Skip to content

Commit 79e3d66

Browse files
TaojunshenTaojunshen
authored
Merge pull request #53422 from MicrosoftDocs/main
Auto Publish – main to live - 2026-02-11 00:00 UTC
2 parents 1d8a4f0 + d8f44bc commit 79e3d66

19 files changed

Lines changed: 1062 additions & 16 deletions

‎learn-pr/wwl-sci/introduction-entra-agent-id/1-introduction.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
### YamlMime:ModuleUnit
2+
uid: learn.wwl.introduction-entra-agent-id.introduction
3+
title: Introduction
4+
metadata:
5+
title: Introduction
6+
description: "Introduction to Microsoft Entra Agent ID and the challenges of managing AI agent identities in enterprise environments."
7+
ms.date: 02/09/2026
8+
author: wwlpublish
9+
ms.author: roberts
10+
ms.topic: unit
11+
durationInMinutes: 3
12+
content: |
13+
[!include[](includes/1-introduction.md)]

‎learn-pr/wwl-sci/introduction-entra-agent-id/2-describe-agent-id-compare-identities.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
### YamlMime:ModuleUnit
2+
uid: learn.wwl.introduction-entra-agent-id.describe-agent-id-compare-identities
3+
title: Describe agent ID and compare identity types
4+
metadata:
5+
title: Describe agent ID and compare identity types
6+
description: "Learn how Microsoft Entra Agent ID compares to service principals and managed identities, and understand when to use each identity type."
7+
ms.date: 02/09/2026
8+
author: wwlpublish
9+
ms.author: roberts
10+
ms.topic: unit
11+
durationInMinutes: 8
12+
content: |
13+
[!include[](includes/2-describe-agent-id-compare-identities.md)]

‎learn-pr/wwl-sci/introduction-entra-agent-id/3-identify-products-use-agent-identities.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
### YamlMime:ModuleUnit
2+
uid: learn.wwl.introduction-entra-agent-id.identify-products-use-agent-identities
3+
title: Identify products that use agent identities
4+
metadata:
5+
title: Identify products that use agent identities
6+
description: "Discover which Microsoft products automatically create and manage agent identities, including Microsoft Foundry, Copilot Studio, and Azure services."
7+
ms.date: 02/09/2026
8+
author: wwlpublish
9+
ms.author: roberts
10+
ms.topic: unit
11+
durationInMinutes: 10
12+
content: |
13+
[!include[](includes/3-identify-products-use-agent-identities.md)]

‎learn-pr/wwl-sci/introduction-entra-agent-id/4-navigate-admin-center-view-agents.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
### YamlMime:ModuleUnit
2+
uid: learn.wwl.introduction-entra-agent-id.navigate-admin-center-view-agents
3+
title: Navigate the admin center to view agents
4+
metadata:
5+
title: Navigate the admin center to view agents
6+
description: "Learn how to navigate the Microsoft Entra admin center to view, search, filter, and manage agent identities and blueprints."
7+
ms.date: 02/09/2026
8+
author: wwlpublish
9+
ms.author: roberts
10+
ms.topic: unit
11+
durationInMinutes: 12
12+
content: |
13+
[!include[](includes/4-navigate-admin-center-view-agents.md)]

‎learn-pr/wwl-sci/introduction-entra-agent-id/5-understand-access-permissions.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
### YamlMime:ModuleUnit
2+
uid: learn.wwl.introduction-entra-agent-id.understand-access-permissions
3+
title: Understand access and permissions
4+
metadata:
5+
title: Understand access and permissions
6+
description: "Learn about the roles required to manage agent identities, how permission inheritance works, and security restrictions for agent identities."
7+
ms.date: 02/09/2026
8+
author: wwlpublish
9+
ms.author: roberts
10+
ms.topic: unit
11+
durationInMinutes: 10
12+
content: |
13+
[!include[](includes/5-understand-access-permissions.md)]

‎learn-pr/wwl-sci/introduction-entra-agent-id/6-understand-microsoft-graph-operations.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
### YamlMime:ModuleUnit
2+
uid: learn.wwl.introduction-entra-agent-id.understand-microsoft-graph-operations
3+
title: Understand Microsoft Graph operations
4+
metadata:
5+
title: Understand Microsoft Graph operations
6+
description: "Learn how to use Microsoft Graph APIs to programmatically query and manage agent identities, including permission requirements and common operations."
7+
ms.date: 02/09/2026
8+
author: wwlpublish
9+
ms.author: roberts
10+
ms.topic: unit
11+
durationInMinutes: 8
12+
content: |
13+
[!include[](includes/6-understand-microsoft-graph-operations.md)]

