AI Agent Identity Inventory
The question it answers: Which AI agent identities exist in the tenant, what can they access, and does each have an accountable sponsor?
AI agents built with Copilot Studio, Azure AI Foundry and similar tools get their own Entra identities. They can hold permissions, act on data and run without a person watching. Every agent should have a sponsor accountable for it and an owner who manages it.
At a glance
Section titled “At a glance”| Where in the app | Entra ID › Identity Configuration › AI Agent Identities |
| Workload | Entra ID |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Microsoft Entra Agent ID (part of Microsoft Agent 365 / Entra licensing for agents). |
| Report id (API and MCP) | entra.configuration.agent-identities |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| State | Category | Text |
| Agent | Subject | Link |
| Check | Setting | Text |
| Sponsors / owners | Value | Text |
| Finding | Finding | Text |
| Detail | Detail | Text |
| Last sign-in | When | Date |
| App permissions | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Microsoft Entra Agent ID (part of Microsoft Agent 365 / Entra licensing for agents).
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
AgentIdentity.Read.All | Microsoft Graph | Read all agent identities | |
Application.Read.All | Microsoft Graph | Read all applications | |
AuditLog.Read.All | Microsoft Graph | Read all audit log data | last sign-in |
Data sources it reads
GET /v1.0/servicePrincipals/microsoft.graph.agentIdentityGET .../owners, .../sponsors, .../appRoleAssignments ($batch)GET /beta/reports/servicePrincipalSignInActivities (cached)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/entra.configuration.agent-identities?size=100An AI assistant reads it with the MCP tool get_report and the id entra.configuration.agent-identities. The client needs the Read grant for Entra ID. See Using the API.