The Agent Registry and How Agent Identities Operate in Entra ID

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Chapter six of Semperis' Entra ID agent-identity guide covers common misconfigurations: agent IDs without owners or sponsors, blueprints relying on client secrets, and over-privileged agents.

A hands-on checkpoint walking through Entra ID's three agent authentication flows (autonomous, OBO, agent-user), decoding tokens to show how claims map to blueprints, identities and permissions.

Semperis practice checkpoint two wires up the Entra ID agent permission model: direct app-only roles on the agent identity plus inheritable delegated permissions granted at the blueprint level.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Nearly one in seven Entra ID environments saw rogue device registrations in 90 days, Wiz finds; attackers abuse DRS via device-code phishing, and AI-realistic device names erode old fingerprints.