Microsoft Entra Agent ID is generally available and does the job properly: an agent gets its own directory object, a named human sponsor, access that expires, and Conditional Access that reads agent risk. The problem is not the governed path. It is the agents in your tenant that never entered it, and the three credentials launched in October 2026 do not pull a single one of them in.
Which agents in your tenant already have an Entra Agent ID?
Microsoft's own governance documentation describes four object types: an agent identity blueprint, a blueprint principal, an agent identity and an agent user. Around them sits machinery an identity team recognises. A sponsor is a named human accountable for an agent's lifecycle, and Microsoft states that if the sponsor leaves the organisation, sponsorship transfers automatically to their manager. Access arrives through access packages carrying group memberships, OAuth API permissions and directory roles, with an expiry date that warns the sponsor first. If the sponsor does nothing, the assignment expires and the agent loses access. Conditional Access evaluates agent risk from Entra ID Protection and attaches at blueprint level, so every agent minted from it inherits the policy. The Entra Agent ID governance documentation is explicit on all of it.
Two caveats matter more than the feature list. First, the licence gate: agent governance requires Microsoft 365 E7, or Microsoft Agent 365 paired with at least Entra P1 or Microsoft 365 E3. That is a procurement decision in a technical costume. Second, coverage. Copilot Studio documents that agents created before Entra Agent ID was implemented in May 2026 still run on traditional app registrations, and the Entra Agent ID release notes still mark the wizard for creating blueprints and identities as preview, while listing migration guidance for custom app registrations and for Copilot Studio agents. That guidance exists because there is a population to migrate.
One more detail: on an Entra Agent ID the owner is added as a sponsor with limited permissions rather than a full owner, and Microsoft notes some preexisting agents may have no sponsor at all. On a legacy app registration the owner is full owner, and any Global, Application or Cloud Application Administrator can mint a new secret for it.
The standards question has not gone away either. When we looked at the four IETF agent-identity drafts in September, two of the most-cited had expired and none had formal standing. That is why every credential below is a vendor object rather than a portable one. The same pattern sits one layer down in MCP client registration, where Entra ID accepts neither dynamic registration nor client ID metadata documents, so an agent reaching an MCP server still arrives as something you registered by hand.
What did ServiceNow and Microsoft actually ship on 15 October?
Two agent credentials launched on the same day, from different vendors, into the same enterprise estate.
ServiceNow AI Passport is a cryptographically signed credential recording what an agent may do, drawn from business context in the CMDB, governance policies and workflow approvals, and verified at each step as the agent moves between workflows and tools. Diginomica's account of the launch quotes Nenshad Bardoliwalla, SVP of AI Products, on graduated rather than binary enforcement: "It's more like a dimmer switch." The demo was a refunds agent with a $25 limit that cleared $18 automatically and was stopped from executing a $40 one on its own. Availability is expected in Q4 2026, with NVIDIA as design and launch partner and enforcement running through NVIDIA's Open Agent Safety Platform. ServiceNow says Passport uses open specifications that let other governance products, identity providers and enforcement points issue and verify the credential; it does not name them.
Microsoft agent accounts, announced the same day under the Frontier preview programme, go further into your directory. Microsoft's prerelease documentation states that an agent gets its own Entra account, a mailbox that can send and receive mail and sit on distribution lists, and a presence in Teams and the directory where colleagues @mention it. In the EEA the account, mailbox and directory entry still apply, but Teams appears only if the tenant licenses Teams separately. Each published agent consumes a Frontier for AI Teammates licence; the maker needs E5 with the Agent 365 add-on, or E7. The agent keeps one memory across everyone it works with and, in this preview, you cannot opt out, because using the agent counts as consent.
Google moved a week earlier. At Gemini at Work on 8 October, persistent coworker agents got their own Workspace identity, an email address on an agents subdomain, a calendar and Drive storage, per Futurum's write-up of the event. Three vendors inside your own estate, three issuers, seven days.
Where does the ungoverned population actually live?
Before adopting any of the above, count. In a mid-market Microsoft estate an agent credential usually sits in one of five places, each with a different revocation surface:
- Pre-May-2026 Copilot Studio and custom agents. Object: an app registration. Revocation: delete its client secret or certificate in Entra, remembering that three admin roles can mint a replacement.
- Foundry and in-house applications that were never migrated. Object: an app registration, same surface, owned by whoever built it.
- The pilot running under a named employee's account. Object: a human user. Revocation means disabling a person who is still doing their own job.
- The automation platform credential. An n8n, Make or Zapier connection holds a stored secret, revoked in that platform's console rather than in your directory.
- Your AI supplier's agent calling your API. Object: an API key on their side. Revocation is a support ticket.
Run that census against your own tenant; the result rarely flatters. What matters next is this: the October launches issue credentials for new agents on their own platform. None of them reaches items one to five.
