Tenable Integrates Microsoft Entra Agent ID for AI Identity Visibility

Tenable has expanded its Tenable One Cloud Exposure platform to include visibility into Microsoft Entra Agent IDs, according to company research. This update targets organizations deploying autonomous AI agents that interact with databases and external APIs. Traditional identity management systems often fail to recognize these new identity classes, creating security blind spots. The integration allows security teams to locate and catalog every AI agent operating within their cloud environments, addressing a critical gap in current asset inventories.

By the numbers

• 4: The number of objects in the Microsoft Entra Agent ID structural model.
• 2: The buckets security teams traditionally use for identities: human and non-human.
• 1: The unified asset and identity inventory where Tenable now places these agents.

What the figures mean

Microsoft’s framework uses a four-object model including agent identity blueprints, blueprint principals, identities, and users. Tenable states that conventional IAM systems may not monitor these brand-new identities. By bringing Microsoft Entra agentic AI identities into a unified inventory, Tenable aims to provide context about security flaws. This visibility is essential because attackers could compromise and abuse these agents, which now hold real permissions. The four-tiered structure includes cross-tenant links that can heighten exposure to supply-chain attacks.

What should you do?

Organizations should immediately audit their environments for any AI agents that lack dedicated identities. Check whether vendors are using human identities or over-privileged service accounts for these tools, as Tenable advises against this practice. Verify that your cloud exposure platform can detect Microsoft Entra Agent IDs to ensure complete inventory coverage. Organizations must understand their current maturity level before building an action plan to secure these agent identities.

Operational impact

Security teams usually need to update their asset discovery processes to include non-human identities that behave autonomously. Check whether your current IAM tools can distinguish between standard service accounts and adaptive AI agents. Inform cloud architects and vendor management teams about the need for dedicated agent identity models. Ensure that procurement contracts require vendors to adopt official identity standards like Microsoft Entra Agent ID. This prevents the use of shared or human credentials for automated tools, reducing lateral movement risks.

What to do and how to stay safe: Tenable

• Use cloud providers’ native tools or Tenable One Cloud Exposure to locate and catalog every AI agent in your environment.
• Require vendors to adopt official models like Microsoft Entra Agent ID for their AI agents’ identities rather than using human accounts.
• Do not assign human identities or over-privileged service accounts to the AI agents your vendors deploy in your environment.
• Understand your current maturity level and build an appropriate action plan to secure your agent identities based on the findings.

Step-by-step guide: Shadow AI Explained: 8 Questions Answered for Secure Operations

General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why are standard non-human identities insufficient for AI agents?

AI agents are non-deterministic and adapt to solve problems, making it difficult to establish baseline behavior compared to rigid scripts.

What is the Microsoft Entra Agent ID model?

It is a four-object model including agent identity blueprints, blueprint principals, agent identities, and agent users.

How does Tenable help with AI agent security?

Tenable One Cloud Exposure now brings Microsoft Entra agentic AI identities into a unified asset and identity inventory for better visibility.