The AI now has its own access badge. Who decides which doors it opens?

When a new employee starts, they get an access badge. Not the master key. A badge that opens the front door, the office and maybe the stockroom, and that stops working the day they leave.

AI agents are now getting the same.

Since May 2026, Microsoft has given new agents built in Copilot Studio their own identity in Entra, the same directory that keeps track of your employees. The agent no longer signs in as the person who built it. It has its own badge.

And there will be a lot of badges. When Microsoft launched Agent 365 in March, a control panel for agents, the company wrote that tens of millions of agents had appeared in its registry after two months of preview. October brought a new round of launches from several of the big vendors: agents that work on their own over time, buy supplies, book meetings and answer customers.

It is easy to read this as news for large enterprises. It is not. An SMB with 30 employees on Microsoft 365 has exactly the same directory, the same settings and the same question in front of it: who decides what the agent is allowed to open?

Four decisions that are yours, not your IT provider's

1. Who is responsible?

Microsoft automatically adds the person who builds the agent as a "sponsor" on its identity. That is a good starting point, but it is not a decision.

Say someone in finance builds an agent and leaves next spring. The agent is still there. Decide who takes over responsibility, the way you would with a power of attorney at the bank.

2. What may it do?

This is the detail that matters most. When an agent is published, its identity gets permissions that match the connectors it uses, for example to calendar or email. Whoever builds the agent can grant access to the whole connector, or only to the individual actions the agent actually needs.

The whole connector is the fastest to set up. It is also the master key.

An agent that suggests meeting times does not need to be able to delete meetings. Ask for individual actions, and ask to see the list.

3. Where do the rules actually apply?

Many companies have sign-in rules: only from approved PCs, only from Norway, only with two-factor. Microsoft calls this Conditional Access, and it can now be applied to the agent's identity as well.

But today it is only enforced when the agent runs in Teams. When it runs anywhere else, you can see the permissions, but the rule does not kick in.

That is not a flaw in itself. It is a boundary you need to know before you assume the agent follows the same rules as your staff.

4. When should the badge stop working?

Delete the agent and its identity is removed. Fine. The problem is the agents nobody deletes: the test agent from a workshop, the one that drafted invoices for a project that finished long ago.

Set aside half an hour each quarter to go through the list in Entra, the same way you review who has a key to the office.

This is not about technology

None of this requires a new licence or a new tool. It requires what a good managing director has always done with keys and authorisations: someone owns them, they open as little as possible, and they get collected again.

The difference is the pace. A new hire gets one badge. An eager colleague with Copilot Studio can build five agents before lunch.

(That is a good sign, by the way. It means someone is actually using the tools you already pay for.)

So my advice is simple: treat the agent like a new hire. Give it a badge, not the master key. And write down who is responsible for it before it starts, not after something has gone wrong.