Microsoft Entra Agent ID

Agent Id Governance Overview

7 November 2026Doc update+4 / −4 lines

In brief

The overview adds a link to a second Copilot Studio article, clarifies when to use an access package policy for service principals, and renames the management section to focus on delegated management.

What Entra admins need to know

Admins can more precisely identify applicable service principal policies and locate delegated management guidance; no action is required.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Agent identities basics

Historically, AI agents would rely upon tools to interact with various applications and systems, and each of those tools would have their own identities in those applications and systems. Some of those tools would use service principals to authenticate to Microsoft services via Microsoft Graph or Microsoft Azure APIs. Microsoft Entra Agent ID introduces support for identities for the agents themselves, with four new types of object: agent identity blueprint, agent identity blueprint principal, agent identity, and agent user. Through the agent identity blueprint, the agent can create one or more agent identities, and optionally an agent user for each agent ~~identity.~~identity, which it can use for authentication to Microsoft, third party and line of business applications. Each agent identity and agent user can have distinct access rights.

Diagram of the relationship of Microsoft Entra Agent ID objects in a single tenant.

You can configure an Azure App Service or Azure Functions app to use the Microsoft Entra agent identity platform to securely connect to resources as an agent. For more information, see How to use an agent identity in App Service and Azure Functions.
Agents created in Microsoft Copilot Studio can be configured to automatically be assigned to an agent identity. When an agent identity is first created in a Power Platform environment after enabling this setting, a Microsoft Copilot Studio agent identity blueprint, and an agent identity blueprint principal, are automatically created. For more information, see Microsoft Entra Agent IDs for Copilot Studio agents and Agent identities and authentication for Copilot Studio.
For agents in the Microsoft Teams platform, a developer can create and manage agent identity blueprints in the Developer Portal for Teams. For more information, see Manage your apps in Developer Portal.

To use access packages for agent identities, configure an access package with the required policy settings. When creating an access package assignment policy, in the Who can get access section, select For users, service principals, and agent identities in your directory, and then select the option of All agents.

Agents can then be assigned access packages through three different request pathways.

For more information, see Conditional Access for agents and Identity Protection for agents.

ManagementDelegated management of agentsagent identities and access

When agent identities are created, owners and sponsors of the agent can manually make decisions for the agent identity via both the My Account portal, and the My Access Portal.

@@ -20,7 +20,7 @@ This allows agent identities to be governed with Microsoft Entra features in the  ## Agent identities basics -Historically, AI agents would rely upon tools to interact with various applications and systems, and each of those tools would have their own identities in those applications and systems. Some of those tools would use service principals to authenticate to Microsoft services via Microsoft Graph or Microsoft Azure APIs. [Microsoft Entra Agent ID](../agent-id/what-are-agent-identities.md) introduces support for identities for the agents themselves, with four new types of object: agent identity blueprint, agent identity blueprint principal, agent identity, and agent user. Through the [agent identity blueprint](../agent-id/agent-blueprint.md), the agent can create one or more agent identities, and optionally an agent user for each agent identity. Each agent identity and agent user can have distinct access rights.+Historically, AI agents would rely upon tools to interact with various applications and systems, and each of those tools would have their own identities in those applications and systems. Some of those tools would use service principals to authenticate to Microsoft services via Microsoft Graph or Microsoft Azure APIs. [Microsoft Entra Agent ID](../agent-id/what-are-agent-identities.md) introduces support for identities for the agents themselves, with four new types of object: agent identity blueprint, agent identity blueprint principal, agent identity, and agent user. Through the [agent identity blueprint](../agent-id/agent-blueprint.md), the agent can create one or more agent identities, and optionally an agent user for each agent identity, which it can use for authentication to Microsoft, third party and line of business applications. Each agent identity and agent user can have distinct access rights.  ![Diagram of the relationship of Microsoft Entra Agent ID objects in a single tenant.](./media/agent-id-governance-overview/agent-identity-objects-single-tenant.png) @@ -36,7 +36,7 @@ The agent identity and the agent user allow AI agents to take on digital identit  * You can configure an **Azure App Service or Azure Functions app** to use the Microsoft Entra agent identity platform to securely connect to resources as an agent. For more information, see [How to use an agent identity in App Service and Azure Functions](/azure/app-service/overview-agent-identity). -* Agents created in **Microsoft Copilot Studio** can be configured to automatically be assigned to an agent identity. When an agent identity is first created in a Power Platform environment after enabling this setting, a Microsoft Copilot Studio agent identity blueprint, and an agent identity blueprint principal, are automatically created. For more information, see [Microsoft Entra Agent IDs for Copilot Studio agents](/microsoft-copilot-studio/admin-use-entra-agent-identities).+* Agents created in **Microsoft Copilot Studio** can be configured to automatically be assigned to an agent identity. When an agent identity is first created in a Power Platform environment after enabling this setting, a Microsoft Copilot Studio agent identity blueprint, and an agent identity blueprint principal, are automatically created. For more information, see [Microsoft Entra Agent IDs for Copilot Studio agents](/microsoft-copilot-studio/admin-use-entra-agent-identities) and [Agent identities and authentication for Copilot Studio](/microsoft-copilot-studio/govern-agents-identities-overview).  * For agents in the **Microsoft Teams** platform, a developer can create and manage agent identity blueprints in the Developer Portal for Teams. For more information, see [Manage your apps in Developer Portal](/microsoftteams/platform/concepts/build-and-test/manage-your-apps-in-developer-portal). @@ -53,7 +53,7 @@ When created, agent identities have limited permissions, such as OAuth 2 delegat To use access packages for agent identities, configure an access package with the required policy settings. When creating an access package assignment policy, in the **Who can get access** section, select **For users, service principals, and agent identities in your directory**, and then select the option of **All agents**.  > [!NOTE]-> If your agents aren't using Microsoft Entra agent IDs, then also create an access package assignment policy with the option **All Service principals** to allow service principals in your directory to be able to request this access package.+> If your agents aren't using Microsoft Entra agent IDs, but are using service principals, then also create an access package assignment policy with the option **All Service principals** to allow service principals in your directory to be able to request this access package.  Agents can then be assigned access packages through three different request pathways. @@ -73,7 +73,7 @@ Entitlement management controls which resources an agent identity can be assigne  For more information, see [Conditional Access for agents](../identity/conditional-access/agent-id.md) and [Identity Protection for agents](../id-protection/concept-risky-agents.md). -## Management of agents+## Delegated management of agent identities and access  When agent identities are created, owners and sponsors of the agent can manually make decisions for the agent identity via both the My Account portal, and the My Access Portal.