Your AI agents have identities too. Who's watching them?

Why it matters

Microsoft auto-assigns an owner when an AI agent identity is created, but never a sponsor, so a real person accountable for that agent's behaviour is often missing entirely. And "owner" doesn't always mean a person either, it can resolve to another machine identity one step removed, which isn't the same thing as someone who can actually be held accountable. Then there's the permissions question: an agent's underlying blueprint can be granted broad Microsoft Graph access that every agent minted from it inherits automatically, a much wider blast radius than a single over-permissioned app. None of this shows up in the Entra admin center's day-to-day view. It's a new object type, created by a platform your security team may not have configured directly, and it behaves like every other unmanaged non-human identity that's come before it, just faster and with less oversight. ID Posture checks it the same way it already checks application registrations, service principals, and managed identities: on every scan, no separate tool required.