Design security operations, identity, and compliance capabilities · Topic 5 of 7
Agent Identities, Secrets and AD DS Hardening
SC-100 identity: Microsoft Entra Agent ID for AI agents, secrets and keys with Key Vault and Managed HSM, and hardening Active Directory.
- 6 min
- Entra Agent ID: agent identities, blueprints, agent users and sponsors, with autonomous or delegated access.
- Never share credentials between agents. Use least privilege and review agents.
- Key Vault stores secrets, keys and certificates. Managed HSM is for the highest assurance keys. Use RBAC, soft delete and purge protection.
What it is
Three identity problems sit beside the main Entra design. AI agents are a new kind of actor that needs its own identity. Secrets, keys and certificates are the credentials applications use and must be stored and rotated safely. Active Directory Domain Services (AD DS) is old but still central in many organizations, and attackers target it first.
How it works
Agent identities with Microsoft Entra Agent ID
AI agents act on their own: they decide, call tools and access data, sometimes created and destroyed thousands of times a day. Treating them as users or as ordinary application identities does not fit. Microsoft Entra Agent ID provides agent identities, special identity accounts in Entra ID for AI agents, so they can authenticate and be governed.
| Concept | Meaning |
|---|---|
| Agent identity | The identity an agent uses to get tokens and access resources, distinct from workforce, customer and ordinary workload identities, so agent activity is identifiable in logs |
| Agent identity blueprint | A template from which many agent identities are created and managed consistently |
| Agent user | A special Entra user account paired one to one with an agent identity, for cases where the agent must appear as a user (for example to own a mailbox or Teams presence) |
| Sponsor | The accountable human recorded for an agent, such as the person who created it |
What you can do with them: grant autonomous access (rights assigned to the agent identity, such as Microsoft Graph permissions or Azure RBAC roles), delegated access (acting on behalf of a user within that user's rights), and authenticate incoming requests to the agent. Agent identities are subject to Conditional Access policies built for agents, can be given only the access they need, and are prevented from reaching the most sensitive roles. Extending the wider Entra security features to agents is part of Microsoft Agent 365.
Design guidance:
- Give every agent its own identity, never a shared account or a person's credentials.
- Apply least privilege, and prefer delegated access when the agent should only do what the user may do.
- Record a sponsor for accountability and review agents regularly so abandoned ones are retired.
- Log and monitor agent sign ins and actions, which are recorded as agent activity.
- Combine with data controls: sensitivity labels and DLP limit what an agent can read or share.
Secrets, keys and certificates
| Principle | Practice |
|---|---|
| Avoid secrets where possible | Use managed identities and workload identity federation instead of passwords or keys |
| Central, protected storage | Azure Key Vault for secrets, keys and certificates |
| Strong key protection | Premium vaults use HSM backed keys. Azure Key Vault Managed HSM is a single tenant HSM service validated to FIPS 140 level 3 for the most sensitive keys, with customer controlled security domain |
| Access control | Azure RBAC (recommended) with roles such as Key Vault Secrets User, Crypto User, Certificates Officer. Separate people who manage the vault from the apps that use it |
| Protect against deletion | Soft delete and purge protection |
| Network | Firewall, private endpoints, disable public access |
| Rotation | Expiration dates, automatic rotation for keys and supported secrets, certificate auto renewal with integrated certificate authorities, Event Grid notifications near expiry |
| Monitoring | Diagnostic logs to Log Analytics, and Defender for Key Vault alerts for unusual access |
| Separation | One vault per application, environment and region to limit blast radius |
For customer managed keys, services such as Storage, SQL and disk encryption can use keys held in Key Vault or Managed HSM. For certificates, keep the life cycle automated so that expiry does not cause outages, and use short lived certificates where you can.
Hardening Active Directory Domain Services
AD DS holds the keys to the kingdom in many organizations. An attacker who controls a domain controller or a domain administrator controls everything joined to it.
| Measure | Why |
|---|---|
| Enterprise access model and tiering | Administrators of domain controllers and identity systems never sign in to lower trust machines, so their credentials are not exposed |
| Reduce privileged membership | Few Domain, Enterprise and Schema Admins, no standing use, Protected Users group |
| Microsoft Defender for Identity | Sensors on domain controllers detect attacks such as Kerberoasting, DCSync, pass the hash and golden ticket, and report identity security posture assessments (weak configuration, unsafe delegation, exposed accounts) and lateral movement paths |
| Protocol hardening | Require LDAP signing and channel binding, disable NTLM and SMBv1 where possible, enforce Kerberos with strong encryption |
| Windows LAPS | Unique, rotated local administrator passwords on every machine |
| Managed service accounts | gMSA instead of static service account passwords |
| Protect the KRBTGT account | Reset its password (twice) after suspected compromise |
| Domain controller security | Dedicated, patched, minimal servers, limited network access, secure boot, and backups with tested forest recovery |
| Reduce attack paths | Review delegation, ACLs and certificate templates, and fix risky Active Directory Certificate Services configuration |
| Hybrid protections | Protect the Entra Connect server as a tier zero asset, and avoid syncing privileged on premises accounts to the cloud |
A worked scenario
A company lets business users build AI agents. The architect requires that each agent has an agent identity with a recorded sponsor, limits agents to delegated access with only the Graph permissions they need, applies agent targeted Conditional Access, and reviews agents quarterly. Their credentials for databases move into Key Vault, with managed identities reading them. For the AD DS estate, they deploy Defender for Identity on all domain controllers, remove legacy NTLM where possible, and apply LAPS.
What to remember for the exam
- Entra Agent ID: agent identities, blueprints, agent users and sponsors, with autonomous or delegated access.
- Never share credentials between agents. Use least privilege and review agents.
- Key Vault stores secrets, keys and certificates. Managed HSM is for the highest assurance keys. Use RBAC, soft delete and purge protection.
- Rotation and certificate auto renewal prevent outages.
- Defender for Identity detects Kerberoasting, DCSync, pass the hash and golden ticket. Windows LAPS rotates local admin passwords.
"Detect Kerberoasting or DCSync against domain controllers" points to Defender for Identity.
How the exam asks about this
- "Identify actions performed by an AI agent in the logs." An agent identity, so actions are recorded as agent activity.
- "Which key store gives dedicated HSM protection with customer controlled security domain?" Azure Key Vault Managed HSM.
- "Rotate local administrator passwords for domain joined servers." Windows LAPS.
- "Protect against Active Directory credential theft from a compromised member server." Tiered administration, Protected Users and Defender for Identity.
Common mistakes
Running agents under a person's account. You cannot tell who acted.
Leaving purge protection off. A deleted key may be unrecoverable.
Domain admins signing in everywhere. Their credentials end up on many machines.
Forgetting the sync server. Entra Connect is a tier zero asset.
Check yourself
What does an agent user pair with in Microsoft Entra Agent ID?
One agent identity, in a one to one relationship.
Which Key Vault feature prevents a deleted vault or key from being permanently removed too early?
Purge protection, together with soft delete.
Which product detects DCSync and Kerberoasting?
Microsoft Defender for Identity.
Topic 5 of 7 in Design security operations, identity, and compliance capabilities
Test yourself on Design security operations, identity, and compliance capabilities
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.