AI agents are increasingly present in Microsoft Entra tenants, and new ones keep becoming available whether or not you have explicitly approved them. Rather than accepting every agent by default, the safest first move is to block those that Entra evaluates as high risk. You do this with a Conditional Access policy scoped to agent identities instead of user accounts.
In this tutorial you will build a policy in Entra ID > Conditional Access > Policies that targets all agent identities (Preview), applies to all resources, and uses the Agent risk (Preview) condition set to High with a Block access grant control. You can enable the policy immediately or run it in Report-only mode first to observe its impact before enforcement. Several features referenced here are in Preview, so verify availability in your own tenant.
Before you start
What you will learn
- You will learn how to create a Conditional Access policy in Microsoft Entra that blocks access for AI agent identities evaluated as high risk.
- AI agents can appear in your tenant and act against your resources without administrators being aware, so proactively blocking high-risk ones reduces exposure before it becomes an incident. A single Conditional Access policy gives you a repeatable, tenant-wide control.
Requirements
- You need administrative access to the Microsoft Entra admin center with permission to create and manage Conditional Access policies for your tenant. The Agents (Preview) and Agent risk (Preview) options must be available in your tenant.
- Conditional Access Administrator
- Security Administrator
- Global Administrator
Good to know
- About 10 minutes to configure, plus a few minutes for the policy to take effect.
- Steps reflect the Microsoft Entra admin center. Agent identities and the Agent risk condition are in Preview and may change.
Quick answer
Create a Conditional Access policy in the Microsoft Entra admin center that targets all agent identities, applies to all resources, uses the Agent risk (Preview) condition set to High, and blocks access. Enable it directly or start in Report-only mode, then allow a few minutes for it to take effect.
Entra ID > Conditional Access > PoliciesStep-by-step tutorial
6 stepsSign in and open Conditional Access
Reach the policy creation area in the Microsoft Entra admin center.
Entra ID > Conditional Access > Policies > New policySign in to the Microsoft Entra admin center at entra.microsoft.com with an account that can manage Conditional Access (for example a Conditional Access Administrator, Security Administrator, or Global Administrator).
In the left navigation, browse to Entra ID > Conditional Access > Policies. Click New policy to start a blank policy, then in the Name field enter a descriptive name such as CA13-Block High-Risk Agent Identities.
Use a consistent naming convention (like the CA13- prefix) so the policy is easy to find and audit later. The Agents features referenced in these steps are in Preview, so exact labels may change over time.
Target all agent identities
Scope the policy to AI agent identities rather than users.
New policy > Assignments > Users or agents (Preview) > Agents (Preview) > Include > All agent identities (Preview)Click under Users or agents (Preview). Select Agents (Preview) to switch the assignment from human users to agent principals.
Under Include, choose All agent identities (Preview) so the policy evaluates every agent identity in the tenant.
Because this scopes to All agent identities, the actual blocking is still narrowed later by the Agent risk condition — so only high-risk agents are affected, not every agent.
Select target resources
Apply the policy across the resources agents could reach.
New policy > Assignments > Target resources > Resources (formerly cloud apps) > Include > All resourcesClick under Target resources. Choose Resources (formerly cloud apps).
Under Include, select All resources (formerly 'All cloud apps') so the block applies broadly rather than to a single application.
Applying to all resources gives the broadest protection. If you have specific service accounts or apps that must never be blocked, plan for exclusions and test carefully in report-only mode first.
Configure the Agent risk condition
Limit the policy to high-risk agents only.
New policy > Assignments > Conditions > Agent risk (Preview) > Configure: Yes > High > DoneClick under Conditions, then open Agent risk (Preview).
Set Configure to Yes, then select the High risk level. Click Done to save the condition.
Selecting only High ensures agents evaluated at lower risk levels are not blocked by this policy. Entra assigns the risk level; this condition simply filters on it.
Set the Block access grant control
Deny access when the conditions match.
New policy > Access controls > Grant > Block access > SelectClick under Grant. Select Block access, then click Select to confirm the control.
This tells Conditional Access to deny access whenever the policy's assignments and conditions are all met.
Block access is an all-or-nothing control — no session or additional grant options apply. Double-check the assignments before enabling so you don't unintentionally block legitimate agents.
Enable and create the policy
Activate the policy or run it in report-only mode first.
New policy > Enable policy > On / Report-only > CreateUnder Enable policy, choose On to enforce the block immediately, or Report-only to log what would be blocked without actually blocking anything.
Click Create to save the policy. It appears in the Policies list right away.
