Question

A financial services company is deploying autonomous AI agents built on Azure that call internal APIs and Microsoft Graph on behalf of business workflows. The security architect must design a way to detect anomalous or compromised agent behavior—such as an agent suddenly requesting scopes far beyond its normal pattern or accessing resources at abnormal times—and feed high-fidelity signals into the SOC's Microsoft Sentinel workspace for correlation with human-identity incidents. Which design approach best meets these requirements?

Accepted Answer

Assign each agent a distinct Entra workload identity, enable Microsoft Entra Workload Identities Premium with risk detections and Conditional Access for workload identities, and ingest the identity risk and sign-in logs into Sentinel for correlation.

Answer

Share a single high-privilege service principal across all agents and rely on Azure Activity logs alone to detect abnormal resource access.

Answer

Embed long-lived client secrets in each agent's configuration and rotate them manually every 90 days, monitoring only Key Vault access logs in Sentinel.

Answer

Grant the agents user accounts with Conditional Access and MFA, then use Entra ID Protection user risk policies to detect anomalies.