Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Microsoft Entra Agent ID Keep Credentials Away From Agents?
No, because Microsoft's identity pages describe who may reset or restore a credential and how Purview classifies and audits agent data, not what the agent holds once it signs in. Ask what token the agent carries, which applications accept it, and what its model receives on each screen.
For an accounts-payable team, an agent that signs in with an Entra identity is admitted to the application and then reads the page it was admitted to. The identity decides that the run may happen, not what it carries away. That split is the question behind Entra Agent ID for a team putting an agent on a payment screen: the directory can prove which agent acted, and the page still draws the account number, the invoice amount and the approver's name in front of the model. The Microsoft documentation reviewed covers two ends: the administrator who resets or restores a credential, and the Purview controls that classify and audit agent data. Neither end describes a control that keeps the credential the agent uses out of its reach, or that keeps the values on the screen out of what its model reads. The record is one agent with an Entra token working a vendor invoice in an accounts-payable platform. What Can Microsoft Copilot Studio Agents See? sets out the screen side, and What Is Least Exposure? explains why an identity control answers a different question from exposure.
Key findings
- For Microsoft Entra Agent ID to keep a credential away from the agent, the token the agent presents would have to be scoped to the one approved action, and the page it reads would carry consistent tokens before any model reads the screen (What Is Least Exposure?).
- It would also require a named person approving each payment and a record of what the model received, which the directory does not produce (RedactSure vs Microsoft Entra Agent ID: 2026 Comparison & Alternative).
- The gap is in the documentation: Purview's page for Copilot Studio agents lists the capabilities it supports and does not document agent credential handling (Microsoft, Purview, 2026).
- A password reset is an administrative act under a role, and the value is handed over: "Copy the password and give it to the user" and "The temporary password never expires" (Microsoft, Reset, 2026).
- A deleted identity waits 30 days in a suspended state, restorable with all its properties, and then "the permanent deletion process automatically starts and can't be stopped" (Microsoft, Restore, 2026).
- Microsoft's managed identity page states that "This token acquisition doesn't require any secrets and is automatically authenticated based on the environment where the code runs," which removes a stored password and leaves the environment that requests the token (Microsoft, Managed identities, 2026).
What does an Entra identity decide before the agent reads a screen?
Entra Agent ID is an identity object in the directory, and the Microsoft pages reviewed for it are about lifecycle: which agent it belongs to, what it may reach and who manages it. A how-to on restricting an agent to one workflow records the starting point: agent identities can be governed through their identity and access lifecycle, and a new identity starts with limited permissions (How Do You Restrict an AI Agent to One Workflow With Microsoft Entra, ServiceNow AI Passport or SailPoint?).
Microsoft's Copilot Studio material is explicit about the boundary: "It doesn't stop the model from opening them," even though access control "only prevents the model from taking actions on websites or applications that aren't in the allow list" (Does Copilot Studio Limit What Its Agent Sees?). The allowlist narrows where the agent may act; the page still renders in full.
The record is a vendor invoice in an accounts-payable platform the organization bought. The agent holds an Entra identity, signs in, and the platform draws the invoice for the queue it is assigned. The model receives the page, including the vendor's bank account and the approver's name. Nothing in the identity's lifecycle decides which fields the model is shown.
What does the agent receive after it signs in?
Microsoft's managed identity page describes the design Microsoft applies to a workload identity: "Managed identities eliminate the need for developers to manage these credentials," and "This token acquisition doesn't require any secrets and is automatically authenticated based on the environment where the code runs" (Microsoft, Managed identities, 2026). The stored password leaves the code. What remains is a token acquired by the environment, and the page does not describe a run in which the agent acts without one. Identity is not the same control: of 86 AI security and data protection products reviewed, 58 control where data can go, and 1 describes masking what an agent reads on the web pages it works in (How Many AI Security Products Control What an AI Agent Sees?).
A deleted identity stays in a suspended state for 30 days and can be restored with all its properties, after which "the permanent deletion process automatically starts and can't be stopped" (Microsoft, Restore, 2026). The lifecycle is managed; the token is still issued.
