Does Agent 365's governance cover app-only/service-principal agents, or only delegated-user agents?

Enterprise Architecture Statement

Governance & Management Plane
Microsoft’s emerging agent governance capabilities — spanning Microsoft 365 admin center agent management, Copilot Studio governance, Entra workload identity controls, and Purview — treat agents as managed entities. Autonomous, app-only/service-principal agents can be inventoried where supported by the relevant Microsoft agent governance and workload integration surfaces, assigned ownership, reviewed for permissions, blocked, or removed. These management-plane controls exist independently of whether the agent authenticates using delegated user credentials or an application identity.

Runtime Enforcement: The User-Context Gap
When an agent operates under a delegated user token, Microsoft security controls (Purview DLP, sensitivity labeling, Conditional Access) can evaluate user context including group membership, sign-in risk, device compliance, location, and authentication state. In the app-only model, that user context is absent. The security boundary becomes the workload identity itself: the application identity, its permissions, tenant association, and configured access. Therefore, policies that depend on human user context — such as user risk, user membership conditions, or device compliance requirements — cannot be evaluated in the same way.

What Still Works Preventatively (App-Only)
App-only agents are not automatically audit-only. Preventative controls based on workload identity, permissions, and resource boundaries continue to apply:

• Entra application permissions and app-consent governance limit what the service principal can access.
• Workload and resource-level restrictions (e.g., limiting an agent to a specific SharePoint site or library) remain enforceable.
• Tenant-level application restrictions and Conditional Access policies targeting the application identity can apply where supported by the workload and authentication flow (for example, supported workload identity scenarios).

What degrades is user-conditional enforcement. Policies like “Block external sharing if the user is high risk,” “Require a compliant device,” or “Apply controls based on user location” cannot be evaluated against a headless agent because there is no user session. In these cases, enforcement may rely on workload identity controls, monitoring/audit, or workload-specific default labeling behavior rather than user-context-aware evaluation.

Audit Visibility
Audit capabilities are increasingly enriched to distinguish autonomous agent activity from user activity. The enterprise question is no longer only “Who executed the action?” but also “What initiated the action?” A complete audit chain should identify:

• the human initiator (if applicable)
• the agent identity
• the authentication model used
• the trigger event
• the tools/API calls involved
• the resulting action

This is the level of visibility SOC teams require.

Current State Summary
Agent governance addresses the identity and management gap: agents can now be governed as entities with inventory, ownership, permissions, lifecycle controls, and auditability — including app-only/service-principal agents. However, it does not make app-only agents equivalent to user-delegated sessions for runtime security enforcement. Organizations deploying autonomous agents today should combine:

• agent governance
• workload identity governance
• least-privilege permissions
• resource-level security boundaries
• monitoring and auditing

Microsoft is actively expanding autonomous-agent governance capabilities, but app-only agents do not yet have complete parity with human-user security enforcement because many Microsoft security controls still depend on user context.

Strategic Note for CISO Audiences

For autonomous agents, the primary security control shifts from authenticating the actor to constraining the actor: limiting permissions, reducing accessible data scope, controlling available tools, and monitoring behavior. This is the operational reality that defines the risk profile of headless agents today.

Core Architectural Reality

Agent governance can govern the agent as an identity, but it does not yet provide the same contextual security model that exists when an agent operates on behalf of a human user.

Since no one has come forward so far, I did a little research... Various AI tools and translation software were used to create and translate this text into English. It is worth reviewing it again.

My answers are voluntary and without guarantee!

Hope this will help you.