Wait a few minutes for the policy to become effective. Starting in Report-only lets you review sign-in log impact before switching to On; check the report-only results before enforcing.
Confirm the high-risk AI agent block policy is in place
After you click Create, the new Conditional Access policy appears in the list at Entra ID > Conditional Access > Policies. Confirm the entry named CA13-Block High-Risk Agent Identities (or the name you chose) shows the state you selected — On or Report-only.
A successful configuration means the policy is scoped to agent identities (not users), targets all resources, and only triggers when the Agent risk condition evaluates an agent as High. When an in-scope agent identity is flagged as high risk, the Block access grant control denies the request. Allow a few minutes after creation for the policy to become effective across the tenant.
Seeing the policy in the list confirms it was saved, but not that it is enforcing. Open the policy and verify each assignment (Users or agents, Target resources, Conditions, and Grant) reflects the intended scope, because a missing condition or wrong grant control would either block too broadly or not block at all.
- The policy is listed with State = On (enforcing) or Report-only (logging only). Its assignments show Agents (Preview) > All agent identities, Target resources = All resources, Conditions > Agent risk = High, and Grant = Block access.
- The policy is missing from the list, shows an unexpected state, or its assignments differ from the intended scope — for example it targets Users instead of Agents, has no Agent risk condition, or uses a Grant control other than Block access. This means the policy will not block high-risk agents as intended and must be corrected.
- The display name shown in the Policies list; use your own naming convention if preferred.
- The policy actively blocks in-scope high-risk agent identities.
- The policy logs what it would have done without blocking; use this to validate impact first.
- The policy only applies to agent identities Entra evaluates as high risk.
- Access is denied when the agent identity and risk condition match.
Troubleshooting
The Agents (Preview) option is not visible under Users or agents (Preview)
Cause: Agent identity assignment in Conditional Access is a preview feature, and the option may not be surfaced in every tenant yet or may require the correct portal experience.
Confirm you are signed in to the Microsoft Entra admin center with an account that has Conditional Access administrator rights, then reopen Entra ID > Conditional Access > Policies > New policy and expand Users or agents (Preview). If the toggle is still missing, the preview may not be enabled for your tenant — verify preview availability before proceeding rather than forcing a user-scoped policy.
The Agent risk (Preview) condition does not appear under Conditions
Cause: The Agent risk condition is only relevant when the policy is scoped to agent identities, and it is a preview capability.
Make sure Step 2 was completed first — select Agents (Preview) and Include > All agent identities (Preview) before opening Conditions. Then reopen Conditions > Agent risk (Preview), set Configure to Yes, and choose High.
High-risk agents are still able to access resources after creating the policy
Cause: The policy needs time to propagate, or it was left in Report-only mode where it logs matches but does not enforce blocking.
Check that Enable policy is set to On rather than Report-only, then wait a few minutes for the policy to take effect. Review the policy in the Policies list to confirm its state, and use sign-in logs to verify the policy is being evaluated.
Legitimate AI agents are unexpectedly blocked
Cause: An agent may be evaluated as high risk, or the policy scope is broader than intended.
Run the policy in Report-only mode first to see which agents would be blocked before enforcing. Review the sign-in and Conditional Access reports to confirm which agent identities match the High risk level, and only switch to On once the impact is understood.
Frequently asked questions
What are AI agent identities in Microsoft Entra?
AI agent identities are principals that represent AI agents operating in your tenant, separate from human user accounts. Scoping a Conditional Access policy to agent identities lets you apply access controls specifically to these agents rather than to your users.
How does Entra determine that an AI agent is high risk?
Entra applies an agent risk level that you can target in the Agent risk (Preview) condition, where you choose the High level to match high-risk agents. The underlying risk evaluation is handled by Microsoft Entra as part of this preview capability.
Should I start with report-only mode when blocking high-risk AI agents?
Yes, setting Enable policy to Report-only first lets you see which agents the policy would block without actually enforcing it. Once you have confirmed the impact in the reports, you can switch the policy to On.
Will this policy block all AI agents or only high-risk ones?
This policy blocks only agents evaluated at the High risk level, because the Agent risk (Preview) condition is set to High. Agents that are not high risk are not affected by this specific policy.
How long does the Conditional Access policy take to become effective?
After you click Create, the policy appears in the list but needs a few minutes to become effective. Wait before testing enforcement so the policy has time to propagate.
Where do I create this policy in the Microsoft Entra admin center?
Sign in to the Microsoft Entra admin center and browse to Entra ID > Conditional Access > Policies, then click New policy. This is where you scope the policy to agent identities and configure the Agent risk condition.