What the token opens matters more. A session credential can expire, and a value read off a page does not: AWS's AssumeRole documentation returns temporary credentials whose session "can range from 900 seconds (15 minutes) up to the maximum session duration set for the role," while a key displayed on a console page stays valid until someone rotates it (What Can a Browser Agent See in My AWS Console?). Then the page renders, and a screenshot-driven agent "may inadvertently expose sensitive information such as identities, accounts, locations, and behavioral traces" (Wang et al., 2026).
What do the vendors themselves say?
Microsoft's pages on credential administration are written for an administrator, not for an agent. A reset needs at least the Password Administrator role, the directory autogenerates a temporary password, and the procedure tells the administrator to "Copy the password and give it to the user" (Microsoft, Reset, 2026). "The temporary password never expires," so a credential issued for one task stays valid until someone changes it (Microsoft, Reset, 2026).
Purview's agent page is about data, not custody. It lists what it supports for Copilot Studio agents: data security posture management, classification, labels, data loss prevention, auditing and retention (Microsoft, Purview, 2026). Coverage carries stated limits: "Encryption is supported only with sensitivity labels, and only for the SharePoint knowledge source," endpoint data loss prevention applies to agents in Teams, SharePoint and Microsoft 365 Copilot when the knowledge source is SharePoint, and agents published to non-Microsoft channels need pay-as-you-go billing (Microsoft, Purview, 2026). The page does not document agent credential handling.
Copilot Studio's governance page adds the control plane: "Data policies control agent knowledge sources, actions, connectors and skills," and admins have full visibility into maker audit logs in Purview (Microsoft, Security and governance, 2026). Approval is documented for agent flows: "Manual stages in your multistage approval let you request approval decisions from different human stakeholders at various stages of the process" (Microsoft, Multistage, 2026). Arcade's blog describes the other route, one vendor holding the credential and making the call: "Arcade holds the credential, makes the call, and returns only the result" (Arcade, 2026).
| Dimension | Microsoft, per its documentation | What a buyer should verify |
|---|---|---|
| Identity | An object governed through its access lifecycle, with limited permissions when created | One identity per task, or one shared |
| Credential issue | A password reset under an administrator role, handed to a person | Who can reset it, and whether the value expires |
| Token | Acquired by the environment without a stored password | Its lifetime, and the applications that accept it |
| Data coverage | Classification, labels, audit and retention for Copilot Studio agents, with limits | Whether the bought application is inside it |
Which record shows what the model read on the page?
Microsoft's record is an audit trail. Copilot Studio's governance page states that admins have full visibility into maker audit logs in Purview, and Purview's agent page lists auditing among the capabilities it supports (Microsoft, Security and governance, 2026; Microsoft, Purview, 2026). Those records answer who built or changed an agent and which interactions were audited. They do not answer what the model received when the invoice rendered.
The regulator's concern has the same shape. FINRA's 2026 oversight report makes the point in its own words: "AI agents acting autonomously without human validation and approval," agents that "may act beyond the user's actual or intended scope and authority," and "Complicated, multi-step agent reasoning tasks can make outcomes difficult to trace or explain, complicating auditability" (FINRA, 2025).
EchoLeak shows why the difference matters. The zero-click injection tracked as CVE-2025-32711 in Copilot used a client that "automatically fetches the external image URL included by the attacker," with an allowed Teams endpoint used to get past the content security policy (Reddy and Gujral, 2025). The action record shows a fetch; the exposure is whatever the model held when the fetch left. An agent working from placeholders gives that fetch nothing to carry (What Can a Hijacked Agent Leak If It Only Has Placeholders?).
What does a governed environment change?
A governed environment changes what the model is given before it acts. Values on the rendered page are replaced with consistent tokens before any model reads the screen, so the invoice the agent opens carries ACCT_001 where the bank account sits and INV_001 where the invoice number sits, for the whole run. The real values resolve only at the approved destination, at the moment of an approved action, so a value the model never saw cannot be repeated from its context.
The same environment puts a named person in front of every consequential step. A payment, a submission or a record change waits for that person's approval, and the approval carries a name rather than a policy exception. Every screen the agent saw, every action and every approval lands in an exported record the customer keeps and can query.
