メインコンテンツへスキップ

Design Identity Governance Access Controls for Agents

Implementation Effort: Medium – Requires cross-team alignment between identity governance administrators, security architects, and business stakeholders to define the governance model before any operational controls are deployed.
User Impact: Low – This is a design and planning activity; no runtime changes affect end users or agent operations.

Overview​

Identity governance for AI agents ensures that every agent identity has a responsible human accountable for its lifecycle and access, and that access does not persist longer than it is needed. Microsoft Entra ID Governance extends the same entitlement management, lifecycle workflows, and sponsorship controls used for human identities to agent identities created through the Microsoft Entra Agent ID platform. Without a deliberate governance design, agent identities accumulate permissions over time, sponsors leave the organization without transferring accountability, and access packages expire or persist without review — all of which create standing privilege that threat actors can exploit.

The governance design must address three pillars. First, the administrative relationship model: every agent identity requires a sponsor at creation — a human user who makes lifecycle and access decisions on behalf of the agent. Owners handle technical administration (credentials, configuration), while sponsors handle business accountability (renewal, suspension, access justification). The design must define who fills each role, how sponsorship transfers when a sponsor moves or leaves the organization, and whether groups or individual users serve as sponsors. Second, entitlement management: agents receive resource access through access packages rather than direct permission grants. Access packages bundle security group memberships, application OAuth API permissions (including Microsoft Graph application permissions), and Microsoft Entra role assignments into governed units with approval workflows, expiration policies, and separation of duties checks. The design must define the catalog structure, which resources belong in which catalogs, and the approval chain for agent access requests — whether initiated by the agent identity itself, by its sponsor, or by an administrator. Third, lifecycle automation: lifecycle workflows notify cosponsors and managers of sponsors when sponsorship changes are imminent, ensuring continuity of human oversight. The design must map these workflows to the organization's existing joiner/mover/leaver processes.

This activity directly supports Verify explicitly by establishing the governance framework that ensures every agent access grant is approved against current business need. It supports Use least privilege access by channeling all agent permissions through time-bounded access packages with expiration and approval controls rather than permanent direct grants. It supports Assume breach by guaranteeing that a responsible human can immediately suspend an agent identity and revoke its access when anomalous behavior is detected. If this governance design is not completed, subsequent deployment tasks — assigning sponsors, configuring lifecycle workflows, and creating access packages — will be disconnected, inconsistent, and difficult to audit.

Reference​