AI and Identity in 2026: A Defenders Field Guide to Agents Copilot and Governance
Source: YouTube · SANS Cloud Security · published Oct 6, 2026 · 59:31
Microsoft's new Agent ID introduces a blueprint-based identity model for AI agents in Entra ID, replacing per-agent service principals with scalable, governed identity objects 3:24. Security teams must understand this architecture to secure credentials, monitor agent activity, and respond to compromise.
Key Takeaways:
• Four object types: Agent Blueprint (template/credential holder), Blueprint Principal (tenant installer), Agent Identity (runtime identity that receives permissions), and optional Agent User (for resources requiring a user object, like mailboxes or Teams) 15:38.
• Credential risk: The blueprint holds the single credential authenticating all child identities—if compromised, attackers can act as any linked agent. Owners can also manage credentials, so assignment matters 19:15.
• Authentication & logging: Agents authenticate via "On Behalf Of" (as a user) or "Application Only" (as itself); tokens link to the Agent Identity in logs, notably non-interactive sign-in logs 31:02.
• Visibility & response: Many agents don't yet use Agent ID, so discovery via Agent 365 has gaps. On compromise, rotate blueprint credentials, disable specific identities/users, or confirm compromise in Entra ID Protection to trigger conditional access blocks 40:01, 53:26.
As agents proliferate, adopting Agent ID and its governance tools is essential for enterprise security visibility.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Uh hello everyone. My name is Ethan Bowen. I'm a security solutions architect at Inviso. Uh I'm based in Frankfurt, Germany. Uh and Inviso is a European cyber security consulting company. Um and today I'm going to talk to you about AI identity, excuse me, uh uh agents, uh co-pilot and a bit about governance. Now in this session, we're going to focus uh entirely on Microsoft's ecosystem. So this is all going is going to be all about how Microsoft has implemented agentic identities. Uh so just so you know going into it uh don't expect me to change and start talking about Google at any point. This is just about uh Microsoft. Right? So uh we're going to start by talking about what is an agent. Uh why do we need agentic identities? Uh and then we'll get into how Microsoft has implemented agenti…