The scope is the rendered page the agent works in. The control does not reach the terminal, the IDE, the local filesystem, direct API calls or MCP. Microsoft's identity control and this one answer different questions: the directory says which agent may act, and the rendered page says what the model reads while it acts. The comparison page for this vendor sets the two side by side (RedactSure vs Microsoft Entra Agent ID: 2026 Comparison & Alternative).
What the record shows
A token scoped to one action, a page rendered with consistent tokens before any model reads it, a named approver and an exported record are the four parts an accounts-payable team needs before it trusts an agent with an invoice. Microsoft's pages supply the directory half: an identity an administrator governs, a password reset that hands the value to a person, a 30-day restore window, and Purview controls that classify and audit the data an agent touches. They do not supply the other half, and no page reviewed describes what the model received on the invoice the agent opened. The test fits on one screen. The team should take an invoice an agent works today, write down every value the platform draws on it, then ask which of those values the agent's token can reach and which the model was shown; where the lists overlap, the directory is not the control that covers it.
Methodology and limitations
This page rests on Microsoft Learn documentation for Purview, Copilot Studio governance, Entra password reset and restore, managed identities, and multistage approvals, plus a vendor blog, two research papers and a regulator's report. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 20, 2026 and October 22, 2026, and each Sources line carries the date for its page.
None of the products on this page was tested for it, and "not described" means the pages reviewed rather than a claim about what a product does. Vendor features change, and the page carries its date. The example describes a record type, not an organization. RedactSure is deploying now with enterprise and government customers. Determinations about a deployment belong to the organization's counsel, its assessors and its own security officers, and nothing replaces a pilot of one workflow on its own screens.
Frequently asked questions
Does Microsoft Entra Agent ID keep credentials away from an agent?
No. Microsoft's pages describe the directory side: who may reset a password, how a deleted identity is restored, and how Purview classifies agent data. They do not document agent credential handling, and no page reviewed describes a run in which the agent acts without a token it can present. The directory decides who may act, and what the agent holds after sign-in is left open.
What does the agent receive after it signs in?
A token the environment acquires, and then the page it opens. Microsoft's managed identity page says token acquisition "doesn't require any secrets and is automatically authenticated based on the environment where the code runs," which removes a stored password from the code and leaves the token in the run. The page does not describe withholding that token from the process that requested it. Whatever the application renders next reaches the model, including the invoice values on the page.
Does Purview read the credential an agent uses?
Not from the pages reviewed. Purview's agent page lists data-security capabilities for Copilot Studio agents, including classification, labels, data loss prevention, auditing and retention, and states that encryption is supported only with sensitivity labels and only for the SharePoint knowledge source. It does not document agent credential handling. Credential custody sits in the identity design and in what the agent presents on each call.
What record shows what the model read on a screen?
Not the audit log alone. Copilot Studio's governance page says admins have full visibility into maker audit logs in Purview, and that record answers who built or changed an agent. It does not capture the page the model was shown. An auditor asking what the agent knew needs the screen, the action and the approver together, exported to the customer's monitoring.
Who approves a payment an agent prepares?
A named person, if the workflow is designed that way. Microsoft documents manual stages in multistage approvals that request decisions from different human stakeholders, which routes approval to people for agent flows. The directory does not approve a payment; it decides whether the agent may act. The gap is between the flow's approval stage and the destination that releases the money to the vendor.
Can an identity control and a render-layer control work together?
Yes. The directory decides which agent may act, and a render-layer control decides which values its model reads while it acts, so one does not replace the other. RedactSure is built as the second control. A team running agents in bought applications usually needs both. The proof is whether one invoice produces a record of what the model saw and a name against the payment.
How RedactSure Keeps the Invoice Values Out of the Agent's Context
An identity tells the platform which agent signed in, and it stops there while the invoice values sit on the screen for that agent's model to read. The Purview page reviewed does not document agent credential handling.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before the run, the invoice drew the bank account and the approver's name, and the model received both. Inside the governed environment the page renders with ACCT_001 and INV_001 before any model reads it, the real bank details resolve only at the payment destination a named person approves, and the screen, action and approval are recorded in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
One invoice an agent works today can show whether its identity answers the question you are asking. Bring that invoice and see, with test values, what the model reads, who approves the release, and what the record holds. Book a demo