# Control 2.26: Entra Agent ID — Identity Governance for Agents

**Control ID:** 2.26
**Pillar:** Management
**Regulatory Reference:** SOX 404, GLBA 501(b), OCC Bulletin 2026-13 (formerly OCC 2011-12), FFIEC Access Management, FINRA 3110, FINRA RN 24-09
**Last UI Verified:** May 2026
**Governance Levels:** Baseline / Recommended / Regulated

---

!!! info "Generally Available — Microsoft Entra Agent ID"
    **Microsoft Entra Agent ID reached general availability in April 2026** ([Entra Agent ID — What's new](https://learn.microsoft.com/en-us/entra/agent-id/whats-new-agent-id); [Entra fundamentals — What's new](https://learn.microsoft.com/en-us/entra/fundamentals/whats-new)). The **Microsoft Agent 365** licensing bundle that packages Entra Agent ID with the Agent 365 control plane in **Microsoft 365 E7** ("Frontier Suite," which bundles E5 + Microsoft 365 Copilot + Entra Suite + Agent 365) became generally available on **May 1, 2026** ([Agent 365 admin overview](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-365-overview)). Access to Entra Agent ID and the agent governance capabilities described in this control requires **Microsoft Agent 365** licensing or **Microsoft 365 E7**. Some adjacent surfaces remain in Public Preview — notably the Lifecycle Workflows **agent-sponsor tasks** and elements of the agent identity governance experience labelled "(Preview)" in Microsoft Learn. Treat the core sponsor / access-package / lifecycle pattern as production-ready, but verify the specific Lifecycle Workflows task names and "All agents (preview)" assignment toggle naming against current Microsoft Learn before wiring supervisory cadences to the exact UI strings. **No GCC, GCC High, or DoD availability has been announced for the agent identity surfaces** as of May 2026 (see Zone-Specific Requirements for sovereign cloud guidance).

---

## How This Control Differs from Related Controls

!!! note "Scope Boundaries — Read Before Implementing"
    This control governs a distinct and new governance domain. Understanding where it begins and where related controls end prevents duplication and gaps.

    **Control 2.26 vs. Control 1.11 (Conditional Access and MFA):**
    Control 1.11 governs **access policies at authentication time** — who can create agents, what MFA is required for agent identity sign-in, and what Conditional Access policies apply at the moment an agent authenticates. That is a point-in-time gate.

    Control 2.26 governs the **ongoing identity lifecycle of the agent itself** — who is accountable for the agent over its full operational life, how long the agent identity exists, what resources it can access through governed access packages, and what happens when the accountable sponsor departs the organization. This is a continuous lifecycle process, not a one-time authentication check.

    **Control 2.26 vs. Controls 2.3 / 2.5 (Change Management and Testing/QA):**
    Controls 2.3 and 2.5 govern the **software development lifecycle (SDLC)** of agent development — how agents are built, tested, approved, and released. These are engineering lifecycle controls.

    Control 2.26 governs the **identity lifecycle** of the agent identity object in Entra ID — who is the named accountable sponsor, what access package governs the agent's resource assignments, what the expiration policy is, and how the agent is decommissioned when no longer needed. The SDLC can complete successfully while the identity lifecycle governance is entirely absent; both must be present for a compliant deployment.

---

## Objective

Establish identity lifecycle governance for all Microsoft 365 Copilot and Microsoft Copilot Studio agent identities operating within the organization's tenant. This control **supports compliance** with regulatory expectations that every agent identity has an accountable human sponsor, that access assignments are intentional and time-bound, that lifecycle events trigger governed workflows, and that agent identities are decommissioned in a controlled and auditable manner.

---

## Why This Matters for FSI

Financial services organizations face a fundamental accountability problem with AI agent proliferation: agents can be deployed quickly, but the governance mechanisms that apply to human user identities — Joiner-Mover-Leaver workflows, access reviews, entitlement management, sponsor accountability — have historically not extended to non-human identities. Microsoft Entra Agent ID addresses this gap specifically for AI agents.

