Daily.Entra.News
Aboutmerill.net
Microsoft Entra Agent ID
Conditional Access

Secure autonomous agents with Conditional Access

7 October 2026Feature update+83 / −70 lines

In brief

The article now documents the enhanced object picker for selecting agent identities and blueprints, updates policy-creation steps, and notes that an Agent 365 license will soon be required.

What Entra admins need to know

Review the revised policy setup guidance and plan for the upcoming licensing requirement.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Secure autonomous agents with Microsoft Entra Conditional Access

Use Conditional Access to control access for autonomous agents that authenticate with their own agent identity and no signed-in user. This access pattern includes agents that run in the background, respond to events, run on a schedule, or are published for public use without delegated user context.

Prerequisites

Allow only approved agent identitiesspecific agents to access resources

Create a block policy that excludes approved agent identities or agent identity blueprints. Start in report-only mode so you can review the policy's effect before you enforce it. You can do this by tagging agents and resources with custom security attributes targeted in your policy, or by manually selecting them using the enhanced object picker.

Use the enhanced object picker

Create Conditional Access policy using the enhanced object picker

Organizations can create a Conditional Access policy using the enhanced object picker to block all agents except those reviewed and approved by your organization.

The enhanced object picker replaces the previous flat list experience in both the assignment and target resources sections of policy configuration. The new experience is meant to simplify the selection of items you want to scope in the policy.

  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.Conditional Access Administrator.
  2. Browse to Entra ID > Conditional Access > Policies.
  3. Select New policy.
  4. EnterGive your policy a namename. Create a meaningful standard for the policy.names of your policies.
  5. Under Assignments, select Users, agents or workload identities.
    1. Under What does this policy apply to?, select Agents.
      1. Under Include, select All agent identities.
      2. Under Exclude, select:
        1. Select Select individual agent identities.
        2. InUsing the enhanced object picker, useswitch between the tabs All, Agent blueprint principals, and Agent identities tabs to select the approvedindividual agent blueprints and/or agent identities or blueprints.approved for use in your environment.
        3. Select Select.
  6. Under Target resources >:
    1. Under Include, select All resources (formerly 'All cloud apps').
  7. Under Access controls > Grant, select:
    1. Select Block, and then select.
    2. Select Select.
  8. SetConfirm your settings and set Enable policy to Report-only.
  9. Select Create. to create your policy.

[!INCLUDE conditional-access-report-only-mode]

For more information about assignment options and the object picker, see Target agent identities in Conditional Access policies.

Allow approved agents by

Use custom security attributes

Create Conditional Access policy using custom security attributes

Use custom security attributes when you needThe recommended approach for creating this policy is to manage approved agents and resources at scale. The following example blocks agents from resources unless the agent has the HR_Approved value.

Createcreate and assign custom security attributes

to each agent or agent blueprint, then target those attributes with a Conditional Access policy. This approach uses steps similar to those documented in Filter for applications in Conditional Access policy. You can assign attributes across multiple attribute sets to an agent or cloud application.

Create attributes for agent approval status and resource departments, and then assign custom attributes

  1. Create the appropriate values.custom security attributes:
    1. Create an attributeAttribute set named AgentAttributes.
    2. Create an attributeNew attributes named AgentApprovalStatus.
    3. Configure the attribute to allow that Allow multiple values to be assignedand onlyOnly allow predefined values.
      4. values to be assigned.
      1. Add the following predefined valuesvalues: New, In_Review, HR_Approved, Finance_Approved, and IT_Approved.
  2. Create another attribute set to group resources that your agents are allowed to access.
    1. Create an attributeAttribute set named ResourceAttributes.
    2. Create an attributeNew attributes named Department.
    3. Configure the attribute to allow that Allow multiple values to be assignedand onlyOnly allow predefined values.
      4. values to be assigned.
      1. Add the following predefined valuesvalues: Finance, HR, IT, Marketing, and Sales.
  3. Assign the appropriate value to eachresources that your agent or agent blueprint and resource.is allowed to access. For example, you might want only agents that are HR_Approved to be able to access resources that are tagged HR.

For more information about custom security attributes, see Custom security attributes in Microsoft Entra ID.

Create the Conditional Access policy

CreateAfter you complete the previous steps, create a blockConditional Access policy that excludes agents with the approvedusing custom security attribute value.attributes to block all agents except those reviewed and approved by your organization.

  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator and Attribute Assignment Reader.
  2. Browse to Entra ID > Conditional Access > Policies.
  3. Select New policy.
  4. Give your policy a name. Create a meaningful standard for the names of your policies.
  5. Under Assignments, select Users, agents or workload identities.
    1. Under What does this policy apply to?, select Agents.
      1. Under Include, select All agent identities.
      2. Under Exclude:
        1. Select Select agent identities based on attributes.
        2. Set Configure to Yes.
        3. Select the Attribute we created earlier called AgentApprovalStatus.
        4. Set Operator to Contains.
        5. Set Value to HR_Approved.
        6. Select Done.
  6. Under Target resources:
    1. Under Include, select All resources (formerly 'All cloud apps').
  7. Under Access controls > Grant:
    1. Select Block.
    2. Select Select.
  8. Confirm your settings and set Enable policy to Report-only.
  9. Select Create to create your policy.

[!INCLUDE conditional-access-report-only-mode]

Block high-risk agent identities

Create a policy that blocks high-risk agent identities, based on signals from Microsoft Entra ID Protection, from organizational resources. For details on risk detection types and response actions for agents, see Identity Protection for agents. Agent risk is in Preview.

  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
  2. Browse to Entra ID > Conditional Access > Policies.
  3. Select New policy.
  4. Enter a name for the policy.
  5. Under Assignments, select Users, agents or workload identities.
    1. Under What does this policy apply to?, select Agents.
      1. Under Include, select All agent identities.
      2. Under Exclude, select Select agent identities based on attributes.
      3. Set Configure to Yes.
      4. Select the AgentApprovalStatus attribute.
      5. Set Operator to Contains.
      6. Set Value to HR_Approved, and then select Done.
      7. Under Target resources > Include, select All resources (formerly 'All cloud apps').
      8. Under Access controls > Grant, select Block, and then select Select.
      9. Set Enable policy to Report-only.
      10. Select Create.

    [!INCLUDE conditional-access-report-only-mode]

    Block high-risk agent identities

    Create a policy that blocks high-risk agent identities from organizational resources. Agent risk is in Preview.

    1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
    2. Browse to Entra ID > Conditional Access > Policies.
    3. Select New policy.
    4. Enter a name for the policy.
    5. Under Assignments, select Users, agents or workload identities.
    6. Under What does this policy apply to?, select Agents.
    7. Under Include, select All agent identities.
    8. Under Target resources > Include, select All resources (formerly 'All cloud apps').
    9. Under Conditions > Agent risk (Preview), set Configure to Yes.
      1. SelectUnder Configure agent risk levels needed for policy to be enforced, select High. This guidance is based on Microsoft recommendations and might be different for each organization.
    10. Under Access controls > Grant, select Block, and then select Select.
    11. Set Enable policy to Report-only.
    12. Select Create.

    [!INCLUDE conditional-access-report-only-mode]

    Policies for agent user accounts

    Agent-To create policies for an agent that access resources through its own user account, find agent-user policy guidance moved toin Secure agents that act as users with Microsoft Entra Conditional Access. The article includes the following policies:

Daily Entra.News

Get daily email updates

Get a concise summary of the latest Microsoft Entra updates delivered straight to your inbox.

Loading the secure signup form…