BlueStar Technology has begun deploying AI agents across multiple business units. The security team requires that every AI agent have a traceable, auditable identity that can be managed through the same lifecycle processes used for human users and service accounts. Which feature in Microsoft Entra should the administrator use to register and manage agent identities?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Microsoft Entra Agent ID is specifically designed for AI agents — it's like giving each agent its own ID card that you can track, suspend, or revoke just like a human employee's account. That's exactly the auditable lifecycle the security team is asking for.
Full explanation below image
Full Explanation
Microsoft Entra Agent ID is a purpose-built identity feature for AI agents within the Microsoft 365 and Azure ecosystem. It allows administrators to register agents as distinct identity objects in Entra ID, apply lifecycle management (enable, disable, delete), enforce access policies, and maintain audit logs of agent activity — all through familiar Entra tooling. This directly satisfies the requirement for traceable, auditable agent identities managed through standard enterprise identity processes.
Option A is incorrect because Managed Identities are bound to specific Azure resources (VMs, App Services, etc.) and are intended for workloads that need to authenticate to Azure services. They are not designed to represent agent identities at the Microsoft 365 layer or support the kind of cross-workload agent governance the question describes.
Option C is incorrect because while workload identity service principals CAN represent applications, they predate the agent identity paradigm and lack the agent-specific governance features, discoverability in the agent registry, and lifecycle workflow integrations that Entra Agent ID provides. Microsoft recommends Agent ID specifically for AI agent scenarios.
Option D is incorrect because creating B2B guest accounts for agents is an anti-pattern that conflates human identity with agent identity, creates licensing issues, and does not integrate with agent governance workflows. Guest accounts are intended for human external collaborators, not AI agent service identities.
Exam tip: Entra Agent ID is a newer feature specifically called out in the AB-650 domain. The key differentiator is that it's purpose-built for AI agents and integrates with Microsoft 365 agent governance tools, unlike generic service principals or managed identities.