How to Create Conditional Access for Agent ID (Preview)

AI AI AI AI AI… So somehow we have to control these where, agents play a critical role in automating tasks, processing data, and interacting with systems. However, these non-human identities often lack the robust security controls applied to human users. This gap creates vulnerabilities, as agents can be exploited to access sensitive resources or perform unauthorized actions. Conditional Access for Agent ID (Preview) addresses this issue by extending Zero Trust principles to agent identities, ensuring that every access request is verified and secure.

By implementing Conditional Access policies for agents, organizations can:

• Protect sensitive resources from unauthorized access.
• Enforce compliance with security standards.
• Gain visibility into agent activity and potential risks.

This guide walks you through creating a Conditional Access policy for agent identities, ensuring your organization stays secure while leveraging the power of AI agents.

---

Step 1: Define Custom Security Attributes

Custom security attributes allow you to tag agents and resources with metadata that can be used in Conditional Access policies. This step is crucial for creating granular policies tailored to your organization’s needs.

1. Open the Microsoft Entra portal.
2. Navigate to Identity → Custom security attributes.
3. Create an attribute set named AgentAttributes.
   • Add an attribute AgentApprovalStatus with values: New, In_Review, HR_Approved, IT_Approved.
4. Create another attribute set named ResourceAttributes.
   • Add an attribute Department with values: HR, Finance, IT.

Why this matters: Custom attributes enable dynamic policy enforcement. For example, you can allow only agents with HR_Approved status to access HR resources, reducing the risk of unauthorized access.

Image Placeholder 1: Custom security attributes creation screen.

---

Step 2: Assign Attributes to Agents and Resources

Once the attributes are defined, the next step is to assign them to agents and resources. This tagging process ensures that your Conditional Access policies can target specific entities based on their attributes.

1. Go to Enterprise applications / App registrations.
2. Select the app or resource.
3. Assign the custom security attributes created in Step 1.
   • Example: Assign AgentApprovalStatus = HR_Approved to approved agents.
   • Example: Assign Department = HR to HR resources.

What this achieves: By tagging agents and resources, you create a clear mapping of who can access what. This step lays the foundation for enforcing access controls based on organizational policies.

Image Placeholder 2: Assigning attributes to agents and resources.

---

Step 3: Create a Conditional Access Policy

Conditional Access policies enforce Zero Trust principles by evaluating access requests based on conditions such as user identity, device state, and risk level. For agents, these policies ensure that only authorized entities can access sensitive resources.

1. Navigate to Security → Conditional Access → Policies.
2. Select New policy and name it.
3. Configure Assignments:
   • Users: Include all agent identities.
   • Exclusions: Filter by AgentApprovalStatus → HR_Approved.
4. Configure Target resources:
   • Include all resources.
   • Exclude resources where Department = HR.
5. Set Conditions:
   • Agent risk: Select High (optional).
6. Set Access controls:
   • Grant → Block.
7. Enable the policy in Report-only mode, validate, then switch to On.

Why this is important: Conditional Access policies act as gatekeepers, ensuring that only trusted agents can perform specific actions. By starting in Report-only mode, you can test the policy’s impact before enforcing it.

Image Placeholder 3: Conditional Access policy configuration screen.

---

Step 4: Monitor Sign-ins

Monitoring sign-ins provides visibility into agent activity, helping you identify potential risks and ensure compliance with your policies.

1. Go to Monitoring → Sign-ins.
2. Filter by agentType to review activity.

What this solves: Regular monitoring helps you detect anomalies, such as unauthorized access attempts or high-risk agents, enabling you to take corrective action promptly.

---

Real-World Benefits

Implementing Conditional Access for Agent ID provides several tangible benefits:

• Enhanced Security: Protect sensitive data and systems from unauthorized access.
• Compliance: Meet regulatory requirements by enforcing strict access controls.
• Operational Efficiency: Automate access management for agents, reducing manual effort.

For example, a financial institution can use Conditional Access to ensure that only agents with Finance_Approved status can access financial systems, minimizing the risk of data breaches.