What is Agent identity?

There is no single formal specification for agent identity. The page cited here is one vendor's description: Microsoft's documentation of agent identities in Microsoft Entra ID. Other vendors and standards groups describe the idea in their own terms.

Microsoft frames the problem as follows. Identity models built for people and for long-lived applications fit agents poorly, because agents can be created dynamically, may live for minutes, and may be created and destroyed thousands of times a day. Service principals assume stable ownership and lifecycle. An agent identity is meant to suit that churn, so organizations can create many in bulk, apply consistent policies, and retire them without leaving orphaned credentials.

According to the page, an agent identity lets an agent request access tokens for web services, act autonomously with rights granted to the identity, act on behalf of a user with delegated rights, and authenticate incoming requests from other clients, users, and agents. Where software needs a human-style account, an agent identity can be paired with an agent user account. Activity is logged as performed by an AI agent, and for agents built in Copilot Studio the page says the creating user is recorded as the sponsor.

At the time of the fetch, the page added a caveat: extending Entra security features to agents requires a Microsoft Agent 365 license.