!!! warning "Regulatory Accountability Gap Without This Control"
    **SOX 404** requires that access controls be documented, attributable, and reviewed. An agent with no named accountable owner and no time-bound access represents a direct gap in the access control attestation required for SOX financial reporting systems.

    **GLBA 501(b)** requires reasonable safeguards for customer financial information. An agent accessing NPI without a documented accountable sponsor and a governed access lifecycle cannot demonstrate those safeguards to OCC or FDIC examiners.

    **OCC Bulletin 2026-13 (formerly OCC 2011-12)** holds financial institutions responsible for technology risk arising from all systems — including AI agents — that process customer data. Orphaned agents (agents whose sponsor has departed with no reassignment) represent unmanaged technology risk.

    **FINRA Rule 3110, as informed by FINRA Regulatory Notice 24-09,** expects firms to supervise AI-enabled business activity through written supervisory procedures and named accountable personnel. An agent performing supervisory-adjacent functions (reviewing communications, generating reports, processing transactions) should have a named accountable owner whose role is documented in the firm's WSPs. Requiring an agent sponsor in this control helps support that supervisory framework and provides examiner-ready attribution, but **it does not substitute for the firm's obligation to assign an appropriately registered principal** where Rule 3110 requires registered supervisory responsibility.

    **FINRA 4511** requires books and records retention. All lifecycle events — agent creation, sponsor assignment, access package grants, access expirations, sponsor departure workflows, decommission — must be logged and retained for the applicable examination period (generally six years for FINRA member firms).

The consequences of non-compliance extend beyond regulatory risk: an agent operating after its accountable sponsor has departed represents an active insider-threat-equivalent risk, because no human is monitoring the agent's behavior, approving its continued access, or responsible for remediating issues it causes.

---

## Control Description

| Capability | Description |
|---|---|
| **Agent Sponsorship** | Every agent identity must have a named human sponsor assigned in Entra Agent ID. The sponsor is accountable for the agent throughout its operational lifecycle — approving resource access, attesting to continued business need, and triggering decommission when the agent is no longer required. |
| **Lifecycle Workflows** | Microsoft Entra ID Governance lifecycle workflows are extended to agent identities. Workflows trigger on defined events: agent creation (Joiner), sponsor change or agent repurposing (Mover), and sponsor departure or agent expiration (Leaver). Automated notifications, review tasks, and suspension actions are configured per zone. |
| **Entitlement Management Access Packages** | Agent resource assignments are governed through the same entitlement management framework used for user access. Access packages define the bundle of resources an agent is permitted to access. Every assignment is intentional, documented, time-bound, and subject to renewal review. |
| **Time-Bound Access** | All Zone 2 and Zone 3 agent access packages are configured with a maximum expiration period. Access does not persist indefinitely. Renewal requires active human approval with documented business justification. |
| **Orphaned Agent Prevention** | Every agent identity must have a sponsor. Microsoft Entra provides a **built-in default**: when a sponsor leaves the organization, sponsorship of their agent identities is **automatically transferred to the sponsor's manager**, so a human accountable owner is preserved without manual intervention. This control augments the default with a configured Lifecycle Workflow (Preview) that adds named agent-sponsor tasks — notifying co-sponsors and the manager of impending sponsorship changes, opening a reassignment task, and escalating to the AI Governance Lead if the new sponsor relationship is not affirmatively accepted within the SLA. The HR connector / `employeeLeaveDateTime` attribute is the documented signal source for the leaver trigger. |
| **Access Certification Campaigns** | Periodic access review campaigns are configured to certify that each Zone 3 agent's resource assignments remain appropriate. Certifiers are the current sponsor and the Compliance Officer. Failure to complete certification within the review window triggers automatic access suspension. |
| **Audit and Retention** | All lifecycle events — sponsor assignment, access package grant, renewal, expiration, suspension, decommission — are written to the Entra audit log and forwarded to the SIEM. Retention policies are aligned to FINRA 4511 six-year requirements. |

---

## Key Configuration Points

!!! note "Prerequisites"
    All configuration steps below that involve Entra Agent ID, access packages for agents, and lifecycle workflows require **Microsoft Agent 365 or Microsoft 365 E7 licensing** assigned to the operating admins and any in-scope sponsor / agent-owner users.

