Governing Agent Access: Least Privilege by Design

Everything up to this point — identity, blueprints, the registry, convergence — exists so that you can finally do the thing governance is really about: decide and control what each agent may reach. This article is that payoff. It is the discipline of access: giving an agent exactly enough to do its job, for exactly as long as it needs, under a named owner, and guarded every time it acts.

1 · Least privilege, and why it matters more for agents

Least privilege is the principle of giving any actor only the permissions its job requires, and nothing more — the cleaner gets the office key, not the key to the safe. It is old, simple, and effective, and it applies to agents with extra force. The reason is speed and reach. A person with too much access tends to cause harm slowly, and a colleague or manager may notice in time. An agent acts at machine speed across many systems at once and never pauses, so if an over-permissioned agent is tricked, misconfigured, or simply mistaken, it can do wide damage before anyone can react.

The size of that potential damage is the agent’s blast radius — everything it could affect if it went wrong. Least privilege is the most direct lever on it: the smaller an agent’s set of permissions, the smaller the circle of harm if the agent is ever turned against you. For an actor this fast and tireless, keeping the circle small is not tidiness — it is the core of the defence.

2 · Enforced by the platform, not just by policy

Here is what makes agent access different from a hopeful company rule. For agents, least privilege is not left entirely to your discipline — the identity platform enforces it. Microsoft states that Entra “limits what agent identities can do,” that it “blocks agents from being granted many high-privilege roles or permissions,” and that “users and administrators aren’t allowed to consent to those powerful permissions for an agent.”

Read that carefully: you could not hand an agent the most dangerous permissions even if you tried, because the platform refuses. Microsoft’s reasoning is that many high-privilege capabilities — managing users, changing security settings — assume a careful human administrator, and an unrestrained agent holding them could take far-reaching actions with enormous impact. So the guardrail is built into the system, not just written in a policy document someone might ignore. This is least privilege “by design”: the safe default is enforced beneath you.

3 · Access that does not outlast the job

Narrow access is only half the discipline; the other half is short-lived access. A permission that made sense for a project last quarter but was never removed is a quiet risk — an open door no one remembers. Governance for agents targets exactly this. Microsoft describes the goal plainly: to ensure “an agent’s access doesn’t persist longer than needed.”

In practice this means access is treated as something that can expire, be reviewed, and be removed — not granted once and forgotten. The same identity-governance tools that run access reviews and lifecycle for people apply to agents: lifecycle management, access assignment, and compliance reporting for agent identities. The principle to carry is that an agent’s reach should shrink back to nothing when its job is done, rather than lingering as standing access nobody is watching.

4 · Owners, sponsors, and managers

Narrow, short-lived access still needs a human behind it — someone answerable for what the agent does and empowered to change it. Microsoft defines distinct administrative relationships for exactly this, and it is worth keeping them separate:

• Owner — who controls the agent identity or blueprint and can change its configuration.
• Sponsor — the human user or group accountable for the agent, contacted if something goes wrong.
• Manager — who administers the agent identity, blueprint, or paired user account day to day.

These roles turn access from an anonymous grant into an owned responsibility. Every agent’s permissions trace back to people who control, answer for, and administer them — which is what makes access reviews meaningful and incidents actionable. Access without ownership is how governance quietly rots; naming these roles is how it stays alive.

5 · Protecting access at the moment of use

Deciding what an agent may do is one layer; guarding what it actually does, each time it acts, is another. Microsoft extends three of its established access protections to agents:

• Conditional Access for agents — policy-based rules that weigh the conditions and risk of each request and can block anything unusual before it proceeds. Think of it as a checkpoint that asks “does this action look right, right now?”
• Identity Protection for agents — real-time risk detection with automated response, spotting an agent behaving abnormally and reacting without waiting for a human.
• Global Secure Access for agents — network-level, zero-trust access controls for an agent’s connections. Zero trust means never assuming a connection is safe just because it is inside the network; every one is checked.

Together these mean an agent’s permissions are not a one-time gate at setup but a live guard: each action is weighed, abnormal behaviour is caught, and every connection is verified. That is what “protect access to resources” looks like in practice for a non-human actor.

6 · Logged, reviewable, and provable

The final piece of governing access is being able to show what happened. Microsoft notes that “all authentication and actions performed by agents are logged in Microsoft Entra ID and viewable through the Microsoft Entra admin center for compliance and audit purposes.” Because each agent acts under its own identity — not a borrowed human account — every action is attributable to a specific agent.

This closes the loop. Narrow, short-lived, owned, and guarded access is the prevention; a complete, attributable log is the proof. Together they make agent access something an organisation can not only control but demonstrate it controlled — which is exactly what compliance, audit, and incident response require. That completes the identity and registry foundation: every agent named, shaped, catalogued, converged, and now governed down to each action it takes.

7 · Glossary — every short-form term, spelled out

Least privilege

Giving any actor only the permissions its job requires, and nothing more.

Blast radius

Everything an actor could affect if it were compromised or went wrong; least privilege shrinks it.

High-privilege role

A powerful permission set — such as managing users or security settings — that the platform blocks agents from holding.

Consent

Approving a permission for an identity; for agents, no one is allowed to consent to the most powerful permissions.

Standing access

Access that stays in place continuously rather than expiring when a task is done.

Owner / sponsor / manager

Distinct roles: who controls, who is accountable for, and who administers an agent identity or blueprint.

Conditional Access

Policy-based rules that weigh the conditions and risk of each request and can block unusual ones.

Identity Protection

Real-time risk detection with automated response to abnormal agent behaviour.

Global Secure Access

Network-level, zero-trust access controls for an agent’s connections.

Zero trust

Never assuming a connection is safe because it is inside the network; every request is verified.

Audit log

A complete, attributable record of authentications and actions, kept for compliance and investigation.