Per-agent identity just became a vendor default
· re: Automatically create Entra Agent IDs - Microsoft Copilot Studio (Microsoft Learn)
The thing I have been arguing for years just turned into a vendor default. Microsoft now creates a per-agent Entra identity for every Copilot Studio agent and has removed the opt-out: “all new agents must have Microsoft Entra Agent IDs, and you can no longer opt out”. In the same fortnight Google shipped a native agent identity that “enforces a least-privilege approach”, binds access to the agent runtime, and gives “non-repudiable auditing of all agent actions” while eliminating dormant credentials.
The argument was always simple: an agent should carry its own scoped identity and see only what the person behind it is cleared to see. It used to be a best practice you had to win on a whiteboard. Now it is becoming infrastructure you cannot switch off.
My read: the borrowed-human-credential era for agents is ending, and that is the right direction. The half people still skip is the audit. An identity that cannot prove it acted within its clearance is only half a control (the interesting logs are always the ones nobody kept). Provable, least-privilege, non-repudiable access is the real test, and it is good to see it shipping by default.