The mental shift: agents are identities, not features
An agent that reads sites, calls APIs and posts messages is operationally an employee with perfect memory and no judgement. The 2026 machinery finally matches that reality:
- Entra Agent ID (automatic for new Copilot Studio agents since May 2026, no opt-out): each agent is a directory identity — enumerable, credential-bearing, and now subject to the identity toolbox: Conditional Access on agents, RBAC, sign-in style telemetry, lifecycle (disable an agent like you disable a leaver).
- Agent 365 (GA May 2026, standalone ~$15/user/mo): the fleet control plane — registry of agents wherever they were built, policy over them, observability of what they touch. It GOVERNS agents; building/running stays in Studio/Foundry with their own costs — budget both lines.
The sprawl model (why this arrived so fast)
Makers build agents in Studio like they built Power Apps; custom engine agents reach everyone through included Chat on credits (taxonomy concept); each agent accumulates knowledge scopes and action endpoints. Without a registry you get the SaaS-sprawl movie again, except the SaaS can now read your files and act. The countermeasures mirror identity governance because it IS identity governance:
- Inventory — the Agent ID directory + Agent 365 registry as the single census; unregistered agents are the new shadow IT.
- Least privilege — knowledge scopes and action manifests reviewed like app consents (Teams curriculum's RSC discipline, agent edition).
- Lifecycle — owners named per agent; orphaned agents disabled on the owner's departure (the Power Automate flow-owner lesson, again).
- Access policy — CA on agent identities: which agents, from which contexts, may touch what.
- Blast-radius review for autonomous agents — triggers, max actions, kill switch documented BEFORE enablement.
What to watch (proofs)
- The census: Entra's agent identity listing vs Agent 365 registry vs Studio's environment inventory — three lists that must reconcile; deltas are shadow agents.
- Agent activity: sign-in/usage telemetry per Agent ID — the 'agent that never runs' (retire it) and the 'agent that runs 10x expected' (investigate it) both fall out of one report.
- Consent/scope drift: audit events for agent manifest/scope changes — an agent whose powers grew quietly is the incident precursor.
- CA coverage: % of agent identities under at least one Conditional Access policy — the number that turns 'we govern agents' from claim into metric.