Microsoft Entra Agent ID
Conditional AccessTarget agents in Microsoft Entra Conditional Access policies
In brief
The article now uses a scenario-based structure, explains that conditions and controls depend on the token subject, and links separately to guidance for agent identities and agent user accounts. Terminology, metadata, and related links were also updated.
What Entra admins need to know
Administrators can identify the token subject first, then follow the applicable policy guidance for autonomous agents or agents acting as users.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
#customer intent: As an identity administrator, I want to target agents in Conditional Access policies so that each policy applies to the correct agent identity or agent user account.
Target agent identities in Microsoft Entra Conditional Access policies
Use this article to select agent identities or agent user accounts in a Conditional Access policies for agent identities let you control how AI agentspolicy, choose target resources, configure supported conditions, and select access corporate resources. As your organization deploys more agents, you need policies that targetcontrols.
The available conditions and controls depend on the token subject. To choose the right agents, evaluatesubject before you build the right signals, and enforce the right controls. To learn more about how Conditional Access policies for agents work for different scenarios,policy, see Conditional Access for agents overview.
This article walks through each section of the Conditional Access policy builder for agents:
Selecting which agents the policy applies toChoosing target resourcesConfiguring conditionsSetting access controls.
Each section builds on the previous one to form a complete policy.
Prerequisites
Create a Conditional Access policy for agent identities
Policies that target agent identities introduce uniqueor agent user accounts have assignment options, conditions, and control limitationscontrols that differ from user-targeted policies.
- For policies that target agent identities, see Secure autonomous agents with Conditional Access.
Configure policy for on-behalf-of agent accessFor policies that target agent user accounts, see Secure agents that act as users with Conditional Access.
To create a new Conditional Access policy for agent identities:
- Policies targeting all users don't include agent's user accounts.
- The agent users option targets agents' user accounts. This option is currently in Preview.
- Agent-based policies apply when agents access resources using their own identity, not on behalf of a user.
- Targeting a blueprint automatically covers all agent identities derived from it, including ones added in the future. For more
information about targeting agent identity blueprints,information, see Agent identity blueprints.
Target resources
- Block access: Deny the agent user account access to resources.
- Grant access with:
- Require device to be marked as compliant: Requires agents to run on Intune-managed compliant devices, such as Windows 365 Cloud PCs for Agents. For more information, seeWhat is Windows 365 for Agents?. :::image type="content" source="media/howto-target-agent-identities/agent-policy-grant-device-compliant.png" alt-text="Screenshot of the Conditional Access policy builder showing the grant option for device compliance." lightbox="media/howto-target-agent-identities/agent-policy-grant-device-compliant.png":::
Related content
@@ -1,26 +1,23 @@ ----title: Target agent identities in Conditional Access policies+title: Target agents in Microsoft Entra Conditional Access policies description: Learn how to select and target agent identities in Microsoft Entra Conditional Access policies using the object picker, blueprints, and custom security attributes.+author: gracenagy+ms.author: gracenagy+ms.service: entra-id ms.topic: how-to-ms.date: 06/02/2026+ms.date: 07/31/2026 ms.reviewer: kvenkit-ms.custom: msecd-doc-authoring-1012+ms.custom: msecd-doc-authoring-1017 ai-usage: ai-assisted-#customer-intent: As an identity administrator, I want to target agent identities in Conditional Access policies so that I can enforce access controls on AI agents operating in my organization.------# Target agent identities in Conditional Access policies -Conditional Access policies for agent identities let you control how AI agents access corporate resources. As your organization deploys more agents, you need policies that target the right agents, evaluate the right signals, and enforce the right controls. To learn more about how Conditional Access policies for agents work for different scenarios, see [Conditional Access policies for agents](agent-id.md).+#customer intent: As an identity administrator, I want to target agents in Conditional Access policies so that each policy applies to the correct agent identity or agent user account.+--- -This article walks through each section of the Conditional Access policy builder for agents:+# Target agent identities in Microsoft Entra Conditional Access policies -- Selecting which agents the policy applies to-- Choosing target resources-- Configuring conditions-- Setting access controls.+Use this article to select agent identities or agent user accounts in a Conditional Access policy, choose target resources, configure supported conditions, and select access controls. -Each section builds on the previous one to form a complete policy.+The available conditions and controls depend on the token subject. To choose the right subject before you build the policy, see [Conditional Access for agents overview](agent-id.md). ## Prerequisites @@ -32,10 +29,10 @@ Each section builds on the previous one to form a complete policy. ## Create a Conditional Access policy for agent identities -Policies that target agent identities introduce unique assignment options, conditions, and control limitations that differ from user-targeted policies. +Policies that target agent identities or agent user accounts have assignment options, conditions, and controls that differ from user-targeted policies. -- [Configure policy for autonomous agent access](policy-autonomous-agents.md)-- [Configure policy for on-behalf-of agent access](policy-on-behalf-of-agents.md)+- For policies that target agent identities, see [Secure autonomous agents with Conditional Access](policy-autonomous-agents.md).+- For policies that target agent user accounts, see [Secure agents that act as users with Conditional Access](policy-agent-user.md). To create a new Conditional Access policy for agent identities: @@ -64,7 +61,7 @@ Keep in mind the following important details when selecting agent assignments: - Policies targeting all users don't include agent's user accounts. - The **agent users** option targets agents' user accounts. This option is currently in Preview. - Agent-based policies apply when agents access resources using their own identity, not on behalf of a user.-- Targeting a blueprint automatically covers all agent identities derived from it, including ones added in the future. For more information about targeting agent identity blueprints, see [Conditional Access for agent identities: Agent identity blueprints](agent-id.md#conditional-access-policies-and-agent-identity-blueprints).+- Targeting a blueprint automatically covers all agent identities derived from it, including ones added in the future. For more information, see [Agent identity blueprints](agent-id.md#conditional-access-policies-and-agent-identity-blueprints). ## Target resources @@ -162,7 +159,7 @@ Access controls determine what happens when conditions are met. For more informa - **Block access**: Deny the agent user account access to resources. - **Grant access** with:- - **Require device to be marked as compliant**: Requires agents to run on Intune-managed compliant devices, such as Windows 365 Cloud PCs for Agents. For more information, see[What is Windows 365 for Agents?](/windows-365/agents/introduction-windows-365-for-agents).+ - **Require device to be marked as compliant**: Requires agents to run on Intune-managed compliant devices, such as Windows 365 Cloud PCs for Agents. For more information, see [What is Windows 365 for Agents?](/windows-365/agents/introduction-windows-365-for-agents). :::image type="content" source="media/howto-target-agent-identities/agent-policy-grant-device-compliant.png" alt-text="Screenshot of the Conditional Access policy builder showing the grant option for device compliance." lightbox="media/howto-target-agent-identities/agent-policy-grant-device-compliant.png"::: > [!IMPORTANT]@@ -170,5 +167,6 @@ Access controls determine what happens when conditions are met. For more informa ## Related content -- [Conditional Access for agent identities](agent-id.md)-- [Configure policy for autonomous agent access](policy-autonomous-agents.md)+- [Conditional Access for agents overview](agent-id.md)+- [Secure autonomous agents with Conditional Access](policy-autonomous-agents.md)+- [Secure agents that act as users with Conditional Access](policy-agent-user.md)