Quick answer
Microsoft’s least-privilege pattern treats every AI agent as a first-class principal: a unique identity, named human owner, explicit purpose, task-scoped roles, approved tools, end-to-end audit trail, and fast revocation path.
Keep identity stable enough to govern its lifecycle. Make elevated access temporary through just-in-time entitlements, short-lived tokens, or per-action approval. Recheck authorization at every hop; an orchestrator’s decision must not silently grant access in a downstream system.
Six enforceable boundaries
| Boundary | Required decision |
|---|---|
| Identity | Which unique principal acted, and who owns it? |
| Resource | Which tenant, subscription, workspace, site, or collection? |
| Data | Which labels, sensitivity levels, records, and export paths? |
| Operation | Read, draft, create, update, export, delete, or administer? |
| Tool | Which approved action and parameters may the agent invoke? |
| Time | How long does the entitlement or approval remain valid? |
Review the combination, not only individual roles. Several narrow permissions can chain into broad effective access. Inventory the complete path from orchestrator to tool and downstream system, including cross-tenant, guest, plugin, and integration paths.
Separate read, write, and remediation
A summarization agent normally needs a read-only role bounded to approved repositories. A ticket agent can use a separate write role limited to creating or updating tickets, with delete and administrative operations blocked. A remediation agent should receive narrowly scoped, time-limited elevation, step-up approval for destructive actions, and a tested rollback.
Allowlist tool actions and validate model-controlled parameters as untrusted input. Deny unreviewed tools by default. Do not let a prompt, retrieved page, plugin description, or agent-generated plan expand resource scope, select a new credential, or skip an approval.
Prove audit and containment
Logs should identify agent identity, role, effective scope, resource, tool, action, timestamp, correlation ID, and the user on whose behalf it acted where applicable. Correlate the chain across orchestrator, tool, and downstream service rather than logging only the chat response.
Test disabling the identity, invalidating active tokens, rotating credentials, removing stale permissions, stopping high-impact actions, and performing compensating rollback. Re-review access when the workflow, tools, data, environment, or owner changes materially.
Use the Assessment and Workshop guide to place these controls in a roadmap and the memory-safety guide to protect persistent context.
Frequently asked questions
Should an AI agent use a shared service account?
Microsoft recommends a unique, lifecycle-managed agent identity with a named owner rather than shared credentials that obscure accountability and slow revocation.
What should be time limited for an AI agent?
Keep the agent identity stable for lifecycle management while making elevated entitlements, tokens, or approvals temporary and scoped to a specific workflow.
Is an orchestrator authorization check sufficient?
No. Tools and downstream services should revalidate identity, role, and scope on every call instead of implicitly trusting the orchestrator.
Official sources
- Microsoft Learn: Least privilege for AI agents
- Microsoft Security: Identity, access, and tool binding
Source check: August 12, 2026. Adapt controls to the actual identity platform, architecture, risks, licensing, and organizational requirements.