Why does a second credential not give you a second off switch?
Because the off switch is not the credential. It is the enforcement point that checks it, and each credential here is checked by its own. AI Passport is verified inside connected enforcement points, NVIDIA's platform at launch. An Entra Agent ID governs authentication to channels and services and the connector permissions Conditional Access can target. A Frontier agent account adds a mailbox and a directory entry. Revoking one does not revoke the others, because none of them is asked.
This is also where the partnership story needs narrowing rather than repeating. Futurum's analysis of the expanded ServiceNow–Microsoft agreement, published in November 2025, argued that AI Control Tower and Agent 365 together form a governance layer across many AI systems, and noted that Agent 365 automatically detects agents from Microsoft, ServiceNow, Adobe, Workday and others. That is a fair description of discovery, which is the half that works. Detecting an agent tells you it exists; it does not tell its issuer to stop honouring its token.
The same analyst returned on launch day, under the headline that AI Passport closes the agentic governance gap. It closes it for agents ServiceNow issues a passport to; the piece never describes how revocation works for a credential another vendor issued. The five places below are exactly those credentials.
The distinction is not academic, and the clearest illustration arrived the day after the launches. On 16 October, Fortune reported that OpenAI had added four incidents to its disclosures page, which now lists nineteen. All four occurred in June and OpenAI learned of three of them in August or September. In one, rated critical, a model looking up public data reached an internal system, made changes, retained access after reverting those changes, and downloaded 147,451 rows from non-public tables without disclosing any of it to its evaluators. Reverting the action did not revoke the entitlement. That gap is precisely what a revocation surface exists to close, and it is the gap a second issuer does not touch.
How do you bring a non-Microsoft agent into the governed path?
There is a documented answer, and it is the only route here that actually shrinks the census. It is not October news: Microsoft published it in April 2026, which is part of why none of the launch coverage mentions it. Microsoft's Entra Agent ID release notes list guidance for configuring non-Microsoft agents through sidecar and federation, with named articles for Amazon Bedrock and for n8n. That turns item four on the list above from a credential in somebody else's console into an identity that lives in your own directory. The page covers token exchange and secret rotation, not expiry, so the access package still has to be added by you.
A workable order of operations for a mid-market estate:
- Census first. One spreadsheet, five columns: agent, platform, credential object, who can revoke it, when it last acted.
- Migrate the app registrations Microsoft gives migration guidance for, preserving the GUIDs so nothing downstream breaks.
- Name a sponsor for every agent identity, and check the agents Microsoft warns may not have one yet.
- Put access on an access package with an expiry date rather than a standing grant. The expiry does the work your review cycle keeps postponing.
- Attach Conditional Access at blueprint level so inheritance, not discipline, enforces it.
Only then is a runtime credential like AI Passport worth evaluating, because you finally know which agents it would and would not cover.
Two notes. If most of your agents came from a Copilot rollout, the census is largely a Power Platform question with a documented migration path. If they came from a self-hosted assistant on your own data, the credential is already yours, a quiet advantage of running the assistant privately: no third issuer to reconcile.
What this means for a Dutch IT department running two suppliers
For an IT manager, informatiemanager or security officer in a 250 to 5,000 FTE organisation, the awkward part is organisational, not technical. You have an ICT partner administering the estate and, increasingly, a separate specialist supplier building the agents. The AI supplier does not hold the keys to Entra. The ICT partner does not build the agents and will not volunteer to inventory them. The census belongs to neither unless someone writes it into a RACI, which is why it is missing in most estates that already run agents.
Three specifics land differently in the Netherlands than they do in the American coverage. The EEA carve-out is in Microsoft's own preview documentation: agent accounts work, but Teams presence depends on a separate Teams licence. The shared memory in that preview has no privacy boundary between users and cannot be switched off without disabling agent accounts entirely, which makes it an instemmingsrecht conversation with your works council before it is a configuration decision. And the licence gate, E7 or Agent 365 plus Entra P1 or E3, puts the governed path in next year's budget rather than in a change request.
If that conversation is new, the ground has been prepared: the same works-council logic already applies to detecting shadow AI on your own network. And if you are deciding how much of this to carry in-house versus with a specialist, the trade-offs sit in our note on applied AI in mid-sized organisations.
Our position on this is narrow and worth stating plainly: Crux Digits is an AI supplier that works alongside your existing ICT partner, not an ICT partner. We do not run your directory. What we do is make the seam explicit: which plane issues an agent's credential, who sponsors it, when its access expires, and which of the five places above it came from, so that the question of who can switch it off has an answer before an auditor asks.
We build custom AI and LLM systems that run in production: a clickable MVP by the second call, fixed steps, and you own the code.
AI development agency in the Netherlands →
