Entra Agent ID: from Detection to Response
Source: YouTube · SANS Cloud Security · published Aug 14, 2026 · 1:00:47
This SANS webinar explains how Microsoft Agent IDs work in Entra ID and what SOCs must know to detect and respond to misbehaving agents 2:33.
Key Takeaways:
• Agent ID has four parts: blueprint (credential-holding factory), blueprint principal, agent identity (runtime, no passwords), and optional 1:1 agent user 10:10
• Blueprints are Tier-0: consented permissions are inherited by every spawned agent, so compromise enables minting malicious agents at scale 15:09
• Entra ID Protection's "unfamiliar resource access" detection is the strongest early warning of prompt injection or token theft 42:18
• Response: confirm compromise to trigger risk-based CA, block high-risk agents, disable the agent user (password resets are pointless), or deprovision the blueprint 49:00
• Gaps: blocking an agent identity doesn't block its agent user, which can't yet be blocked individually or by risk 50:28
• SOC readiness: inventory via Agent 365, ingest non-interactive and service principal sign-in logs, treat blueprints as crown jewels, assign sponsors 56:59
Agents will soon outnumber humans, so treating them as first-class identities with governance, logging, and response playbooks is critical 6:18.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Welcome everyone to this u webinar uh where we're going to be discussing agentic identities. It's a pretty big concept uh that has been introduced um to our uh you know to our IT world with the introduction of agents because with agents obviously those agents need some type of identity. Now we're going to be focusing today purely on the Microsoft ecosystem um with uh their uh agent agent ID that they've introduced towards intra ID to see how we can manage those uh next to or other non-human identities that we're already managing like applications service principles and so on and um see what the differences are and some of the uh intricate details because obviously this is all cutting edge it's all new everyone's trying to find this out including Microsoft so I'm going to try to give you as…