# Agent Identity Governance

> Guidance for governing the identities of AI agents and non-human identities (NHIs) — Microsoft 365 Copilot Studio agents, Microsoft Foundry agents, custom AI agents, and traditional service principals/managed identities — through their full lifecycle. Covers ownership and tagging, scoped permissions and consent (delegated vs application; Sites.Selected; mailbox-scoped Graph), credential hygiene (…

- **Type:** Skill
- **Install:** `agentstack add skill-vinayaklatthe-microsoft-security-skills-agent-identity-governance`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [vinayaklatthe](https://agentstack.voostack.com/s/vinayaklatthe)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [vinayaklatthe](https://github.com/vinayaklatthe)
- **Source:** https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/agent-identity-governance

## Install

```sh
agentstack add skill-vinayaklatthe-microsoft-security-skills-agent-identity-governance
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# AI Agent & Non-Human Identity Governance

AI agents — Microsoft 365 Copilot Studio agents, Microsoft Foundry agents, custom-built
ones, plus traditional service principals and managed identities — are now the
fastest-growing identity population in most tenants. They authenticate, hold permissions,
act on behalf of users (or themselves), and are usually under-governed.

This skill is the lifecycle governance layer for those identities: ownership, scoping,
credential hygiene, reviews, decommissioning, and incident response.

## When to use
Establishing or maturing governance for the agent / NHI population — Copilot Studio
agents, Foundry agents, custom LLM agents, and the service principals that back them.

**Do not use this skill** for workload identity federation patterns alone
(`entra-workload-identity`), human identity governance (`entra-id-governance`), or
generic agent build guidance.

## Agent identity inventory — know what you're governing

| Class | Identity model | Surface |
|---|---|---|
| **Copilot Studio agent (M365)** | Tenant-scoped agent identity + per-user delegated permissions | M365 admin center / Copilot Studio |
| **Microsoft Foundry agent** | Service principal + managed identity + per-user OBO | Azure portal / Foundry |
| **Custom AI agent (your code)** | App registration + workload identity federation / managed identity | Entra admin center |
| **Plugin / connector** | Service principal + delegated/app Graph permissions | Entra admin center |
| **Legacy automation service principal** | App registration, often with secret | Entra admin center |

## Approach

1. **Inventory and tag.** Pull every app registration, service principal, and Copilot
   Studio / Foundry agent. Tag each with:
   - **Owner** (person + group).
   - **Sponsor / business owner**.
   - **Purpose** (one sentence).
   - **Data scope** (which tenants/sites/mailboxes/resources).
   - **Lifecycle stage** (pilot / production / sunset).
   - **Criticality** (tier 0 / 1 / 2).
   Orphaned identities → freeze them; require owner re-claim.

2. **Scope permissions tightly.**
   - Microsoft Graph: prefer **Sites.Selected** over `Sites.Read.All`, **mailbox
     scoping via Application Access Policy** over `Mail.Send`, custom security
     attributes over broad directory roles.
   - Azure: scope role assignments at RG or resource, never subscription Owner unless
     truly required.
   - Copilot Studio agent knowledge sources: explicit site/library lists, not "All
     SharePoint."
   - Foundry agent tools: only the tools needed; remove `http` plugin unless
     necessary.

3. **Credential hygiene.** No client secrets in new builds — federated credentials
   (GitHub Actions, Azure DevOps, AKS, external OIDC) or certificates with auto-rotation
   via Key Vault. Existing secrets: inventory, cap expiry at 180 days, rotate via
   automation, plan migration to federation.

4. **Conditional Access for workloads** (Workload Identities Premium). Apply to
   tier-0 agents and externally-callable agents:
   - Restrict source IP ranges.
   - Block legacy auth.
   - Require named locations.
   Don't try to apply to every SP in the tenant — focus on high-blast-radius identities.

5. **Access reviews for agents** via Entra ID Governance. Owner reviews per quarter:
   - Still needed?
   - Still the right scope?
   - Credential rotation up to date?
   - Owner / sponsor still in role?
   Auto-disable on owner non-response.

6. **Lifecycle workflows.** Build automation for:
   - **Provisioning**: owner-initiated request → approval → SP created with template
     permissions, tagged, owner assigned.
   - **Modification**: scope change requires re-approval.
   - **Decommissioning**: 30-day disable window, then delete; remove role
     assignments, federated credentials, knowledge-source attachments.

7. **Audit and monitoring.**
   - Stream `ServicePrincipalSignInLogs` and `AuditLogs` to Sentinel.
   - For Copilot Studio agents: interaction audit logs via Purview Audit.
   - Detections:
     - New high-privilege role assignment to an agent identity.
     - Agent sign-in from unexpected IP/country.
     - Sudden spike in Graph API calls per agent.
