Agent Identity

Microsoft Entra agent identity - the identity object (inherits from servicePrincipal) used by an AI agent to authenticate. Bound to one agentIdentityBlueprint via agentIdentityBlueprintId; has its own owners and sponsors.

Part of the Microsoft Agent 365 inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Daily	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	Yes

Properties

Property	Type	Description	Automation placeholder
Account enabled	Boolean	True when the agent identity account is enabled. Setting this to false prevents all sign-ins.	{{AgentIdentity.AccountEnabled}}
Agent identity blueprint id	String	appId of the agent identity blueprint that defines the configuration for this identity. Use to join to the Agent Blueprint entity.	{{AgentIdentity.AgentIdentityBlueprintId}}
App role assignment count	Int32	Number of application permissions (appRoleAssignments) granted directly to the identity. Computed during inventory.	{{AgentIdentity.AppRoleAssignmentCount}}
Blueprint	Agent Blueprint	Resolved relation to the parent Agent Blueprint (matched by AgentIdentityBlueprintId == blueprint.AppId). Computed during inventory.	{{AgentIdentity.Blueprint}}
Blueprint name	String	Display name of the parent Agent Blueprint. Computed during inventory.	{{AgentIdentity.BlueprintName}}
Blueprint principal	Agent Blueprint Principal	Resolved relation to the agent identity blueprint principal that authorizes this identity. Computed by matching AgentIdentityBlueprintId == blueprintPrincipal.AppId. Disabling the principal kill-switches every identity sharing it.	{{AgentIdentity.BlueprintPrincipal}}
Blueprint principal name	String	Display name of the blueprint principal. Computed during inventory.	{{AgentIdentity.BlueprintPrincipalName}}
Created by app id	String	appId of the application that created the agent identity (set by Microsoft Entra ID).	{{AgentIdentity.CreatedByAppId}}
Created on	DateTime	Time the agent identity was created.	{{AgentIdentity.CreatedDateTime}}
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	{{AgentIdentity.CreatedTime}}
Delegated permission grant count	Int32	Number of OAuth2 delegated permission grants on the identity. Computed during inventory.	{{AgentIdentity.DelegatedPermissionGrantCount}}
Disabled by Microsoft	String	Microsoft-initiated disable status. Values: null (default), NotDisabled, DisabledDueToViolationOfServicesAgreement.	{{AgentIdentity.DisabledByMicrosoftStatus}}
Deactivated owner count	Int32	Number of registered owners whose Microsoft Entra user account is disabled (AccountEnabled == false). The owner is the human accountable for the identity's credentials, permissions, and incident response; a disabled owner account leaves that accountability non-functional. Resolved against the owners' user accounts during the cross-entity rollup pass; not a direct Graph property.	{{AgentIdentity.DisabledOwnerCount}}
Deactivated sponsor count	Int32	Number of registered sponsors whose Microsoft Entra user account is disabled (AccountEnabled == false). Every agent identity must have an accountable human sponsor; a disabled sponsor account breaks the access-review safety net. Resolved against the sponsors' user accounts during the cross-entity rollup pass; not a direct Graph property.	{{AgentIdentity.DisabledSponsorCount}}
Display Name	String		{{AgentIdentity.DisplayName}}
Has disabled agent user	Boolean	True when the agent user (1:1 child of this identity) has its account disabled while this identity is still active - a half-decommissioned agent. Resolved from the linked agent user during the cross-entity rollup pass; not a direct Graph property.	{{AgentIdentity.HasDisabledAgentUser}}
Id	String	Object id of the agent identity (servicePrincipal id).	{{AgentIdentity.Id}}
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	{{AgentIdentity.LastModifiedTime}}
Owner count	Int32	Number of owners registered on the identity. Computed during inventory; not a Graph property.	{{AgentIdentity.OwnerCount}}
Risk Score	Int32	Stores risk score	{{AgentIdentity.RiskScore}}
Risk Score Update	DateTime	Stores risk score update	{{AgentIdentity.RiskScoreLastUpdate}}
Risk Score Value	String	Stores risk score value like Low_Low	{{AgentIdentity.RiskScoreValue}}
Service principal type	String	Set to 'ServiceIdentity' for all agent identities.	{{AgentIdentity.ServicePrincipalType}}
Sponsor count	Int32	Number of sponsors registered on the identity. Computed during inventory; not a Graph property.	{{AgentIdentity.SponsorCount}}
Tags	String	Comma-separated tags on the identity. The Graph value is the union of identity-side tags and the parent blueprint's tags.	{{AgentIdentity.Tags}}

