Agents

Purpose

The Agents report provides visibility into AI agents, agent identities, and agent-based applications running across your Microsoft environment.

As organizations adopt Microsoft Copilot Studio, Power Virtual Agents, Agent Identities, and other AI-powered solutions, it becomes increasingly important to understand what agents exist, who owns them, what permissions they have, and whether they are actively used.

This report helps organizations establish governance for AI agents, reduce security risk, and ensure accountability for automated workloads.

---

What can I use this report for?

Use this report to:

• Discover AI agents deployed across the organization

• Identify agents without assigned owners or sponsors

• Review permissions granted to agent identities

• Detect potentially overprivileged agents

• Understand which agent technologies are being used

• Support AI governance and compliance initiatives

• Improve accountability and lifecycle management

---

Understanding Agent Types

The report can identify several categories of agents.

Copilot Studio Agents

Agents created through Microsoft Copilot Studio to automate business processes, answer questions, and perform tasks.

Power Virtual Agents

Conversational agents designed to assist users through chat-based interactions.

Agent Identities

Dedicated identities used by agents or automated services to access Microsoft resources.

Foundry Agentic Instances

Agent-based workloads deployed through Microsoft's AI and agent ecosystem.

---

Understanding Risk Levels

Risk levels are assigned based on permissions, ownership, activity, and governance signals.

Risk Level	Description
High	Elevated permissions, governance gaps, or increased security exposure
Medium	Requires review but does not present immediate risk
Low	Well-governed agent with limited risk exposure

Organizations should prioritize High-risk findings for review.

---

Common Use Cases

Find Unowned Agents

Filter on:

• Has Owner = No

Review whether the agent is still required and assign an accountable owner.

---

Find Agents Without Business Sponsorship

Filter on:

• Finding = No sponsor

Ensure every business-critical agent has a responsible sponsor who can validate its purpose and ongoing need.

---

Review High-Risk Agent Permissions

Filter on:

• Risk Level = High

Review assigned permissions and verify that the agent follows the principle of least privilege.

---

Identify Dormant Agents

Filter on:

• Finding = High impact permissions with no matched sign-ins

Determine whether the agent is still required. Unused agents with elevated permissions may represent unnecessary security exposure.

---

Review AI Adoption

Break down by:

• Agent type

• Owner

• Sponsor

Gain visibility into how AI agents are being adopted across the organization.

---

Recommended Actions

Organizations should regularly review:

• Agents without owners

• Agents without sponsors

• Agents with elevated permissions

• Dormant agents with access to business data

• Agent identities with Entra role assignments

• Legacy agents that are no longer required

Every AI agent should have:

• A clearly defined business purpose

• An accountable owner

• A business sponsor

• Appropriate permissions

• Periodic governance reviews

---

Key Questions This Report Helps Answer

• Which AI agents exist in our environment?

• Who owns each agent?

• Which agents lack business sponsorship?

• Are any agents overprivileged?

• Which agents are actively used?

• Are dormant agents retaining unnecessary access?

• Which AI technologies are being adopted across the organization?

• Where should governance efforts be focused?

---

Data Source

This report uses data collected from:

• Microsoft Entra ID

• Microsoft Copilot Studio

• Power Platform

• Microsoft Graph

Data is updated during scheduled Bsure collection runs.