Microsoft Entra ID Governance
FundamentalsIdentity Governance Overview
In brief
The overview now links to additional AI agent governance scenarios, describes Lifecycle Workflows sponsor transition notifications, and clarifies that entitlement management access packages can govern agent identity assignments.
What Entra admins need to know
Administrators managing agent identities should review the updated sponsor-transition and access-governance guidance.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Govern the access lifecycle
- Secure privileged access for administration
In addition, there are additional scenarios for AI aegnts. For more information, see Governing agent identities.
Identity lifecycle
Identity governance for agent identities
With the addition of the Microsoft agent identity platform, managing an agent's identity and access in the same way as people is just as important in the governance lifecycle of your organization. Microsoft Entra Agent ID introduces agent identities — purpose-built identity constructs for AI agents — with governance controls that address the unique challenges of autonomous and semi-autonomousall forms of agents operating at enterprise scale.
Every agent identity requires a human sponsor accountable for the agent's purpose, lifecycle decisions, and access reviews. If a sponsor leaves the organization, sponsorship automatically transfers Agent identities are linked to their manager, ensuring continuous human oversight. Agent identity blueprints which serve as centralized templates that enable organizations to apply Conditional Access rules, permissions, and governance controls once and have all current and future agent instances inherit them automatically. This blueprint model allows administrators to govern, disable, or revoke permissions for an entire class of agents in a single operation.
AgentEvery agent identity requires a human sponsor accountable for the agent's purpose and lifecycle decisions. Lifecycle Workflows automate sponsor transition notifications,so that if a person who sponsors agents moves or leaves the organization, these workflows enables sponsorship to automatically transfer, ensuring continuous human oversight.
Access assignments to agent identities arecan be governed through the same entitlement management access packages available for human identities, providing time-bound, auditable access with approval workflows. Sponsors receive expiration notifications and can request extensions or let access expire. Lifecycle Workflows automate sponsor transition notifications when sponsorship changes occur. All agent identities are discoverable, searchable, and queryable through the Microsoft Entra admin center and Microsoft Graph, giving organizations centralized visibility to prevent agent sprawl and shadow AI.
For more information, see Governing agent identities.
@@ -25,6 +25,7 @@ With Microsoft Entra ID Governance you can implement the following scenarios for - Govern the access lifecycle - Secure privileged access for administration +In addition, there are additional scenarios for AI aegnts. For more information, see [Governing agent identities](agent-id-governance-overview.md). ## Identity lifecycle @@ -115,11 +116,11 @@ Once you've started using these identity governance features, you can easily aut ## Identity governance for agent identities -With the addition of the Microsoft agent identity platform, managing an agent's identity and access in the same way as people is just as important in the governance lifecycle of your organization. Microsoft Entra Agent ID introduces [agent identities](../agent-id/what-is-microsoft-entra-agent-id.md) — purpose-built identity constructs for AI agents — with governance controls that address the unique challenges of autonomous and semi-autonomous agents operating at enterprise scale.+With the addition of the Microsoft agent identity platform, managing an agent's identity and access in the same way as people is just as important in the governance lifecycle of your organization. Microsoft Entra Agent ID introduces [agent identities](../agent-id/what-is-microsoft-entra-agent-id.md) — purpose-built identity constructs for AI agents — with governance controls that address the unique challenges of all forms of agents operating at enterprise scale. Agent identities are linked to [Agent identity blueprints](../agent-id/identity-platform/agent-blueprint.md) which serve as centralized templates that enable organizations to apply Conditional Access rules, permissions, and governance controls once and have all current and future agent instances inherit them automatically. This blueprint model allows administrators to govern, disable, or revoke permissions for an entire class of agents in a single operation. -Every agent identity requires a human [sponsor](../agent-id/agent-owners-sponsors-managers.md) accountable for the agent's purpose, lifecycle decisions, and access reviews. If a sponsor leaves the organization, sponsorship automatically transfers to their manager, ensuring continuous human oversight. [Agent identity blueprints](../agent-id/identity-platform/agent-blueprint.md) serve as centralized templates that enable organizations to apply Conditional Access rules, permissions, and governance controls once and have all current and future agent instances inherit them automatically. This blueprint model allows administrators to govern, disable, or revoke permissions for an entire class of agents in a single operation.+Every agent identity requires a human [sponsor](../agent-id/agent-owners-sponsors-managers.md) accountable for the agent's purpose and lifecycle decisions. [Lifecycle Workflows](agent-sponsor-tasks.md) automate sponsor transition notifications,so that if a person who sponsors agents moves or leaves the organization, these workflows enables sponsorship to automatically transfer, ensuring continuous human oversight. -Agent identities are governed through the same [entitlement management](entitlement-management-overview.md) access packages available for human identities, providing time-bound, auditable access with approval workflows. Sponsors receive expiration notifications and can request extensions or let access expire. [Lifecycle Workflows](agent-sponsor-tasks.md) automate sponsor transition notifications when sponsorship changes occur. All agent identities are discoverable, searchable, and queryable through the Microsoft Entra admin center and Microsoft Graph, giving organizations centralized visibility to prevent agent sprawl and shadow AI.+Access assignments to agent identities can be governed through the same [entitlement management](entitlement-management-overview.md) access packages available for human identities, providing time-bound, auditable access with approval workflows. Sponsors receive expiration notifications and can request extensions or let access expire. For more information, see [Governing agent identities](agent-id-governance-overview.md).