Microsoft Entra Agent ID and AI Access Security Updates

Introduction: why this matters

AI agents are quickly becoming first-class actors in enterprise environments—accessing data, calling APIs, and automating workflows at scale. That raises a practical security problem for IT and security teams: how to enable rapid AI adoption without creating unmanaged identities, excessive permissions, and new paths for data exfiltration. Microsoft’s latest Entra announcements focus on extending Zero Trust controls to both human and agent access.

What’s new

1) Expanded public preview: Microsoft Entra Agent ID

Microsoft is expanding the public preview of Microsoft Entra Agent ID to help organizations secure AI agents with the same identity infrastructure used for workforce identities.

Key capabilities highlighted:

• Register and manage agents: build an inventory of your agent fleet, provide agents with built-in identities, and apply organizational policies. An agent registry supports discovery across the Microsoft Security stack and the Microsoft 365 admin center.
• Govern agent lifecycles: lifecycle management and IT-defined guardrails help reduce “agent sprawl.” Access packages support intentional, auditable, time-bound access.
• Protect agent access: use Identity Protection, Conditional Access, and network controls to reduce breach risk and block risky agents. Additional controls include threat-intel filtering plus file upload/download restrictions and URL filtering to prevent access to malicious destinations.

Microsoft positions Entra Agent ID as the identity foundation for Microsoft Entra Agent 365 (the “control plane for agents”), integrating Entra (access), Purview (data governance), and Defender (threat protection) with centralized visibility in the Microsoft 365 admin center.

2) Public preview: AI-centric controls in Microsoft Entra Internet Access

Microsoft Entra Internet Access is evolving from a Secure Web Gateway to a Secure Web and AI Gateway, adding network-level governance for GenAI usage across providers and platforms.

AI-focused capabilities in public preview include:

• Prompt injection protection (network-layer), extending Azure AI Prompt Shields for more consistent coverage.
• Network file filtering with inspection of content/metadata in transit, integrating with Microsoft Purview to enforce Sensitive Information Types and Exact Data Match policies.
• Shadow AI detection using Cloud Application Analytics and Defender for Cloud Apps risk scoring to surface unsanctioned AI tools.
• Blocking unsanctioned MCP servers by URL.

3) Multilayer access controls and passkey progress (public preview)

Microsoft cites increased identity-based attacks and highlights phishing-resistant MFA as a critical baseline. Entra ID is adding public preview enhancements aimed at simplifying MFA and accelerating a move beyond passwords, including support for synced passkeys.

Impact for IT admins

• Expect new identity objects and lifecycle patterns for agents (inventory, ownership, lifecycle, access reviews) similar to workforce identities.
• Network/security teams can apply consistent, centralized policy to AI tool usage—reducing shadow AI and controlling data movement into unsanctioned services.
• Authentication roadmaps should factor in passkeys and phishing-resistant MFA as core controls, not optional hardening.

Action items / next steps

1. Request/enable the public preview of Microsoft Entra Agent ID and begin building an agent inventory and ownership model.
2. Define guardrails for agent access: least privilege, access packages, lifecycle/deprovisioning, and monitoring.
3. Pilot Entra Internet Access AI controls (prompt injection, file filtering, shadow AI detection) aligned to your Purview data classifications.
4. Review your MFA posture and plan for passkey adoption and phishing-resistant authentication.

Microsoft also noted strong results from Entra’s Conditional Access Optimization Agent in a study (faster task completion and improved accuracy), signaling continued investment in “agent-assisted” administration alongside agent security.