1. **Enable Entra Agent ID:** Confirm that the operating admin and the in-scope sponsor / agent-owner users have **Microsoft Agent 365** or **Microsoft 365 E7** licensing assigned in M365 Admin Center > Billing > Licenses. Allow propagation time before the **Agent identities** blade in the Entra admin center is available to the licensed admin.

2. **Assign sponsors to all Zone 2 and Zone 3 agents:** In the Entra admin center, navigate to the **Agent ID** experience (under Applications or via search for "Agent identities" — exact navigation may shift during preview; Microsoft Learn's *Manage Agents in Microsoft Entra ID (Preview)* page is the authoritative reference). Select the agent, open **Properties**, and assign a **Sponsor**. The sponsor must be a named human user (not a shared mailbox, distribution group, or service account); per Microsoft's documented behaviour, if the sponsor leaves the organization, sponsorship is automatically transferred to that user's manager, so the sponsor's manager-of-record in Entra must be accurate.

3. **Create an Entitlement Management catalog for agent resources:** Entra admin center > Identity Governance > Entitlement management > Catalogs > New catalog. Name: "AI Agent Resources." Add the resource types that entitlement management currently supports for agent identity assignment: **security group memberships**, **application OAuth API permissions (including Microsoft Graph application permissions)**, and **Microsoft Entra role assignments**. SharePoint site access for agents is granted indirectly by adding the agent identity to a security group that has the required SharePoint permission, not by adding the site to the catalog directly. When configuring the access package assignment policy, under **Who can get access**, select **For users, service principals, and agent identities in your directory** and then **All agents (preview)**.

4. **Create access packages for standard agent resource bundles:** Within the AI Agent Resources catalog, create access packages representing supported governance patterns (for example, "Group-based SharePoint Reader + Graph Read — Zone 2 Agent" or "Privileged catalog: Entra role + approved API permissions — Zone 3 Agent"). Where SharePoint access is required, place that access behind a governed group rather than assigning SharePoint Online site roles directly to the agent access package.

5. **Configure access package expiration:** Access package > Lifecycle settings > Maximum duration: 365 days. Renewal requires sponsor re-approval with documented business justification. For Zone 3, renewal additionally requires AI Governance Lead and Compliance Officer co-approval.

6. **Configure agent-sponsor Lifecycle Workflow tasks (Preview):** Entra admin center > Identity Governance > Lifecycle workflows > New workflow. Trigger condition: **leaver** (driven by the `employeeLeaveDateTime` user attribute populated by the HR connector). Add the documented **agent-sponsor tasks** (see Microsoft Learn: *Agent identity sponsor tasks in Lifecycle Workflows (Preview)*) — notify co-sponsors, notify the departing sponsor's manager (who will inherit sponsorship by default), open a reassignment task for the AI Governance Lead, and emit an audit event. SLA: escalate to the AI Governance Lead 5 business days before the sponsor's leave date. **Do not** configure this workflow to disable the agent identity on sponsor departure as a default action — Microsoft's automatic manager-transfer behaviour is intended to keep the agent operational while accountability shifts; suspension should be reserved for the case where the manager affirmatively declines and reassignment fails within the configured SLA.

7. **Configure quarterly access certification campaigns for Zone 3:** Entra admin center > Identity Governance > Access reviews > New review. Scope: Zone 3 agent identities and their access package assignments. Reviewer: current sponsor + Compliance Officer. Frequency: quarterly. On failure to review: remove access.

8. **Configure SIEM forwarding for Entra agent lifecycle logs:** In Entra admin center > Monitoring > Diagnostic settings, forward the **AuditLogs** category (which captures identity governance events including agent identity create/update/delete, sponsor assignment changes, access package assignment events, and Lifecycle Workflow execution) to the organization's SIEM. Filtering to *only* agent-identity events is performed downstream in the SIEM (e.g., on `category` and `targetResources.type`) by correlating object IDs and the **ApplicationManagement** / **User Management** event categories — Entra diagnostic settings export at the category level and cannot pre-filter sub-events. Apply a retention policy of six years minimum to align with FINRA 4511.

