> For the complete documentation index, see [llms.txt](https://docs.bsure.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bsure.io/user-guides/power-bi/security/agents.md). # Agents ### Purpose The **Agents** report provides visibility into AI agents, agent identities, and agent-based applications running across your Microsoft environment. As organizations adopt Microsoft Copilot Studio, Power Virtual Agents, Agent Identities, and other AI-powered solutions, it becomes increasingly important to understand what agents exist, who owns them, what permissions they have, and whether they are actively used. This report helps organizations establish governance for AI agents, reduce security risk, and ensure accountability for automated workloads. *** ### What can I use this report for? Use this report to: * Discover AI agents deployed across the organization * Identify agents without assigned owners or sponsors * Review permissions granted to agent identities * Detect potentially overprivileged agents * Understand which agent technologies are being used * Support AI governance and compliance initiatives * Improve accountability and lifecycle management *** ### Understanding Agent Types The report can identify several categories of agents. #### Copilot Studio Agents Agents created through Microsoft Copilot Studio to automate business processes, answer questions, and perform tasks. #### Power Virtual Agents Conversational agents designed to assist users through chat-based interactions. #### Agent Identities Dedicated identities used by agents or automated services to access Microsoft resources. #### Foundry Agentic Instances Agent-based workloads deployed through Microsoft's AI and agent ecosystem. *** ### Understanding Risk Levels Risk levels are assigned based on permissions, ownership, activity, and governance signals. | Risk Level | Description | | ---------- | --------------------------------------------------------------------- | | High | Elevated permissions, governance gaps, or increased security exposure | | Medium | Requires review but does not present immediate risk | | Low | Well-governed agent with limited risk exposure | Organizations should prioritize High-risk findings for review. *** ### Common Use Cases #### Find Unowned Agents Filter on: * Has Owner = No Review whether the agent is still required and assign an accountable owner. *** #### Find Agents Without Business Sponsorship Filter on: * Finding = No sponsor Ensure every business-critical agent has a responsible sponsor who can validate its purpose and ongoing need. *** #### Review High-Risk Agent Permissions Filter on: * Risk Level = High Review assigned permissions and verify that the agent follows the principle of least privilege. *** #### Identify Dormant Agents Filter on: * Finding = High impact permissions with no matched sign-ins Determine whether the agent is still required. Unused agents with elevated permissions may represent unnecessary security exposure. *** #### Review AI Adoption Break down by: * Agent type * Owner * Sponsor Gain visibility into how AI agents are being adopted across the organization. *** ### What you'll see, and why it matters — the assessments Beyond the report itself, Bsure runs a set of standing checks on your agents and surfaces them on [Assessments](/user-guides/assessments.md), under the **Agents** category. Each one names a finding and suggests the next action. ### Accountability #### Agents Whose Owner Has Been Disabled or Deleted * **What it gives you:** agents left behind when the person responsible for them moved on — with a re-assignment suggestion to that person's manager, so accountability doesn't silently lapse. #### Agents Without Owner or Sponsor * **What it gives you:** the agents nobody has claimed yet, so you can assign an accountable owner and a business sponsor before the list grows unmanageable. ### Access and exposure #### Agents With Permissions Beyond Their Blueprint * **What it gives you:** agents that have picked up more access than their template ever declared — worth a look before that gap becomes a habit. #### Agents With High Blast Radius * **What it gives you:** the agents combining broad data access with a way to send that data out — the combination that turns an oversight into an incident. ### Hygiene and lifecycle #### Agents With Expiring Credentials * **What it gives you:** a heads-up before an agent's credentials lapse and quietly stop a process that depends on it. #### Dormant Agents * **What it gives you:** agents with no recent activity, so you can confirm they're still needed or retire them. #### Dormant Agent Users Holding a License * **What it gives you:** license spend tied to agent accounts nobody is using — a straightforward reclaim. #### Legacy Agents Needing Migration * **What it gives you:** older agents built before today's agent platform, flagged so they can be brought under the same governance as everything else. ### Accepting risk Every one of these findings can be **accepted** instead of acted on immediately — with a reason and a date to revisit it — the same way as any other assessment. See [Accepting risk](/user-guides/assessments.md#accepting-risk). *** ### Recommended Actions Organizations should regularly review: * Agents without owners * Agents without sponsors * Agents with elevated permissions * Dormant agents with access to business data * Agent identities with Entra role assignments * Legacy agents that are no longer required Every AI agent should have: * A clearly defined business purpose * An accountable owner * A business sponsor * Appropriate permissions * Periodic governance reviews *** ### Key Questions This Report Helps Answer * Which AI agents exist in our environment? * Who owns each agent? * Which agents lack business sponsorship? * Are any agents overprivileged? * Which agents are actively used? * Are dormant agents retaining unnecessary access? * Which AI technologies are being adopted across the organization? * Where should governance efforts be focused? *** ### Data Source This report uses data collected from: * Microsoft Entra ID * Microsoft Copilot Studio * Power Platform * Microsoft Graph Data is updated during scheduled Bsure collection runs. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bsure.io/user-guides/power-bi/security/agents.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.