Entra Agent Identity Sponsorship Lifecycle

TL;DR: This skill audits the Microsoft Entra agent identity sponsorship model to confirm every deployed agent has an active human sponsor, that sponsor-departure triggers automatic ownership transfer, and that agents with no valid sponsor are escalated for immediate decommissioning review.

What does the Entra agent identity sponsorship lifecycle audit examine?

Microsoft Entra agent identities — non-human identities created for Copilot Studio agents, declarative agents, and Microsoft Agent 365 — require a human sponsor: a named employee who is accountable for the agent’s actions and permissions. The sponsorship model (introduced alongside Entra Agent ID GA in May 2026) is an entitlement-governance concept: when the sponsor’s Entra account is deactivated, the agent identity should be automatically transferred to the sponsor’s manager or flagged for decommissioning. Without this lifecycle control, agent identities become orphaned, accumulating permissions that outlive their business justification and creating persistent access risks equivalent to a former-employee account that was never offboarded. This skill audits the current sponsorship coverage, identifies agents with inactive or no sponsors, verifies the sponsor-departure transfer workflow, and reports the compliance status against the Microsoft Entra ID Governance agent lifecycle recommendations.

When should you run this skill?

• “Audit Entra agent sponsorship coverage”
• “Find agents without an active human sponsor”
• “Check if sponsor-departure triggers agent ownership transfer”
• “Review agent identity lifecycle governance”
• “Produce evidence of agent identity governance for IRAP”
• “Identify orphaned Copilot Studio agents”

How this skill works, step by step

1. Query Entra ID for all agent identities: Get-MgServicePrincipal -Filter "tags/Any(t:t eq 'AgentIdentity')" or via the Entra portal → Enterprise applications → Application type: Managed identities + Agent identities
2. For each agent identity, retrieve the assigned sponsor (owner attribute linked to a user object)
3. Check each sponsor’s account status: enabled, disabled, or deleted
4. Flag agents with: no sponsor assigned, sponsor account disabled or deleted, sponsor who has not signed in for more than 90 days (potential departure precursor)
5. Review the Entra ID Governance lifecycle workflow: Settings → Lifecycle Workflows — confirm a “sponsor departure” workflow exists that either reassigns agent ownership to the manager or raises an access review for the agent’s permissions
6. For agents flagged as orphaned (no active sponsor), check when the agent last authenticated — if last sign-in within 30 days, escalate as High risk (active orphaned agent)
7. Produce the register below and recommend: Transfer (reassign to manager), Decommission (no business justification), Review (sponsor inactive but agent unused)

Output format

Summary:

• Total agent identities: N
• Agents with no sponsor: N
• Agents with inactive or departed sponsor: N
• Agents without sponsor-departure lifecycle workflow: N
• Active agents (last 30 days) with no valid sponsor: N (escalate immediately)

Scope and safety

Read-only — this skill does NOT:

• Disable or decommission agents
• Reassign sponsors or modify ownership attributes
• Trigger lifecycle workflows

Licensing and permissions

Licences and add-ons

Least-privilege roles

• Global Reader (read-only review of all agent identities, owners, and lifecycle workflow configuration)
• Identity Governance Administrator (read lifecycle workflow configuration)

Microsoft Graph permissions (read-only)

• Application.Read.All — enumerate agent identity service principals and their owner attributes
• Directory.Read.All — resolve sponsor user object status (enabled/disabled) and manager relationships
• LifecycleWorkflows.Read.All — read Entra ID Governance lifecycle workflow definitions and scope

Related skills

• Entra Agent ID Audit: run before to list every agent identity and flag agents with no accountable sponsor
• Lifecycle Workflows Joiner Mover Leaver Coverage: run alongside to confirm joiner, mover and leaver events are automated in Microsoft Entra
• Conditional Access for Agents: run after to draft a Conditional Access policy specification for agents that stay in service
• Governing AI Agents in Microsoft 365: the pillar guide to governing agents by finding them first

Sources and compliance

• Governing agent identities in Microsoft Entra ID Governance (Microsoft Learn) 
• Microsoft Entra Agent ID — General Availability (May 2026) 
• Aligns with the Starter Leaver Access Review skill for a unified joiner-mover-leaver + agent lifecycle governance practice
• Pair with Entra Agent ID Audit for complete agent identity risk coverage

Licensed under CC BY 4.0  by EDUC4TE .

Last reviewed 2026-06-22