---

## Zone-Specific Requirements

!!! warning "Sovereign Cloud Availability — GCC, GCC High, DoD"
    As of May 2026, **Microsoft Entra Agent ID, agent-identity access packages, and the agent-sponsor Lifecycle Workflows tasks have no announced availability in GCC, GCC High, or DoD**. Microsoft Entra ID Governance (lifecycle workflows, entitlement management, access reviews) for human and service-principal identities is generally available in those clouds, but the agent-identity object types and the "All agents (preview)" assignment-policy option are commercial-only at this time. FSI tenants operating in sovereign clouds should:

    - **Not** implement this control as a technical configuration in GCC / GCC High / DoD until Microsoft publishes parity guidance.
    - Maintain a **documented compensating control** for agent accountability in sovereign tenants (named human owner recorded in the agent registry per Control 1.2; manual quarterly attestation; service-principal-based access governance).
    - Track Microsoft 365 and Entra roadmap items filtered to government clouds, and re-verify availability quarterly.
    - Disclose the absence of native technical enforcement in the firm's Written Supervisory Procedures so examiners are not surprised.

| Requirement | Zone 1 — Personal | Zone 2 — Team | Zone 3 — Enterprise |
|---|---|---|---|
| **Sponsor assignment** | Document agent creator as informal owner in agent description field | Formal sponsor assigned in Entra Agent ID; documented in agent metadata | Mandatory sponsor assigned at deployment; Compliance Officer designated as secondary approver |
| **Access packages** | Not required | Recommended for shared team resources; required if agent accesses resources outside creator's personal OneDrive | Mandatory for all resource assignments; no out-of-band resource access permitted |
| **Maximum access duration** | No formal expiration required | 12 months; renewal requires sponsor justification | 12 months; renewal requires AI Governance Lead + Compliance Officer co-approval |
| **Lifecycle workflow** | Not required | Alert to department head when sponsor departs; agent suspended within 10 business days if not reassigned | Immediate suspension workflow on sponsor departure; escalation to AI Governance Lead within 24 hours; mandatory reassignment within 5 business days |
| **Access certification** | Not required | Annual review by sponsor | Quarterly access certification by sponsor + Compliance Officer; evidence retained for FINRA/SEC examination |
| **Audit log retention** | Standard 90-day Entra log retention | Minimum 1 year | Minimum 6 years per FINRA 4511 |
| **Orphan detection** | Quarterly manual scan | Automated detection via lifecycle workflow; alert within 24 hours of sponsor departure | Real-time detection; immediate automated suspension pending reassignment |

---

## Roles & Responsibilities

| Role | Responsibilities |
|---|---|
| **AI Governance Lead** | Owns this control. Approves Zone 3 access package renewals. Receives escalations from sponsor-departure workflows. Maintains the entitlement management catalog for agent resources. Produces quarterly governance evidence for examination readiness. |
| **Agent Sponsor** | Named accountable owner for one or more agent identities. Approves initial access package assignment. Certifies continued business need during access review cycles. Initiates decommission workflow when agent is no longer required. Responsible for notifying AI Governance Lead before departing the organization. |
| **Compliance Officer** | Secondary approver for all Zone 3 access package grants and renewals. Co-certifier in quarterly access review campaigns. Reviews lifecycle event logs for regulatory examination preparation. |
| **Entra Identity Governance Admin** | Configures Entra Lifecycle Workflows, entitlement management catalogs and access packages, and access review campaigns for agent identities. Owns the agent-sponsor task workflow (Preview) configuration. |
| **Entra Agent ID Admin** | Day-to-day administration of agent identity registrations, sponsor assignments, and decommission execution. Acts on reassignment tasks emitted by the Lifecycle Workflow. |
| **AI Administrator** | Owns the **Microsoft Agent 365** or **Microsoft 365 E7** license assignment that gates Entra Agent ID and Agent 365 capabilities for in-scope users. Coordinates with the Entra Identity Governance Admin on cross-service prerequisites. |
| **Entra Security Admin** | Configures Entra diagnostic settings to forward `AuditLogs` to the SIEM and validates retention configuration. Monitors SIEM for orphaned-agent alerts and certification-failure events. Escalates unresolved orphan situations to the AI Governance Lead. |
| **Purview Compliance Admin** | Owns retention labels and examination-ready evidence export workflows for regulated agent governance artifacts. |
| **HR / People Operations** | Provides departure signals via HR connector integration. Ensures leaver workflows are triggered accurately and in a timely manner. Coordinates with Information Security on sponsor departure SLAs. |