Relations

Relation	Service	Description
Agent Blueprint	Microsoft Agent 365	Microsoft Entra agent identity blueprint - a template (inherits from application) that defines the configuration agent identities created from it inherit. Holds credentials (keyCredentials, passwordCredentials, federatedIdentityCredentials), inheritable permissions, owners, and sponsors.
Agent Blueprint Principal	Microsoft Agent 365	Service principal record of an agent identity blueprint's addition to the tenant. Inherits from servicePrincipal; used for token issuance and audit. Linked to an agentIdentityBlueprint via appId.
Agent User	Microsoft Agent 365	Microsoft Entra agent user - a specialized user (inherits from user) for AI agents that need a user account (mailbox, Teams presence). One-to-one with a parent agent identity via identityParentId. Has manager + multi-sponsor relationships to real users.
Agent User	Microsoft Agent 365	When ConsentType=Principal, the agent user the grant is on behalf of. Null for tenant-wide AllPrincipals grants.
Agent Permission	Microsoft Agent 365	The permission scope this app-role assignment grants. Linking via this relation lets a single permission be opened to see every identity it is granted to.
User	Microsoft 365	Microsoft 365 user that owns the agent identity.
User	Microsoft 365	Microsoft 365 user that sponsors the agent identity.

Segments

Segment	Description
Identities without Owners	Lists agent identities that have no registered owners.
Identities without Sponsors	Lists agent identities that have no registered sponsors.

Actions

This object does currently not have any actions.

Policies that check this object

Policy	Severity	Description
Active Identity With a Disabled Agent User	Medium	Flags enabled agent identities whose linked agent user account has been disabled - a half-decommissioned agent.
Identity is active (likelihood)	Medium	Risk-probability factor: agent identities that are enabled and not disabled by Microsoft are reachable and therefore carry baseline likelihood for latent risks to surface.
Identity holds 5+ application permissions (likelihood)	Medium	Risk-probability factor: a broad set of application permissions widens the attack surface and increases the likelihood that one of them is misused.
Identity holds 5+ delegated permissions (likelihood)	Medium	Risk-probability factor: a broad set of delegated permissions widens the on-behalf-of attack surface.
Identity has a deactivated owner or sponsor (likelihood)	Medium	Risk-probability factor: an identity whose owner or sponsor account is disabled has no functioning oversight, raising the likelihood that drift or misuse goes unnoticed.
Microsoft-disabled identity still enabled (likelihood)	High	Risk-probability factor: an identity Microsoft flagged but the tenant left enabled is both suspected and reachable, the highest-likelihood state for an incident to surface.
Identity has no owners (likelihood)	High	Risk-probability factor: identities without a registered owner have no accountability, so misuse or drift goes unnoticed.
Microsoft-Disabled Identity Still Enabled	High	Flags agent identities that Microsoft disabled (DisabledDueToViolationOfServicesAgreement) but whose account is still enabled in the tenant.
Identity Has a Deactivated Owner or Sponsor	Medium	Flags agent identities whose owner or sponsor has a disabled Microsoft Entra user account.
Identity Has No Owners	High	Flags agent identities that have no owners registered.
Identity Has No Sponsors	High	Flags agent identities that have no sponsors registered.