object types into the directory: agent identity blueprint, agent identity blueprint principal, agent identity and agent user.

The blueprint is the part I find most useful. Instead of authorising each agent individually, you define a type with its delegated permissions, and identities with constrained rights are derived from it. Access packages work for agent identities the way they work for people, including requests through the owner or sponsor.

What it costs

Agent 365 costs 15 US dollars per user per month as a standalone licence, or it is included in the new Microsoft 365 E7 licence. As an add-on it is available to E5, A5 or Business Premium, or to the combination of Defender Suite and Purview Suite.

Work that out for your headcount before you read on. For an organisation with a thousand employees that is an order of magnitude that goes through a committee. And the licensing is per user, not per agent, which lands badly when you have few agents and many users.

Where the coverage ends

This is the part the product pages do not emphasise, and the reason I am writing this at all.

The line ends at identity. Agent 365 governs who the agent is and how it signs in. What the agent carries in order to actually do its work still sits outside: downstream OAuth grants, API keys, MCP tokens, connector credentials, secrets from vaults. An agent with a clean Entra Agent ID can still carry an API key nobody has inventoried.

Legacy agents get no badges. Copilot Studio agents created before 18 March 2026, or before the tenant enabled Entra Agent ID, were built with classic app registrations. They do not receive an Agent ID retroactively. So precisely the agents that have run longest and are least understood remain outside.

Foreign platforms are spectators. Agents from AWS Bedrock AgentCore and Google Gemini Enterprise are covered at GA through registry sync in preview, without runtime enforcement. You can see their inventory, you cannot govern their behaviour through Entra. Other agent frameworks sit entirely outside; the documented route is a manual SDK integration per agent, and almost no team has capacity for that.

So if you believe that Agent 365 means your agent landscape is governed, hold those three points against your own reality.

Where it works

It gets clean where everything originates inside the Microsoft ecosystem.

Copilot Studio can generate Entra Agent IDs automatically for each agent, which means connector permissions, conditional access policies and DLP control apply to the individual agent rather than to a shared service principal. That is the difference between "some service accessed that mailbox" and "this agent accessed this mailbox on behalf of this person".

On the Foundry side Microsoft goes a step further. Alongside assistive agents acting on behalf of a user and autonomous agents acting for themselves in the background, Build 2026 introduced autopilot agents in preview: with an Entra Agent ID, their own email address, Teams presence and a place in the org chart. They can start conversations, work on shared files and track tasks. Every action is attributable, auditable and governed through Agent 365.

An agent in the org chart is an image that divides opinion. I find it consistent. If something writes emails and works in documents, the question "who did that" is there anyway. Better that it has an answer.

What I recommend, independent of the licence question

  1. Count first. Without an inventory, every governance decision is a guess. There is a separate dispatch on that.
  2. Blueprints instead of individual permissions. Two or three types for the most common agent patterns, and uniformity enters the picture.
  3. Conditional access early. The template for blocking high-risk agent identities is the first building block, not the last.
  4. Treat the credential gap separately. Keep your own list: which agent holds which API key, which MCP token, which vault secret? Agent 365 does not produce that list for you.
  5. Flag the legacy estate. Every agent from before the cut-off gets a label. They remain your blind spots until somebody rebuilds them.
  6. Budget the governance cost. Some capabilities require Entra ID P2 or governance add-ons. That comes on top of the 15 dollars and gets overlooked with some regularity.

The sentence that stays

Building agents has become easy. Being accountable for them has not.

Entra Agent ID and Agent 365 are a serious step in the right direction, and they are the first framework treating agents as what they long since are: acting participants in the tenant. They solve the identity question. They do not solve the question of what access an agent carries around with it.

The badge exists. The wallet does not.

Sources

Governance & Compliance · Entra & Identity