---

## Related Controls

| Control | Relationship |
|---|---|
| [1.11 — Conditional Access and MFA](../pillar-1-security/1.11-conditional-access-and-phishing-resistant-mfa.md) | **Complementary — authentication governance.** Control 1.11 governs Conditional Access policies applied at agent authentication time. Control 2.26 governs the ongoing identity lifecycle after authentication is established. Both must be implemented for complete agent identity governance. |
| [2.3 — Change Management and Release Planning](2.3-change-management-and-release-planning.md) | **Complementary — SDLC lifecycle.** Control 2.3 governs the engineering lifecycle: how agents are built, approved, and released. Control 2.26 governs the identity lifecycle: how agent identities are sponsored, governed, and decommissioned. Both are required; neither substitutes for the other. |
| [2.5 — Testing and Quality Assurance](2.5-testing-validation-and-quality-assurance.md) | **Complementary — pre-deployment quality.** Control 2.5 ensures agents are tested before deployment. Control 2.26 ensures identity governance is established at and after deployment. An agent that passes QA still requires a sponsor and access package before going to production. |
| [2.8 — Access Control and Segregation of Duties](2.8-access-control-and-segregation-of-duties.md) | **Dependency — access control framework.** Control 2.8 defines the access control policy and SoD requirements. Control 2.26 implements those requirements specifically for agent identities through entitlement management access packages. |
| [2.25 — Agent 365 Admin Center Governance Console](2.25-agent-365-admin-center-governance-console.md) | **Dependency — governance platform.** The Agent 365 Admin Center (Control 2.25) provides the inventory and governance dashboard. Control 2.26 provides the identity lifecycle governance layer for the agents inventoried in that console. |
| [3.6 — Orphaned Agent Detection and Remediation](../pillar-3-reporting/3.6-orphaned-agent-detection-and-remediation.md) | **Layered defense — reactive vs. preventive.** Control 3.6 is the operational detection and remediation control for orphaned agents already identified in the environment. Control 2.26 is the preventive identity governance layer that prevents orphaning in the first place. Both are required for a complete orphan management posture. |

---

## Implementation Playbooks

| Playbook | Description |
|---|---|
| [Portal Walkthrough](../../playbooks/control-implementations/2.26/portal-walkthrough.md) | Step-by-step Entra admin center and M365 admin center configuration: Microsoft Agent 365 / Microsoft 365 E7 license assignment, agent identity sponsor assignment, entitlement management catalog and access package creation, lifecycle workflow setup, and access certification campaign configuration. |
| [PowerShell Setup](../../playbooks/control-implementations/2.26/powershell-setup.md) | Microsoft Graph API and PowerShell commands to query all agent identities and sponsors, export governance gap reports (agents without sponsors, agents with expired access), perform bulk sponsor assignments, and generate evidence exports for examination readiness. |
| [Verification Testing](../../playbooks/control-implementations/2.26/verification-testing.md) | Test procedures to validate that sponsor assignment is functioning, access packages are applying correctly with proper expiration, lifecycle workflows fire on sponsor departure simulation, and access certification campaigns surface Zone 3 agents. |
| [Troubleshooting](../../playbooks/control-implementations/2.26/troubleshooting.md) | Resolution guidance for the most common implementation issues: Agent identities not visible (Microsoft Agent 365 / E7 license assignment), lifecycle workflow not triggering (HR connector and trigger conditions), access package assignment failures, and sponsor reassignment notification failures. |

---

## Verification Criteria

The following criteria constitute the minimum evidence set required to attest this control as implemented. All criteria must be evidenced for Zone 3 compliance attestation. Criteria 1–5 apply to Zone 2. Criteria 1–2 apply to Zone 1 at a documentation level.