‎learn-pr/wwl-sci/introduction-entra-agent-id/7-knowledge-check.yml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
### YamlMime:ModuleUnit
2+
uid: learn.wwl.introduction-entra-agent-id.knowledge-check
3+
title: Knowledge check
4+
metadata:
5+
title: Module Assessment
6+
description: "Module assessment"
7+
ms.date: 02/09/2026
8+
author: wwlpublish
9+
ms.author: roberts
10+
ms.topic: unit
11+
durationInMinutes: 5
12+
quiz:
13+
title: Module Assessment
14+
questions:
15+
- content: "Which two components make up the Microsoft Entra Agent ID platform?"
16+
choices:
17+
- content: "Agent identities and service principals"
18+
isCorrect: false
19+
explanation: "Sorry, that's incorrect. Service principals are a separate identity type, not a component of the Agent ID platform."
20+
- content: "Agent identities and agent identity blueprints"
21+
isCorrect: true
22+
explanation: "That's correct. The Microsoft Entra Agent ID platform consists of agent identities and agent identity blueprints."
23+
- content: "Agent users and managed identities"
24+
isCorrect: false
25+
explanation: "Sorry, that's incorrect. Agent users are an optional component, and managed identities are a separate identity type."
26+
- content: "Service principals and managed identities"
27+
isCorrect: false
28+
explanation: "Sorry, that's incorrect. These are separate identity types, not components of the Agent ID platform."
29+
- content: "What is the primary difference between agent identities and service principals in credential management?"
30+
choices:
31+
- content: "Agent identities use passwords while service principals use certificates"
32+
isCorrect: false
33+
explanation: "Sorry, that's incorrect. Agent identities don't use passwords or certificates directly."
34+
- content: "Service principals can't have credentials while agent identities can"
35+
isCorrect: false
36+
explanation: "Sorry, that's incorrect. Service principals can have their own credentials."
37+
- content: "Agent identities rely on parent blueprint credentials while service principals manage their own credentials"
38+
isCorrect: true
39+
explanation: "That's correct. Agent identities inherit credentials from their parent blueprint, while service principals manage their own credentials independently."
40+
- content: "Agent identities and service principals use the same credential management approach"
41+
isCorrect: false
42+
explanation: "Sorry, that's incorrect. They have different credential management approaches."
43+
- content: "Which Microsoft product automatically creates a shared agent identity when you create your first agent in a project, and then creates a distinct identity when you publish the agent?"
44+
choices:
45+
- content: "Microsoft Copilot Studio"
46+
isCorrect: false
47+
explanation: "Sorry, that's incorrect. Microsoft Copilot Studio assigns agent identities when enabled at the environment level, but doesn't use the shared/distinct identity pattern."
48+
- content: "Microsoft Foundry"
49+
isCorrect: true
50+
explanation: "That's correct. Microsoft Foundry creates a shared agent identity for development and a distinct identity when you publish the agent."
51+
- content: "Azure App Service"
52+
isCorrect: false
53+
explanation: "Sorry, that's incorrect. Azure App Service requires developers to manually create blueprints and agent identities."
54+
- content: "Microsoft Teams"
55+
isCorrect: false
56+
explanation: "Sorry, that's incorrect. Microsoft Teams requires developers to manually configure agent identity blueprints in the Developer Portal."
57+
- content: "Which roles are required to view and manage agent identities in the Microsoft Entra admin center?"
58+
choices:
59+
- content: "Global Administrator or User Administrator"
60+
isCorrect: false
61+
explanation: "Sorry, that's incorrect. While Global Administrator has access, User Administrator is not the recommended role for agent identity management."
62+
- content: "Agent ID Administrator or Cloud Application Administrator"
63+
isCorrect: true
64+
explanation: "That's correct. Agent ID Administrator or Cloud Application Administrator are the recommended roles for managing agent identities."
65+
- content: "Security Administrator or Compliance Administrator"
66+
isCorrect: false
67+
explanation: "Sorry, that's incorrect. These roles don't have the required permissions for agent identity management."
68+
- content: "Application Developer or Service Support Administrator"
69+
isCorrect: false
70+
explanation: "Sorry, that's incorrect. These roles don't have the required permissions for agent identity management."
71+
- content: "What happens to RBAC permissions when you publish an agent in Microsoft Foundry?"
72+
choices:
73+
- content: "They automatically transfer to the new distinct identity"
74+
isCorrect: false
75+
explanation: "Sorry, that's incorrect. RBAC permissions don't automatically transfer when publishing an agent."
76+
- content: "They must be manually reassigned to the new agent identity"
77+
isCorrect: true
78+
explanation: "That's correct. When you publish an agent, RBAC permissions must be manually reassigned to the new distinct agent identity."
79+
- content: "They're duplicated across both the shared and distinct identities"
80+
isCorrect: false
81+
explanation: "Sorry, that's incorrect. Permissions aren't automatically duplicated between identities."
82+
- content: "They're removed for security reasons"
83+
isCorrect: false
84+
explanation: "Sorry, that's incorrect. Permissions aren't removed; they simply don't transfer automatically."
85+
- content: "Which high-privilege Microsoft Entra roles can be assigned to agent identities?"
86+
choices:
87+
- content: "Global Administrator, Privileged Role Administrator, and User Administrator"
88+
isCorrect: false
89+
explanation: "Sorry, that's incorrect. These high-privilege roles cannot be assigned to agent identities."
90+
- content: "None - these roles are blocked from agent identities"
91+
isCorrect: true
92+
explanation: "That's correct. High-privilege Microsoft Entra roles like Global Administrator, Privileged Role Administrator, and User Administrator are blocked from being assigned to agent identities for security reasons."
93+
- content: "Only Global Administrator"
94+
isCorrect: false
95+
explanation: "Sorry, that's incorrect. Global Administrator cannot be assigned to agent identities."
96+
- content: "All roles can be assigned to agent identities"
97+
isCorrect: false
98+
explanation: "Sorry, that's incorrect. High-privilege roles are blocked from agent identities."
99+
- content: "What is the primary purpose of using Microsoft Graph APIs with agent identities?"
100+
choices:
101+
- content: "To create user interfaces for agent management"
102+
isCorrect: false
103+
explanation: "Sorry, that's incorrect. Microsoft Graph APIs aren't primarily for creating user interfaces."
104+
- content: "To replace the Microsoft Entra admin center"
105+
isCorrect: false
106+
explanation: "Sorry, that's incorrect. Microsoft Graph APIs complement rather than replace the admin center."
107+
- content: "To programmatically query, manage, and automate agent identity operations"
108+
isCorrect: true
109+
explanation: "That's correct. Microsoft Graph APIs enable programmatic querying, management, and automation of agent identity operations at scale."
110+
- content: "To store agent identity data in external systems"
111+
isCorrect: false
112+
explanation: "Sorry, that's incorrect. Microsoft Graph APIs are for interacting with Microsoft Entra data, not storing it externally."

