Secure agents: Identity, access, and data protection

Executing agents don't just answer questions. They act in your systems. They need the same security discipline as any workload identity, plus a few agent-specific controls. To scale with confidence, use security as the enabler, not as a checkpoint that slows you down.

Why security enables scale

The first few agents feel safe because you know each one. At 50 or 500 agents, that familiarity is gone, and the only thing that keeps the estate trustworthy is a security model that scales with it. When every agent has an identity, holds only the access it needs, and is registered in one place, you can add the next 100 agents without adding proportional risk. Security is what makes speed durable.

This article covers some of the controls that enable security at scale: agent identity and access, shadow-agent discovery, data protection, and ongoing monitoring.

Give each agent an identity

Assign each agent its own identity with Microsoft Entra Agent ID. When an agent acts under its own identity, every action it takes is attributable to that agent. You can govern it the way you govern any other principal: grant access, review it, and revoke it. Shared or borrowed credentials break that chain and make incidents impossible to trace.

Apply least-privilege access

An agent should hold only the permissions it needs to complete its task, and nothing more. Scope access to the specific data, tools, and systems the agent's job requires, and then review those grants as the agent changes. Least privilege limits the impact if an agent is compromised or misbehaves, and it keeps a single agent from quietly becoming a cross-system superuser.

Register every agent

Register every agent so you have one inventory of what exists, who owns it, and what it can reach. You can't secure what you can't see, and an unregistered agent is invisible to review, monitoring, and offboarding.

Use Microsoft Agent 365 as your control plane. It brings the registry, identity, least-privilege access, and observability together in one place so identity and inventory stay aligned. Agent 365 is generally available to commercial customers, with some scenarios still in preview. Be sure to confirm support for your specific scenario.

Discover and manage shadow agents

Shadow agents are agents built or run outside the Center of Excellence (CoE), often by well-meaning teams moving fast. They aren't inherently malicious, but they're unmanaged, with no registered owner, no reviewed access, no monitoring. Left alone, they're where your next incident starts.

Use discovery to find these agents and bring them under management. Microsoft Agent 365 and Microsoft Defender surface agents running across your environment so you can register each one, assign an owner, right-size its access, and bring it into your standard lifecycle. The goal isn't to punish the teams that built them. The goal is to make the managed path easier than the shadow path.

Protect the data agents can reach

An agent is only as safe as the data it can touch. Two principles do most of the work: agents inherit the asking user's permissions, and Microsoft Purview governs the data itself.

Agents respect the permissions the asking user already has, so people only see content they're allowed to see. An agent doesn't grant new access. It works within the boundaries that already apply to the person using it.

Oversharing matters because agents surface whatever a user can already access. Existing oversharing, (a too broad site, an open file share, or a mislabeled document) becomes far more visible once an agent retrieves and summarizes it on demand. Tighten permissions and labeling before you scale, not after an agent surfaces something it shouldn't.

Use Microsoft Purview to protect the data layer:

  • Sensitivity labels classify content so protection travels with the data.
  • Data loss prevention stops sensitive content from leaving where it belongs.
  • Oversharing controls help you find and reduce over-broad access before agents amplify it.
  • Audit of agent actions gives you a record of what agents accessed and did, for investigation and compliance.

Note

Oversharing is a data governance problem that agents expose, not one they create. Fix access and labeling first so that agents inherit a safer starting point.

Monitor agents and detect abuse

For executing agents, and especially external-facing ones, security doesn't end at deployment. Monitor agent interactions in real time so you can see what agents are doing while they do it, and detect anomalies such as unusual access patterns, spikes in activity, or attempts to push an agent outside its intended behavior. Pair monitoring with an incident-response plan that names who's alerted, how an agent is paused or revoked, and how you investigate, so a detected problem becomes a contained one.

Next step

With security controls in place, embed responsible AI principles into how your agents are designed, reviewed, and monitored.

Apply responsible AI

  • Last updated on