1. Entra Agent ID is enabled for the tenant via confirmed Microsoft Agent 365 or Microsoft 365 E7 license assignment to the operating admin, evidenced by the presence of the "Agent identities" blade in Entra admin center.
2. All Zone 2 and Zone 3 agents have an assigned sponsor documented in Entra Agent ID properties; zero agents in these zones show a null or empty sponsor field, as evidenced by the governance gap report from the PowerShell playbook.
3. Entitlement management access packages have been created for all standard agent resource bundles; all Zone 3 agents are assigned resources exclusively through access packages (no direct permissions outside entitlement management), as evidenced by access package assignment reports.
4. Time-bound access is configured on all Zone 2 and Zone 3 access packages with a maximum duration of 365 days; no access package for a Zone 3 agent has a perpetual (no-expiration) configuration, evidenced by access package lifecycle settings screenshots or export.
5. At least one lifecycle workflow is active and configured to trigger on sponsor departure; workflow logs show at least one test execution or a live execution with expected actions (notification sent, suspension task created), evidenced by workflow execution history.
6. Quarterly access certification campaigns have been completed for all Zone 3 agents within the current quarter; completion evidence (certifier name, date, decision) is retained in the Entra access review audit log and exported for examination file.
7. For any access package assignment that has reached its expiry date in the prior 90 days, the corresponding agent identity has either (a) had a sponsor-approved renewal recorded with documented business justification, or (b) lost the granted resource access within 24 hours of expiry. Evidence: Graph export of `accessPackageAssignment` records with `expiredDateTime` in the period, joined to the agent identity's effective permissions snapshot at expiry+24h. No agent identity in Zone 3 holds a perpetual (no-expiration) access package assignment.
8. All lifecycle event logs (sponsor assignment, access package grant, renewal, expiration, suspension, decommission) are being forwarded to the SIEM and subject to a minimum six-year retention policy, evidenced by SIEM ingestion confirmation and retention policy screenshot.

---

## Additional Resources

- [Microsoft Entra Agent ID documentation (Microsoft Learn)](https://learn.microsoft.com/en-us/entra/agent-id/)
- [Governing Agent Identities — Microsoft Entra ID Governance](https://learn.microsoft.com/en-us/entra/id-governance/agent-id-governance-overview)
- [Agent identity sponsor tasks in Lifecycle Workflows (Preview)](https://learn.microsoft.com/en-us/entra/id-governance/agent-sponsor-tasks)
- [Access packages for agent identities in Microsoft Entra Agent ID](https://learn.microsoft.com/en-us/entra/agent-id/identity-professional/agent-access-packages)
- [Entra ID Governance — Lifecycle workflows](https://learn.microsoft.com/en-us/entra/id-governance/what-are-lifecycle-workflows)
- [Entitlement management overview](https://learn.microsoft.com/entra/id-governance/entitlement-management-overview)
- [Access reviews overview](https://learn.microsoft.com/entra/id-governance/access-reviews-overview)
- [Microsoft 365 Copilot Frontier program (historical reference — Agent 365 reached GA May 1, 2026)](https://adoption.microsoft.com/copilot/frontier-program/)
- [FINRA 4511 — Books and Records Requirements](https://www.finra.org/rules-guidance/rulebooks/finra-rules/4511)
- [OCC Bulletin 2026-13 — Sound Practices for Model Risk Management (formerly OCC Bulletin 2011-12)](https://www.occ.gov/news-issuances/bulletins/2011/bulletin-2011-12.html)
- [SOX Section 404 — Internal Control Over Financial Reporting (PCAOB AS 2201)](https://pcaobus.org/Standards/Auditing/Pages/AS2201.aspx)

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Status aligned to Microsoft Learn `entra/agent-id/whats-new-agent-id` and `entra/fundamentals/whats-new` (Entra Agent ID platform GA, April 2026; Microsoft Agent 365 licensing bundle GA, May 1, 2026). Specific control narrative not yet end-to-end re-verified against the May 2026 Entra admin center build — operators should re-verify the exact UI strings ("All agents (preview)" assignment toggle, Lifecycle Workflows agent-sponsor task names) against current Microsoft Learn before wiring supervisory cadences to specific names.*
