Entra Agent ID + Agent 365 governance platform

Goal

Stand up a full Microsoft-native governance plane for a mixed fleet of agents (Copilot Studio + LangChain + AWS Bedrock + n8n) inside a single Entra tenant. Demonstrate to a hypothetical enterprise buyer (bank / telco / public-sector) that every agent — regardless of origin — is identified, permissioned, policy-controlled, risk-monitored, and governed under one control plane. Deliver a public repo (secrets scrubbed), demo video, and a 3-slide architecture pitch.

Complements Project 5 (which uses the vendor-neutral open-source stack). Read both if you're targeting enterprise architect / agent-security-engineer roles at M365-heavy customers.

Stack

• Tenant: Microsoft Entra ID tenant + Microsoft Agent 365 licence (E7 trial is fine).
• Identity foundation: Microsoft Entra Agent ID — 3 blueprints, ~15 agent identities, 2 agent user accounts.
• Governance: Access packages, Lifecycle Workflows, custom security attributes, sponsors.
• Policy: Conditional Access (blueprint-scoped + attribute-driven), ID Protection with auto-block.
• Observability: Agent 365 SDK (Python + Node), OpenTelemetry → Azure Monitor + Splunk.
• Tool governance: Agent 365 SDK ToolCatalog + 2 MCP servers registered to the tenant.
• Network: Global Secure Access for the Copilot Studio agent, allow-list of approved egress domains.
• Multi-platform agents:
  • Copilot Studio agent — with auto Agent ID assignment.
  • LangChain agent in Azure Container Apps — sidecar pattern.
  • AWS Bedrock Claude agent in ECS Fargate — sidecar + FIC to AWS STS.
  • n8n workflow in a separate Container Apps env — community node.
• Third-party federation: FIC to AWS STS for Bedrock; FIC to GitHub Actions OIDC for CI/CD.
• Sponsors + owners: 3 sponsors (business owners), 2 owners (technical), all with manager populated.
• CI/CD: GitHub Actions (OIDC federation to Entra, no static secrets); Bicep / Terraform for infra.

Reference architecture

                    ┌──────────────────────────────────────┐
                    │         M365 Admin Center            │
                    │  Agent Registry / At Risk / Shadow   │
                    └─────────────────┬────────────────────┘
                                      │
                                      ▼
┌──────────────────────────────────────────────────────────────────┐
│                    Microsoft Agent 365 (control plane)           │
│  Access packages · Lifecycle workflows · Notifications · MCP     │
│  catalogue · OTel spans → Azure Monitor → Splunk                 │
└─────────┬───────────────────┬────────────────────┬────────────────┘
          │                   │                    │
          ▼                   ▼                    ▼
┌─────────────────┐  ┌───────────────────┐  ┌──────────────────────┐
│  Microsoft      │  │  Microsoft        │  │  Microsoft Purview   │
│  Entra          │  │  Defender / GSA   │  │  DLP + audit         │
│  Agent ID       │  │  network + threat │  │  labels + evidence   │
│  (3 blueprints, │  │  policies         │  │                      │
│   15 identities,│  └───────────────────┘  └──────────────────────┘
│   Conditional   │
│   Access,       │
│   ID Protection)│
└──┬──────────┬───┘
   │ FIC      │ FIC
   │          │
   ▼          ▼
Azure MI    AWS STS    GitHub OIDC    SPIRE (optional Part D)
   │          │            │
   ▼          ▼            ▼
┌───────────────┐  ┌──────────────────┐  ┌───────────────────┐  ┌──────────────┐
│ Copilot       │  │ LangChain agent  │  │ Bedrock Claude    │  │ n8n workflow │
│ Studio agent  │  │ ACA + sidecar    │  │ ECS + sidecar     │  │ ACA + node   │
│ (auto Agent ID│  │                  │  │                   │  │              │
│  assignment)  │  │ ← MCP catalog →  │  │ ← MCP catalog →   │  │ ← MCP → …   │
└───────────────┘  └──────────────────┘  └───────────────────┘  └──────────────┘

Every agent hits at least one MCP server + one Microsoft Graph endpoint. Every hop is instrumented.

Build plan (12 days)

Days 1-2 — Foundation

1. Provision an Entra tenant with Agent 365 trial (E7 or E5 + Agent 365 + Entra Suite).
2. Bicep / Terraform: two Azure Container Apps environments (aca-agents-dev, aca-agents-prod), a user-assigned managed identity per environment, an Azure Monitor workspace, a Log Analytics workspace, an Application Insights instance.
3. GitHub repo with OIDC FIC into Entra (no AZURE_CLIENT_SECRET).

Days 3-4 — Blueprints + identities

4. Create three blueprints via Agent 365 CLI: crm-helpdesk, momo-fraud-triage, onbill-billrun.
5. Wire FIC on each blueprint → the corresponding environment's managed identity.
6. Create 3-5 agent identities per blueprint (dev / staging / prod × business unit). Populate sponsors + owners + custom security attributes.
7. Create an agent user account for the momo-fraud-triage prod identity; assign Teams Enterprise licence; wait for mailbox.

