Monitor risky agents and keep agent governance current

This article is part of a multi-part series on Microsoft Entra Agent ID governance. For the full sequence and recommended reading order, start from the Governing AI agents with Microsoft Entra Agent ID and Agent 365

Agent governance does not finish when inventory, custom security attributes, Conditional Access policies, access packages, and lifecycle workflows are configured. That is only the foundation.

The real operating model starts after that.

Agents will continue to be created. Sponsors will move roles. Access packages will expire. Some agents may become risky. Some may become unused. Some may lose ownership. If the organisation does not monitor these signals, the governance model will slowly become stale.

The final stage of the agent governance journey is continuous monitoring and operational review.

Why monitoring matters

A governed agent estate should not be treated as a one-time project. It should behave more like an identity governance programme.

The organisation should be able to answer these questions on an ongoing basis:

• Are any agents currently risky?
• Are any agents accessing resources unexpectedly?
• Are any agents missing owners or sponsors?
• Are any approved agents no longer used?
• Are access package assignments nearing expiry?
• Have any agents lost their sponsor due to role change or departure?
• Are custom security attributes still accurate?
• Are Conditional Access policies working as expected?
• Are any agents still in ReviewRequired state for too long?

If these questions are not reviewed periodically, the environment may drift back into unmanaged state.

What to monitor

The monitoring layer should focus on a few practical areas instead of trying to inspect every detail manually.

Monitoring area	Why it matters	Recommended action
Risky agents	Agent identities may show risky behaviour or unusual access patterns.	Review high-risk agents, block access if required, disable the agent, or move it back to ReviewRequired.
Sign-in logs	Shows whether agents are authenticating and accessing resources as expected.	Validate Conditional Access impact and check unexpected access behaviour.
Audit logs	Helps track changes to agent identity, ownership, sponsorship, attributes, and access assignments.	Review important changes and investigate unauthorised or unexpected updates.
Owner and sponsor gaps	Agents without accountability become governance risks.	Re-run ownership and sponsorship gap reports periodically.
Access package expiry	Agent access should not remain permanent without review.	Track expiring assignments and ensure sponsor or approver validates continued need.
Custom security attribute drift	Incorrect attribute values can lead to wrong policy targeting.	Review agents with missing, stale, or inconsistent attribute values.
Conditional Access impact	Policies may block or allow agents unexpectedly if scope is wrong.	Review report-only results and policy impact before broad enforcement.
Lifecycle workflow outcomes	Sponsor transition workflows depend on accurate user and manager data.	Verify sponsorship transfers and notifications worked as expected.

Review high-risk agents

Identity Protection for agents should be treated as an operational review point.

If an agent is marked as high risk, the organisation should not simply ignore the signal. The response should depend on the agent’s business criticality, access level, and sensitivity.

Recommended actions include:

• Review the agent’s recent sign-in and audit activity.
• Confirm the agent’s owner and sponsor.
• Validate whether the agent still has a valid business purpose.
• Check access package assignments and resource permissions.
• Move the agent to ReviewRequired if the risk is unclear.
• Block access through Conditional Access if required.
• Disable the agent identity if immediate containment is needed.
• Retire the agent if it is no longer required.

The key point is that risky agents should not remain silently approved.

Use governance states to drive action

The monitoring process becomes easier when agents have clear governance states.

Governance state	Meaning	Monitoring action
Approved	Agent is classified, accountable, and allowed to operate.	Monitor normally.
ReviewRequired	Agent has missing or uncertain metadata, risk, or ownership issue.	Do not treat as production-ready until reviewed.
Rejected	Agent should not be used.	Ensure access is blocked or removed.
Orphaned	Agent has no valid owner or sponsor.	Start claim-or-retire process.
Retiring	Agent marked for removal or decommissioning.	Track until disabled or deleted.
Disabled	Agent no longer allowed to operate.	Confirm access and assignments removed.

These states should be reflected in custom security attributes or the governance tracker so that operations teams can filter and act quickly.

Monitor Conditional Access effectiveness

Conditional Access policies for agents should be reviewed after deployment.

