Woodgrove Bank has developed several AI agents using Microsoft Copilot Studio that interact with Microsoft 365 services. The security team wants to ensure each agent has a distinct, auditable identity that can be managed and monitored independently. The administrator needs to manage the full lifecycle of these agent identities, including creation, permissions assignment, and decommissioning. Which identity platform should be used to manage agent identities?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Agents need identities just like users do, and Microsoft Entra Agent ID is the system built specifically for that. Think of it as Entra ID but for bots — each agent gets its own identity, permissions, and audit trail, all managed in one place.
Full explanation below image
Full Explanation
Microsoft Entra Agent ID is a purpose-built identity management system within the Microsoft Entra platform that provides a unique, manageable identity for AI agents. This includes creating agent identities (service principals or managed identities scoped for agents), assigning Microsoft 365 and Azure permissions through role-based access control, monitoring agent sign-in and activity logs, and decommissioning agent identities when they are retired. Entra Agent ID enables the principle of least-privilege access for agents and provides a centralized audit trail that satisfies compliance requirements like those in financial services.
Option A, Microsoft 365 admin center service accounts, manages human user accounts and shared mailboxes. There is no dedicated section for AI agent identity lifecycle management at the level of granularity required for modern agentic workloads.
Option C, Azure Key Vault, is a secrets management service for storing API keys, certificates, and passwords. While agents may use Key Vault to retrieve credentials, Key Vault does not manage agent identity lifecycle — it manages the secrets that an identity might use.
Option D, Microsoft Defender for Identity, monitors on-premises Active Directory environments for suspicious authentication behavior. It is a threat detection tool, not an identity provisioning or lifecycle management platform.
Exam tip: Microsoft Entra Agent ID is a key topic in the AB-650 exam. Whenever a question involves creating, managing, or decommissioning identities for AI agents in Microsoft 365, Entra Agent ID is the answer. Treat agents like non-human identities (NHIs) with their own lifecycle.