Microsoft adds automatic removal of AI agent accounts in Entra

Microsoft added governance and access controls to Entra, its identity system for staff, guests and AI agents, for commercial customers. New lifecycle policies remove guest accounts and AI agent identities that are not necessary, and drift reports show access that does not agree with policy. Microsoft gave no test results, and administrators must examine policies before they use them.

What is new

• Drift reports show access that does not agree with policy.
• Lifecycle policies remove guest and AI agent accounts that are not necessary.
• The system changes access in minutes when it gets device and user risk signals.

Passkeys (sign in with no password) work in more sign in methods.

The proof

Microsoft gave no test results or numbers for these tools.

What is not known

Automatic removal can decrease risk. But an incorrect policy can stop a person who must have access. Sign in with more safety can add work for users. Administrators must examine lifecycle, sign in and network adjustments before they deploy.

Insight: Microsoft treats agents as one more identity

On 19 October, Microsoft told that agents start with no access and have less access when risk increases. Entra at this time adds an end date: agent accounts end as guest accounts do. This reads as a move to apply its identity system to agents, and the identity tool that a company has can control agents. Monitor if agents from other vendors fit the same policies.