AI Agent Identity: Stop Letting Bots Use Staff Logins

Give every AI agent its own login. Not a shared service account, not a staff member's credentials, not an API key pasted into a config file by whoever built it.

Most small businesses running agents today have done exactly the opposite. The agent that reads the shared inbox runs as the office manager. The one that updates the CRM runs as whoever set it up. It works fine right up until it doesn't, and then nobody can answer the two questions that matter: what did it touch, and who said it could?

Why does an AI agent need its own identity?

Because an agent that borrows a person's account inherits everything that person can reach, and leaves that person's name on everything it does. Your audit log says Maria deleted 400 records. Maria was at lunch. You now have an incident with no evidence trail and a staff member who's understandably upset.

Separate identity fixes both halves. The agent gets only the access its job requires, and every action it takes is attributable to the agent rather than to a human.

Agents aren't apps, and that's the problem

Traditional software does what it was programmed to do. Microsoft's own security guidance for agents puts the difference plainly: "Unlike applications that execute predetermined logic, AI agents make dynamic decisions and adapt behavior based on training data, input, and environment conditions. This adaptive behavior expands the organizational attack surface."

Microsoft's Entra security for AI documentation lists what that expanded surface actually looks like. Agents get provisioned with overly broad permissions. Compromised agents act on their own. Prompt injection turns instructions in a document into commands the agent follows. Compromise spreads from one agent to another. And agents multiply without anyone tracking them.

That last one is the sleeper. Microsoft calls it agent sprawl: expansion "without visibility or lifecycle controls." Three agents is manageable. Nobody notices the jump to fifteen.

What "too much access" looks like in a 30-person company

An agent built to answer questions about pricing gets pointed at SharePoint. Whoever set it up granted it read access to the whole tenant, because that was the fastest way to make the demo work.

Six weeks later someone asks it about severance policy and it answers, accurately, from an HR folder nobody meant to expose. The agent didn't malfunction. It did its job with the permissions it was handed. We've seen the same pattern with Copilot, which is why we wrote about Copilot oversharing separately.

Scoped identity prevents this. Broad identity guarantees it.

The four things every agent needs

1. Its own identity. One per agent, never shared, never a human's account. This is what makes the audit log useful.
2. A named owner. A person who is accountable for what it does and who gets called when it misbehaves. Microsoft's guidance is to "ensure sponsors and owners are assigned and maintained for each agent identity." An agent with no owner is an orphan with credentials.
3. Least privilege, enforced. Access to the specific mailbox, the specific site, the specific records. Not the tenant.
4. An expiry date. Microsoft's framing is access that is "intentional, auditable, and time-bound." The pilot agent someone built in March should not still hold live credentials in December because everyone forgot it existed.

What Microsoft is building for this

Entra Agent ID is Microsoft's answer: an identity and security framework specifically for AI agents. It assigns identities with autodiscovery across the organization, so agents somebody spun up without telling you still show up in the inventory.

The useful parts for a smaller business are the ones that don't require a security team to operate. Conditional Access policies apply to agents the same way they apply to people. Identity Protection scores agent risk based on the agent's own behavior, not just the user behind it. And blueprints let you set rules once so every agent built from that template inherits them, which also means you can disable an entire class of agents in one move when something goes wrong.

Agent-to-agent discovery runs on standard protocols including the Model Context Protocol, the open standard for connecting AI applications to outside systems. Worth understanding before you wire an agent into your own data.

Where to start if you already have agents running

Inventory first. Write down every agent, what account it runs as, what it can reach, and who owns it. Most owners are surprised by their own list.

Then fix the worst one. Usually that's whichever agent can send email externally or move money, running on a human's credentials with no approval step. Give it its own identity, cut its permissions to what the job needs, and require a human to approve anything irreversible.

Then set the rule for the next one. Deciding "every agent gets its own identity and an owner" before agent number four is cheap. Retrofitting it across fifteen is not.

If you're earlier than that and still deciding whether agents make sense at all, our AI agents FAQ covers the cost and capability questions first.

Frequently asked questions

Can't I just use a service account like we do for other software?

You can, and it's better than a staff login, but it's not enough. Service accounts usually have static credentials, no owner, no expiry, and permissions that only ever grow. An agent makes its own decisions, so it needs access controls that can respond to risk in real time rather than a password set once in 2023.

What is agent sprawl?

Agents accumulating across a business without anyone tracking them. Microsoft defines it as uncontrolled expansion "without visibility or lifecycle controls." It happens fast because building an agent now takes an afternoon, so departments build their own and nobody keeps a list.

What is prompt injection, in plain terms?

Hiding instructions inside content the agent reads, so the agent follows them. A line buried in an emailed PDF telling the agent to forward its last ten messages to an outside address. OWASP ranks it LLM01, the top risk for LLM applications, and defines it as occurring "when user prompts alter the LLM's behavior or output in unintended ways." The agent can't reliably tell your instructions from the attacker's, which is why limiting what it can reach matters more than trying to make it smarter.

Do we need Entra Agent ID to do this properly?

No. The principles work with whatever you have: separate identity, named owner, least privilege, expiry date. Entra Agent ID makes them enforceable at scale rather than tracked in a spreadsheet, which matters once you're past a handful of agents.

How many agents is too many to manage manually?

In our experience, about five. Below that you can hold it in your head. Above it, people start losing track of what exists, and the first thing to go is knowing which agents still have access they no longer need.

Before you build the next one

We help businesses across NY, NJ, CT, PA, and Southwest Florida deploy agents that are actually governed: scoped access, named owners, and an audit trail that holds up. Start with our AI agents service, or book a complimentary assessment and we'll inventory what you already have running.