Ask who an AI agent is, and you’ll often get a strange answer: “It’s Sarah.” Or “It’s the admin account.” Or “It’s the service account we set up for the old integration.”
That’s the AI agent identity problem. Agents read mail, move files and call other apps, but many of them don’t have an identity of their own. They borrow a person’s login, share an admin account, or run on a key nobody owns. When something goes wrong, nobody can tell what the agent did from what the person did, and nobody can stop the agent without stopping everything else.
This post explains what agent identity means, why it matters, what Microsoft and Google are doing about it, and how to fix it.
What is AI agent identity?
An AI agent identity is the account an agent uses to sign in and act. A good one has four properties:
- It’s the agent’s own. Not a person’s account and not shared with other agents or tools.
- It has a human sponsor. A named person who answers for the agent and decides whether it should keep its access.
- It’s scoped. It holds only the access the agent’s job needs.
- It’s revocable. It can be stopped in one step without breaking anything else.
Agents are one kind of non-human identity, alongside service accounts, app registrations and API keys. What makes them different is that they act on their own, at machine speed, and can be steered by what they read.
Why shared and borrowed identities are dangerous
- You can’t tell who did what. If an agent runs on Sarah’s account, every file it opens looks like Sarah opened it. Investigations stall.
- The agent gets everything the account has. An agent on an admin account can do what the admin can, whatever its job.
- You can’t stop one without stopping the other. Disabling the shared account breaks every tool that uses it.
- Nobody reviews it. Access reviews look at people. An agent hiding inside a person’s account is never reviewed on its own.
- It outlives its maker. When the person who set it up leaves, a borrowed identity often stays live.
What Microsoft and Google are changing
Both platforms are moving towards agents with identities of their own.
Microsoft. Microsoft Entra Agent ID gives agents a first-class identity in Microsoft Entra ID. Microsoft’s Copilot Studio documentation says that since May 2026, every new Copilot Studio agent automatically gets an Entra Agent ID, and the person who created it is recorded as its sponsor. Microsoft says agents built in Microsoft Foundry get one as part of onboarding too, and Microsoft Agent 365 brings these identities into one registry.
Google. Google says coworker agents in Gemini Enterprise each get their own Workspace account, with an @agents email address and Drive storage, plus a cryptographic Agent Identity for audit trails. Read Gemini Enterprise agent security for more.
That’s real progress. Three things still need doing by you:
- Older agents built before these changes, and third-party AI apps connected through consent, often still run on borrowed or shared identities.
- Sponsors go stale. The creator recorded as sponsor isn’t always the right owner, and people leave.
- An identity isn’t a limit. Having its own account doesn’t stop an agent holding far more access than its job needs.
A worked example: the integration account that did everything
This is an illustrative example, not a real client. A 45-person property management firm’s MSP takes over its Microsoft 365 tenant and finds an account called “svc-integration”.
- It was created in 2023 for a now-retired document tool, and given Global Administrator so the setup would “just work”.
- Since then, three AI tools have been connected using it: a lease-summary agent, an invoice-matching agent and a chatbot on the client portal.
- Its password is in a shared spreadsheet, and MFA is off because “integrations can’t do MFA”.
- Nobody owns it. The person who created it left in 2024.
Every one of those AI tools can do anything an admin can. If any of them is tricked by what it reads, or the spreadsheet leaks, the whole tenant is exposed.
The fix, in order: give each agent its own identity with only the access it needs; give each a named sponsor; move the three agents across one at a time; then remove the admin rights and retire “svc-integration”. The firm goes from one all-powerful shared account to three small, owned, revocable ones.
How to fix agent identity, step by step
- Find agents that don’t have their own identity. Look for service accounts and app registrations used by more than one tool, agents connected with a person’s credentials, and accounts with admin rights that nobody signs into interactively.
- Give each agent its own identity. Use Entra Agent ID or a dedicated app registration in Microsoft 365, and a dedicated agent or service account in Google Workspace.
- Assign a sponsor. A named person, not a team, who still works for the business.
- Scope it. Only the mail, sites, drives and systems the job needs. Read access unless write is essential.
- Watch how it signs in. Keys and tokens should be used from the places and at the times you expect.
- Make it revocable. Know exactly how to stop it, and check that stopping it doesn’t break anything else.
- Review every 90 days, and whenever the sponsor changes role or leaves.
Checklist: does every agent have a proper identity?
- No AI agent runs on a person’s own account.
- No two agents or tools share one service account.
- No agent holds admin rights its job doesn’t need.
- Every agent has a named sponsor who still works here.
- Every agent’s keys and tokens are owned and rotated.
- Every agent can be stopped in one step.
- Agents are part of offboarding for their sponsor.
- Every agent is reviewed at least every 90 days.
Agent identity is one part of SaaS posture. Read what is SSPM for how agents change the way SaaS settings and connected apps need watching.
How Centeye helps
Centeye Synthwatch gives every AI agent an identity, an owner and an off switch. Today it lists the agents and AI apps holding access to Microsoft 365 and Google Workspace, flags agents with no identity of their own (such as those running on a shared or admin account), names a sponsor with a 90-day re-approval, and shows the narrower access each agent’s job needs. It can lock a service principal, reset an API token or revoke a grant at the setting you choose.
Synthagent, the guard agent inside Synthwatch, watches each agent’s identity, authentication, grants and connections continuously. If Centeye Gatewatch finds a sponsor’s account has been taken over, every agent that person owns is reviewed in the same case.
Reading Microsoft Entra Agent ID and Google’s agent identities directly is coming. Synthwatch and Synthagent are in early access.
Frequently asked questions
What is AI agent identity?
The account an AI agent uses to sign in and act. A good agent identity is the agent’s own, has a human sponsor, holds only the access the job needs, and can be revoked in one step.
What is Microsoft Entra Agent ID?
Microsoft’s identity type for AI agents in Microsoft Entra ID. Microsoft says new Copilot Studio agents get one automatically since May 2026, with the creator recorded as sponsor.
Is an agent a non-human identity?
Yes. AI agents are one kind of non-human identity, alongside service accounts, app registrations and API keys. See non-human identity in our glossary.
Can an agent use MFA?
Not in the way people do. Agents prove who they are with certificates, tokens or managed identities. That’s why their keys need owners, rotation and monitoring instead.
Where should we start?
Find any account with admin rights that’s used by tools rather than people. That’s usually where the riskiest agents are hiding.
New to the terms? See AI agent, non-human identity and OAuth grant in our glossary. Want to see which agents in your tenant lack their own identity? Ask for early access.
Microsoft Entra Agent ID and Copilot Studio agent identities as described on Microsoft Learn; Google coworker agents and Agent Identity as described by Google, October 2026. The worked example is illustrative. Synthwatch and Synthagent are in early access.