AI agents are coming—are your identity controls prepared?

AI is reshaping identity risk. Attackers now use AI to automate phishing, social engineering, and privilege escalation, making credential theft faster and more convincing than ever. SMS codes and push approvals can be intercepted, while standing privileges give attackers reach far beyond a single account.

On the other hand, as organizations adopt AI agents, identity risk grows exponentially. Securing agent identities is critical to maintaining trust and control. The same principles that protect user identities must now extend to every agent identity.

Reinforcing the principles

Microsoft’s recently published guidance, Secure identity to get ready for AI, reinforces key principles for securing identities: move users and administrators to phishing-resistant multifactor authentication (MFA), eliminate standing privileges with Microsoft Entra Privileged Identity Management (PIM), and extend a unified policy engine to govern every identity.

Putting the principles into practice

Implement these principles in sequence to strengthen your Zero Trust foundation and secure every identity, starting with the accounts and controls you already manage:

• Move users and admins to phishing-resistant MFA. Protect privileged accounts first by requiring MFA for every administrator and moving them to device-bound passkeys or FIDO2 security keys. Plan a phishing-resistant, passwordless authentication rollout across your workforce using methods such as Windows Hello for Business, device-bound passkeys, synced passkeys, or certificate-based authentication.
• Eliminate standing privileges. Permanent administrative assignments create lasting exposure. Run Microsoft Entra Privileged Identity Management (PIM) discovery, and convert static roles to eligible, time-bound activations that require justification and MFA. Govern guest access through expiring access packages.
• Apply policy coverage across every identity and resource. Apply Conditional Access broadly, block legacy authentication, and require device compliance through Microsoft Intune. Enable Microsoft Entra ID Protection to respond to identity risk in real time by enforcing MFA at medium risk and a credential reset at high risk. Maintain continuous coverage by exporting logs to Microsoft Sentinel or Azure Monitor, alerting on privileged activations, and running recurring access reviews.

Start your secure identity journey today

Phishing-resistant MFA removes the password and SMS-based paths attackers depend on. Just-in-time activation through PIM removes standing privileges. A unified policy engine secures identities consistently. By securing identities in the recommended sequence, you establish the Zero Trust foundation that AI identities need to inherit least privilege and remain secure by design. Explore the full guidance: Secure identity to get ready for AI with Microsoft Entra

We’d love to hear your feedback on the guidance in the comments below, especially how it helps your organization prepare to secure agent identities.

-Melainie Maynes – Director, Identity and Network Access

Additional resources

• Secure your Microsoft Entra identity infrastructure
• Plan a phishing-resistant passwordless authentication deployment in Microsoft Entra ID
• Discovery and insights (preview) for Microsoft Entra roles in Privileged Identity Management
• Azure identity management and access control best practices
• Continuous access evaluation in Microsoft Entra
• Four priorities for AI-powered identity and network access security in 2026
• Zero Trust Workshop
• Secure Future Initiative Progress Report

Learn more about Microsoft Entra

Prevent identity attacks, ensure least-privilege access, unify access controls, and improve the user experience with comprehensive identity and network access solutions across on-premises environments and clouds.

• Microsoft Entra News and Insights | Microsoft Security Blog
• Microsoft Entra blog | Tech Community
• Microsoft Entra documentation | Microsoft Learn
• Microsoft Entra discussions | Microsoft Community