Tenable Adds Microsoft Entra Agent ID Support to Cloud Exposure Platform

Tenable announced that its One Cloud Exposure platform now supports Microsoft Entra Agent ID, bringing agentic AI identities into unified asset and identity inventories. This update addresses the growing challenge of securing autonomous AI agents that operate within cloud environments and interact with external APIs.

According to Tenable, conventional identity and access management systems often fail to recognize or monitor these new identity classes. This creates security blind spots as organizations accelerate the adoption of agentic AI tools. The new integration allows security teams to locate and catalog every AI agent operating in their environment using native cloud provider tools or Tenable’s platform.

The Limits of Traditional Identity Models

Security teams traditionally categorize identities into human users and non-human identities, such as service accounts and automated scripts. Tenable warns that treating AI agents as standard non-human identities is ineffective because of their non-deterministic nature. Unlike classic scripts that follow rigid code paths, AI agents execute flexible, outcome-oriented actions and constantly adapt to solve problems.

These agents interact with dynamic external tools, memory caches, and knowledge bases, making it difficult for security teams to establish baseline behavior. As AI agents move from experimental tools to autonomous decision-makers, organizations must clarify what is executing actions in their cloud environments. Major cloud providers have introduced specialized agentic AI identity models to address these unique behavioral characteristics and permission requirements.

Microsoft Entra Agent ID Framework

Microsoft Entra Agent ID functions through a four-tiered structural model designed for identity provider-centric management. Agent identity blueprints serve as master templates for shared attributes and reside exclusively within the agent provider’s home tenant. These blueprints establish cross-tenant links, which heightens exposure to potential supply-chain attacks according to Tenable.

Agent identity blueprint principals represent the localized instantiation of a blueprint within every specific tenant where the AI agent is deployed. Agent identities are the functional identities utilized for routine tasks. The framework supports any AI platform, including Microsoft Copilot and third-party platforms not hosted on Azure, covering both unmanaged and external SaaS-based agents.

What should you do?

Tenable advises organizations to understand their current maturity level before building an action plan to secure agent identities. Security teams should use cloud providers’ native tools or Tenable One Cloud Exposure to locate and catalog every AI agent. Organizations should not assign human identities or over-privileged service accounts to AI agents deployed by vendors. Instead, they should require vendors to adopt official models like Microsoft Entra Agent ID for robust agentic AI identity security.

What to do and how to stay safe: Tenable

• Inventory all AI agents in your cloud environment using native tools or Tenable One Cloud Exposure.
• Avoid assigning human identities or over-privileged service accounts to vendor-deployed AI agents.
• Require vendors to adopt official identity models like Microsoft Entra Agent ID for their agents.
• Review permission boundaries and cascade rules for all agentic AI identities in your tenants.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why are traditional non-human identities insufficient for AI agents?

AI agents are non-deterministic and execute flexible, outcome-oriented actions rather than following rigid, predictable code paths like standard scripts.

What is the four-object model in Microsoft Entra Agent ID?

It consists of agent identity blueprints, agent identity blueprint principals, agent identities, and agent users to manage permissions and authentication.

How does Tenable One Cloud Exposure help with AI agents?

It brings Microsoft Entra agentic AI identities into a unified asset and identity inventory to improve visibility and security context.