     - Sensitive data access by agent outside business hours.
     - New credential added to an agent by an identity other than its owner.

8. **Incident response when an agent is compromised.**
   1. **Disable the identity** (block sign-in on the app registration / SP).
   2. **Rotate credentials**, revoke refresh tokens.
   3. **Hunt actions** taken by the agent identity in the past 7–30 days
      (Graph audit, resource activity).
   4. **Notify data owners** for the resources the agent had access to.
   5. **Root cause** (leaked secret? OAuth consent phishing? supply chain?).
   6. **Restore with tightened scope** or retire.

9. **Couple with usage signals.** Purview AI Hub / DSPM for AI shows *what the agent
   does* (sensitive data flowing through prompts). Pair with identity audit to get a
   complete view.

## Guardrails
- **Every agent identity has a named human owner.** Empty owners list = orphan =
  audit/security risk.
- **No client secrets for new identities.** Federation > certificate > secret.
- **Sites.Selected (and similar) is mandatory where it exists.** "Quick start with
  `.All` and we'll scope later" never scopes later.
- **Conditional Access for workloads is a separate license.** Confirm SKU before
  designing.
- **OAuth consent for new agents must be admin-reviewed.** End-user consent for high-
  privilege scopes is the agent equivalent of a phishing onboarding.
- **Decommissioned ≠ deleted in 1 day.** 30-day disable window catches "wait, that was
  in use somewhere."
- **Agent credentials are not for human use.** Don't share an agent's secret with the
  team for "easier debugging."
- **Tag agents with data scope and tier.** Without it, IR and reviews are guesswork.

## Common anti-patterns
- **"Copilot Studio agent grounded on 'All SharePoint'"** — same oversharing problem as
  Copilot itself, scaled. Use site-scoped knowledge sources.
- **"Agent SP granted Mail.Send Application permission tenant-wide"** — can email as
  anyone. Use app access policies to scope to specific mailboxes.
- **"Owner field set to a leaver's account"** — orphaned, no review, no rotation.
- **"Long-lived client secret in agent code"** — git history forever; leak detection
  too late.
- **"All agents in tier-0 because 'they're all important'"** — review and IR effort
  becomes uniform but is uniformly low quality. Real tiering.
- **"Decommissioned by deleting the app reg, leaving role assignments behind"** —
  dangling principal IDs in RBAC; restore-with-same-id risk.
- **"No audit on Copilot Studio agent interactions"** — compromised agent acts
  invisibly.
- **"Treated agent identity governance as identical to human IGA"** — different
  lifecycle, different controls, different reviews.

## Example prompts
- `Inventory all Copilot Studio agents, Foundry agents, and service principals in the
  tenant and produce an owner + scope + tier report.`
- `Roll out access reviews for 600 agent identities via Entra ID Governance quarterly.`
- `Scope a Copilot Studio agent for HR from "All SharePoint" to 4 specific knowledge
  sites.`
- `Build a decommissioning workflow: 30-day disable, owner notification, full cleanup of
  RBAC and federated credentials.`
- `Sentinel detections for agent identity compromise: new credential, anomalous sign-in,
  spike in Graph calls.`
- `IR runbook: compromised Foundry agent that called Microsoft Graph for 48 hours —
  containment, hunt, notification.`
- `Replace client secrets across 120 legacy automation SPs with workload identity
  federation or Key Vault certificates.`
- `Apply Conditional Access for workload identities to all tier-0 agents.`

## Microsoft Learn
- Workload identities overview: https://learn.microsoft.com/entra/workload-id/workload-identities-overview
- Entra ID Governance overview: https://learn.microsoft.com/entra/id-governance/identity-governance-overview
- Access reviews for service principals: https://learn.microsoft.com/entra/id-governance/create-access-review
- Conditional Access for workload identities: https://learn.microsoft.com/entra/identity/conditional-access/workload-identity
- Application access policies (Graph mailbox scoping): https://learn.microsoft.com/graph/auth-limit-mailbox-access
- Sites.Selected: https://learn.microsoft.com/sharepoint/dev/solution-guidance/security-apponly-azuread
- Copilot Studio security and governance: https://learn.microsoft.com/microsoft-copilot-studio/security-and-governance
- Microsoft Foundry agent security: https://learn.microsoft.com/azure/ai-foundry/concepts/ai-resources
- Audit (unified) for Copilot: https://learn.microsoft.com/purview/audit-copilot
- Workload identity federation: https://learn.microsoft.com/entra/workload-id/workload-identity-federation

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [vinayaklatthe](https://github.com/vinayaklatthe)
- **Source:** [vinayaklatthe/microsoft-security-skills](https://github.com/vinayaklatthe/microsoft-security-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-vinayaklatthe-microsoft-security-skills-agent-identity-governance
- Seller: https://agentstack.voostack.com/s/vinayaklatthe
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.