The review should check whether policies are doing what they were designed to do:

• Approved agents can access expected resources.
• Rejected or unknown agents are blocked.
• Risky agent identities are blocked or restricted.
• Report-only policies are showing expected impact.
• No business-critical agent is unintentionally blocked.
• Policies are scoped to the correct access pattern.

This is especially important because on-behalf-of agents, autonomous agents, and agent users may follow different access models.

A strong review question is:

Is this policy controlling the right identity subject for the right access pattern?

If the answer is unclear, reassess the policy before enforcement.

Monitor access package lifecycle

Access packages provide time-bound access, but they only deliver value if expiry and extension are reviewed.

For agents, access package monitoring should focus on:

• Assignments nearing expiry.
• Sponsors requesting extensions.
• Assignments with no sponsor action.
• Agents with access packages but missing valid sponsor.
• High-risk agents with active access assignments.
• Agents that no longer need access but still hold assignment.

The recommendation is simple: approved access should not become permanent access by accident.

If access is still needed, extension should follow approval. If no one validates the need, access should expire.

Review owner and sponsor health

Owner and sponsor data should be reviewed periodically.

Useful checks include:

• Agents with no owner.
• Agents with no sponsor.
• Agents where owner or sponsor has left the organisation.
• Agents where sponsor changed role.
• Agents where only technical owner exists but no business sponsor.
• Agents where sponsor exists but business purpose is unclear.

This connects directly with lifecycle workflows. If sponsor transition workflows run, the organisation should still validate whether the new sponsor is appropriate.

Automatic transfer can help continuity, but it should not replace business accountability review.

Watch for custom security attribute drift

Custom security attributes are only useful if they remain accurate.

Common drift examples:

• Agent marked Approved but sponsor missing.
• Agent marked Prod but actually used for testing.
• Agent marked Low sensitivity but now accesses confidential data.
• Agent still marked ReviewRequired after approval completed.
• Agent owner changed but OwnershipStatus not updated.
• Agent retired but still marked Active.

Build a simple periodic review around these mismatches.

The goal is not perfect metadata. The goal is trusted enough metadata to drive policy decisions safely.

Suggested operational cadence

The cadence can vary by organisation size and risk, but the operating model should include recurring checks.

Cadence	Review item
Daily or frequent	High-risk agents, blocked access events, critical policy failures.
Weekly	New agents, agents in ReviewRequired, owner or sponsor gaps, report-only CA impact.
Monthly	Access package expiry, sponsor validity, orphaned agents, attribute drift.
Quarterly	Overall agent governance posture, policy effectiveness, exception review, retired agent cleanup.

For large environments, this should be report-driven and automated where possible. For smaller environments, a lightweight review process may be enough.

What good looks like

A mature agent governance monitoring model should show:

• Every production agent has owner and sponsor.
• Every approved agent has required custom security attributes.
• Unknown agents remain under review and are not silently trusted.
• Risky agents are reviewed and actioned.
• Agent access is time-bound where appropriate.
• Access extensions require sponsor or approver validation.
• Conditional Access policies are reviewed before enforcement.
• Lifecycle workflow outcomes are validated.
• Retired or orphaned agents are removed or disabled.
• Governance dashboards show actionable exceptions, not just raw inventory.

Final operating model

The complete governance journey should now look like this:

1. Inventory agents across platforms.
2. Classify source, identity model, and access pattern.
3. Assign accountability with owners and sponsors.
4. Populate custom security attributes for governance metadata.
5. Apply Conditional Access using approval state, risk, and access pattern.
6. Use access packages for governed, time-bound access.
7. Use lifecycle workflows to maintain sponsor continuity.
8. Monitor continuously through risk, logs, access expiry, and metadata drift.

Wrap-up

Monitoring is what keeps agent governance alive.

Inventory creates visibility. Custom security attributes create structure. Conditional Access and access packages create control. Lifecycle workflows maintain accountability. Monitoring ensures the model does not drift over time.

For AI agents, the goal is not just to approve access once. The goal is to continuously confirm that each agent is still known, accountable, justified, correctly classified, and operating within policy.