Agents
Purpose
The Agents report provides visibility into AI agents, agent identities, and agent-based applications running across your Microsoft environment.
As organizations adopt Microsoft Copilot Studio, Power Virtual Agents, Agent Identities, and other AI-powered solutions, it becomes increasingly important to understand what agents exist, who owns them, what permissions they have, and whether they are actively used.
This report helps organizations establish governance for AI agents, reduce security risk, and ensure accountability for automated workloads.
What can I use this report for?
Use this report to:
Discover AI agents deployed across the organization
Identify agents without assigned owners or sponsors
Review permissions granted to agent identities
Detect potentially overprivileged agents
Understand which agent technologies are being used
Support AI governance and compliance initiatives
Improve accountability and lifecycle management
Understanding Agent Types
The report can identify several categories of agents.
Copilot Studio Agents
Agents created through Microsoft Copilot Studio to automate business processes, answer questions, and perform tasks.
Power Virtual Agents
Conversational agents designed to assist users through chat-based interactions.
Agent Identities
Dedicated identities used by agents or automated services to access Microsoft resources.
Foundry Agentic Instances
Agent-based workloads deployed through Microsoft's AI and agent ecosystem.
Understanding Risk Levels
Risk levels are assigned based on permissions, ownership, activity, and governance signals.
High
Elevated permissions, governance gaps, or increased security exposure
Medium
Requires review but does not present immediate risk
Low
Well-governed agent with limited risk exposure
Organizations should prioritize High-risk findings for review.
Common Use Cases
Find Unowned Agents
Filter on:
Has Owner = No
Review whether the agent is still required and assign an accountable owner.
Find Agents Without Business Sponsorship
Filter on:
Finding = No sponsor
Ensure every business-critical agent has a responsible sponsor who can validate its purpose and ongoing need.
Review High-Risk Agent Permissions
Filter on:
Risk Level = High
Review assigned permissions and verify that the agent follows the principle of least privilege.
Identify Dormant Agents
Filter on:
Finding = High impact permissions with no matched sign-ins
Determine whether the agent is still required. Unused agents with elevated permissions may represent unnecessary security exposure.
Review AI Adoption
Break down by:
Agent type
Owner
Sponsor
Gain visibility into how AI agents are being adopted across the organization.
What you'll see, and why it matters — the assessments
Beyond the report itself, Bsure runs a set of standing checks on your agents and surfaces them on Assessments, under the Agents category. Each one names a finding and suggests the next action.
Accountability
Agents Whose Owner Has Been Disabled or Deleted
What it gives you: agents left behind when the person responsible for them moved on — with a re-assignment suggestion to that person's manager, so accountability doesn't silently lapse.
Agents Without Owner or Sponsor
What it gives you: the agents nobody has claimed yet, so you can assign an accountable owner and a business sponsor before the list grows unmanageable.
Access and exposure
Agents With Permissions Beyond Their Blueprint
What it gives you: agents that have picked up more access than their template ever declared — worth a look before that gap becomes a habit.
Agents With High Blast Radius
What it gives you: the agents combining broad data access with a way to send that data out — the combination that turns an oversight into an incident.
Hygiene and lifecycle
Agents With Expiring Credentials
What it gives you: a heads-up before an agent's credentials lapse and quietly stop a process that depends on it.
Dormant Agents
What it gives you: agents with no recent activity, so you can confirm they're still needed or retire them.
Dormant Agent Users Holding a License
What it gives you: license spend tied to agent accounts nobody is using — a straightforward reclaim.
Legacy Agents Needing Migration
What it gives you: older agents built before today's agent platform, flagged so they can be brought under the same governance as everything else.
Accepting risk
Every one of these findings can be accepted instead of acted on immediately — with a reason and a date to revisit it — the same way as any other assessment. See Accepting risk.
Recommended Actions
Organizations should regularly review:
Agents without owners
Agents without sponsors
Agents with elevated permissions
Dormant agents with access to business data
Agent identities with Entra role assignments
Legacy agents that are no longer required
Every AI agent should have:
A clearly defined business purpose
An accountable owner
A business sponsor
Appropriate permissions
Periodic governance reviews
Key Questions This Report Helps Answer
Which AI agents exist in our environment?
Who owns each agent?
Which agents lack business sponsorship?
Are any agents overprivileged?
Which agents are actively used?
Are dormant agents retaining unnecessary access?
Which AI technologies are being adopted across the organization?
Where should governance efforts be focused?
Data Source
This report uses data collected from:
Microsoft Entra ID
Microsoft Copilot Studio
Power Platform
Microsoft Graph
Data is updated during scheduled Bsure collection runs.
Last updated
Was this helpful?