‎learn-pr/wwl-sci/introduction-entra-agent-id/8-summary.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
### YamlMime:ModuleUnit
2+
uid: learn.wwl.introduction-entra-agent-id.summary
3+
title: Summary
4+
metadata:
5+
title: Summary
6+
description: "Summary of Microsoft Entra Agent ID concepts, including agent identities, blueprints, administration, and Microsoft Graph integration."
7+
ms.date: 02/09/2026
8+
author: wwlpublish
9+
ms.author: roberts
10+
ms.topic: unit
11+
durationInMinutes: 2
12+
content: |
13+
[!include[](includes/8-summary.md)]

‎learn-pr/wwl-sci/introduction-entra-agent-id/includes/1-introduction.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
The emergence of AI agents as autonomous enterprise systems introduces unique security and operational challenges that existing identity models weren't designed to address. Organizations need a way to distinguish operations performed by AI agents from operations performed by human users or traditional applications, while maintaining appropriate security controls and governance.
2+
3+
Microsoft Entra Agent ID provides specialized identity constructs designed specifically for AI agents operating in enterprise environments. These identity constructs enable secure authentication and authorization patterns that address the unique requirements of autonomous AI systems.
4+
5+
## Scenario: Managing AI Agent identities
6+
7+
Imagine you're an Identity and Access Administrator at a large organization that's adopting AI agents across multiple departments. Your marketing team uses AI agents in Microsoft Copilot Studio to answer customer inquiries. Your development team builds agents in Microsoft Foundry that access company data. Your IT team deploys agents in Azure App Service to automate workflows.
8+
9+
Each of these agents needs an identity to authenticate and access resources securely. However, using traditional service principals or managed identities doesn't provide the visibility, governance, or security controls designed for AI agents. You need to:
10+
11+
- Distinguish AI agent operations from human user operations in audit logs
12+
- Apply consistent security policies to all agents of a particular type
13+
- Prevent agents from gaining excessive privileges
14+
- Scale identity management to potentially thousands of agents that might be created and destroyed rapidly
15+
16+
Microsoft Entra Agent ID addresses these challenges by providing specialized identity types designed for AI agents.
17+
18+
## Content description
19+
20+
In this module, you learn about Microsoft Entra Agent ID and how it differs from other identity types like service principals and managed identities. You explore which Microsoft products automatically create agent identities and how to view and manage them through the Microsoft Entra admin center. You also learn about the roles required to manage agent identities and how to query them programmatically using Microsoft Graph.
21+
22+
## What is the main goal
23+
24+
By the end of this module, you'll understand what Microsoft Entra Agent ID is. You can explain how it compares to other identity types. You can define which Microsoft products use the Agent ID, and how to view and manage agent identities in your organization.

0 commit comments

Comments
 (0)