Days 5-6 — Policy + risk

8. Custom security attribute set AgentGovernance with 5 keys (Env, BU, DataSensitivity, RiskTier, PurposeArea).
9. CA policies: block high-risk agents (from template), require named-location for prod, MFA-exclude for agent user accounts.
10. ID Protection: enable, deploy the CA "block high risk" template, forward RiskyAgents + AgentRiskDetection to Log Analytics → Splunk.
11. Trigger some synthetic risk (Lesson 10.6 lab) and verify SIEM alerts + auto-block work.

Days 7-8 — Third-party integration

12. Deploy the LangChain agent to ACA-prod with the sidecar. Verify autonomous + OBO tokens.
13. Deploy the Bedrock agent to ECS Fargate with sidecar; configure FIC to AWS STS (WIF pattern for Part D bonus).
14. Deploy n8n to ACA-dev with the community node.
15. Deploy the Copilot Studio agent; enable auto Agent ID assignment tenant-wide.

Days 9-10 — Governance + registry

16. Access packages for the two most sensitive agents: momo-fraud-triage (financial data) and onbill-billrun (write to BSS).
17. Lifecycle Workflows: sponsor auto-transfer to manager, 60/30/15 day notifications.
18. Access review every 6 months for all agents.
19. Register any third-party agents that don't auto-register in the M365 admin center registry.
20. Run the "shadow agents" detection query; ensure none exist.

Days 11-12 — Observability, GSA, hardening

21. Add Agent 365 SDK to LangChain and Bedrock agents (runtime + observability-core + framework extensions). Export OTel to Azure Monitor + Splunk.
22. Register 2 MCP servers to the tenant catalogue (a mock Mail search + a mock ticket create). Wire via ToolCatalog.for_agent().
23. Enable GSA traffic forwarding for the Copilot Studio environment. Allow-list approved domains; block social + consumer storage.
24. Red-team exercise: try a prompt-injection asking the LangChain agent to hit an unregistered MCP server. Verify hard-refuse. Try to trigger earlyLifeMaliciousActivity.
25. Threat model + agent cards for all agents. Governance report exported from admin registry.

Acceptance criteria

• All 4 platform agents visible in the M365 admin center registry.
• "Unmanaged agents" and "Agents without owners" both = 0.
• Every agent identity has: sponsor with manager, owner, 5 custom attributes, an access package (where applicable).
• CA policies enforce location + block-on-high-risk.
• Triggering Confirm Compromise in ID Protection blocks the agent within 5 minutes end-to-end.
• Splunk / Sentinel dashboard shows agent activity by identity, blueprint, risk state.
• OTel spans reach Azure Monitor + Splunk with agent identity + blueprint attributes.
• Attempted MCP call to unregistered server is refused by ToolCatalog.
• GSA blocks Copilot Studio agent's egress to a disallowed domain.
• Sponsor departure triggers auto-transfer + review workflow.
• CI/CD deploys new agent identities without any static Azure secret in the repo.
• Recorded 5-minute demo video walking through: create agent → policy applied → risk fired → CA blocks → remediation → access package renewed → agent decommissioned.

Stretch goals

• SPIRE integration — enable SPIRE OIDC discovery, add an FIC on a blueprint trusting your SPIFFE trust domain; verify a SPIRE-issued JWT-SVID can be exchanged at Entra.
• Second tenant + multitenant blueprint — publish crm-helpdesk as a multitenant blueprint; add it to a partner tenant; verify agent creation + policy inheritance works cross-tenant.
• Purview DLP integration — apply a sensitivity label to a SharePoint site; verify the Copilot Studio agent's access is blocked when it violates a DLP rule; log the block into your SIEM.
• Defender for Cloud Apps — configure a real-time policy that alerts on unusual agent-token usage patterns; wire to Sentinel.
• Cost attribution — use OTel agent.identity_oid on every span to build a Grafana panel showing LLM cost by agent per week.
• Kill-switch runbook — a single button (or POST /admin/kill-agent) that: confirms compromise in ID Protection, revokes all sessions, disables the identity, notifies sponsor + owner, opens a Sentinel incident.

Deliverables

• Public GitHub repo: iam-for-agents-project-6-entra-agent365/ with the full Bicep / Terraform / SDK code (secrets scrubbed).
• README.md, ARCHITECTURE.md, THREAT_MODEL.md, AGENT_CARDS/ (one per agent), RUNBOOK.md.
• 5-minute demo video (YouTube / Loom).
• Slide deck (3-5 slides) suitable for pitching to an enterprise architecture review board.
• Interview talking points — how you designed the object model, why FIC over secrets, how CA + ID Protection interlock, how the sidecar keeps third-party agents governable, how you scale governance from 15 to 1500 agents.

Notes

• License trials matter. Microsoft's Agent 365 trial has time limits. Plan the 12 days around it.
• Diagnostic settings + Log Analytics workspace need to exist before you flip ID Protection on, or you'll lose the first days of detection data.
• Copilot Studio auto Agent ID assignment is preview at time of writing — verify it's still on in your tenant.
• Do not put real MTN / customer data in this lab. Use contoso.com-style test fixtures.
• Sponsor discipline matters even in a lab. Assign a real (test) user with manager populated; the workflows only fire if the graph is populated correctly.