BlueStar Technology has begun deploying AI agents across multiple business units. The security team requires that every AI agent have a traceable, auditable identity that can be managed through the same lifecycle processes used for human users and service accounts. Which feature in Microsoft Entra should the administrator use to register and manage agent identities?
Select an answer to reveal the explanation.
Short Explanation
You need Microsoft Entra Agent ID because it gives each AI agent its own auditable identity you can register, enable, disable, delete, and track just like a user or service account. That is the lifecycle management the security team asked for.
Full Explanation
Microsoft Entra Agent ID is a purpose-built identity feature for AI agents within the Microsoft 365 and Azure ecosystem. It lets you register agents as distinct identity objects in Microsoft Entra ID, apply lifecycle management such as enable, disable, and delete, enforce access policies, and maintain audit logs of agent activity through familiar Entra tooling. That directly satisfies the requirement for traceable, auditable agent identities managed through standard enterprise identity processes. The managed identities assigned to the Azure subscriptions hosting the agents approach is incorrect because managed identities are bound to specific Azure resources such as VMs and App Services and are intended for workloads that need to authenticate to Azure services. They are not designed to represent agent identities at the Microsoft 365 layer or support the kind of cross-workload agent governance described here. The workload identities configured as service principals for each agent application approach is incorrect because, while service principals can represent applications, they predate the agent identity paradigm and lack the agent-specific governance features, discoverability in the agent registry, and lifecycle workflow integrations that Microsoft Entra Agent ID provides. Microsoft recommends Agent ID specifically for AI agent scenarios. The B2B guest accounts created for each agent using a shared mailbox as the agent identity approach is incorrect because it is an anti-pattern that conflates human identity with agent identity, creates licensing issues, and does not integrate with agent governance workflows. Guest accounts are intended for human external collaborators, not AI agent service identities. Exam caveat: Microsoft Entra Agent ID is a newer feature specifically called out in the AB-650 domain. The key differentiator is that it is purpose-built for AI agents and integrates with Microsoft 365 agent governance tools, unlike generic service principals or managed identities. Sources: https://learn.microsoft.com/en-us/entra/agent-id/what-is-microsoft-entra-agent-id, https://learn.microsoft.com/en-us/entra/agent-id/agent-identities, https://techcommunity.microsoft.com/blog/microsoft-entra-blog/announcing-microsoft-entra-agent-id-secure-and-manage-your-ai-agents/3827392