AI agents are identities
May 21st, 2025 by Jesper Kråkhede
At Build this month Microsoft introduced Microsoft Entra Agent ID, a way to give AI agents their own identities in the directory. That may sound like a small detail. It isn´t.
An AI agent that reads mail, files tickets, queries databases or changes configurations needs permissions to do so. Today, many agents run with the permissions of the user who started them, or with a service account or app registration that someone created and forgot. We have spent twenty years learning how dangerous forgotten service accounts with too many rights are. We are about to do it again, at a much larger scale.
So treat agents like what they are: identities. Every agent should have its own identity, so you know which agent did what. It should have an owner, a person responsible for it. It should have the least privilege it needs, and nothing more. Its access should be reviewed regularly, and removed when the agent is no longer used. And its activity should be logged and monitored like any other identity, with alerts on unusual behaviour.
Conditional Access, access reviews and lifecycle management, everything we built for users and service accounts, should apply to agents too.
The scary part is the numbers. Users are counted in thousands. Agents may soon be counted in tens of thousands, created by anyone with a few clicks.
Every agent you can´t see is a service account you forgot.