IntelligentHQ
IntelligentHQ
Skip to content

Secure identities

Protect sign-ins for people, workloads and AI agents with Microsoft Entra: phishing-resistant passwordless methods, Conditional Access, risk-based policies and governed, time-limited access, with device health checked through Intune.

The problem

Most attacks start with an identity: phished passwords, password spray, leaked credentials and administrators with permanent rights. Passwords and many second factors can be phished, and access tends to pile up as people change roles.

AI agents add a new kind of identity that acts on its own, needs scoped permissions and still needs an accountable human.12

The approach

  1. Baseline: security defaults are available to all customers. Conditional Access, which requires Microsoft Entra ID P1 (also in Microsoft 365 Business Premium), adds if-then policies that use signals such as user, location, device, application and risk to block access or require MFA, a compliant device or a stronger authentication method.
  2. Phishing-resistant sign-in: passkeys (device-bound in Microsoft Authenticator or FIDO2 keys, or synced), Windows Hello for Business and certificate-based authentication. Microsoft recommends FIDO2 security keys for highly regulated industries or privileged users. Registration needs no license, but Microsoft recommends P1 to enforce it with Conditional Access.
  3. Risk: Microsoft Entra ID Protection (P2) detects risks such as leaked credentials and password spray and can drive risk-based Conditional Access.
  4. Governance: Microsoft Entra ID Governance adds access reviews, lifecycle workflows, entitlement management and Privileged Identity Management for just-in-time admin access.
  5. Devices: Intune sends device compliance state to Entra for Conditional Access.
  6. Agents: Microsoft Entra Agent ID is available to all Entra customers; Microsoft says extending Entra security features to agents requires Microsoft Agent 365.

When a simpler route is enough: a small organization can start with security defaults or the Conditional Access included in Microsoft 365 Business Premium before buying P2 or governance add-ons.1345678

Conceptual architecture

Secure identities: conceptual architectureCopilot & businessappsAgents & automationSecurity, identity &governancePeople, workloads and agents: Request access to apps and dataPeople, workloads and agentsApps and resources: Protected targetsApps and resourcesMicrosoft Entra Agent ID: Identities and blueprints for AI agentsMicrosoft Entra Agent IDMicrosoft Entra ID: Directory and authenticationMicrosoftEntra IDPasskeys, Windows Hello for Business, FIDO2 keys: Phishing-resistant authenticationPasskeys,Windows Hel…Conditional Access: If-then policies that block or require stronger controlsConditionalAccessMicrosoft Entra ID Protection: Detects risky users and sign-insMicrosoftEntra ID…ID Governance and Privileged Identity Management: Access reviews, lifecycle and just-in-time admin rightsID Governanceand…Microsoft Intune: Reports device compliance to EntraMicrosoftIntune
Diagram as a list

  1. Copilot & business apps

    • People, workloads and agentsRequest access to apps and dataConnects to Microsoft Entra ID
    • Apps and resourcesProtected targets

  2. Agents & automation

    • Microsoft Entra Agent IDIdentities and blueprints for AI agentsConnects to Conditional Access

  3. Security, identity & governance

    • Microsoft Entra IDDirectory and authentication
    • Passkeys, Windows Hello for Business, FIDO2 keysPhishing-resistant authenticationConnects to Conditional Access
    • Conditional AccessIf-then policies that block or require stronger controlsConnects to Apps and resources
    • Microsoft Entra ID ProtectionDetects risky users and sign-insConnects to Conditional Access
    • ID Governance and Privileged Identity ManagementAccess reviews, lifecycle and just-in-time admin rightsConnects to Microsoft Entra ID
    • Microsoft IntuneReports device compliance to EntraConnects to Conditional Access
Conceptual: one common way to arrange the parts, not a required design.3

Technologies and their roles

  • Microsoft Entra2

    Identity and access

    Entra ID, Conditional Access, ID Protection, ID Governance and Agent ID form the control plane for sign-ins.

  • Microsoft Intune7

    Device compliance

    Managed devices report compliance that Conditional Access can require.

  • Microsoft Defender XDR9

    Threat signals

    Defender XDR uses Entra ID Protection signals and can contain compromised identities.

  • Microsoft Agent 3658

    Security for agent identities

    Microsoft states that extending Entra security features to agents requires Agent 365.

What you need first36

  • Microsoft Entra ID P1 for Conditional Access (P2 for risk-based policies; ID Governance or Entra Suite for governance features)
  • An inventory of admin roles and break-glass accounts excluded from risky policies
  • Supported devices or security keys for passwordless rollout
  • Intune enrollment if policies will require compliant devices
  • A named human sponsor for each agent identity

Risks and how to reduce them

A new policy locks out administrators3
Roll policies out to a small pilot group first and keep emergency access accounts excluded.
Users fall back to phishable methods5
Enforce authentication strength with Conditional Access once passkeys or Windows Hello are registered.
Risk signals without action1
Connect ID Protection to risk-based Conditional Access so remediation happens automatically.
Agents keep access after owners leave6
Use agent sponsors and access packages so sponsorship moves to the manager and access is reviewed.

Related

Sources

  1. What is Microsoft Entra ID Protection? (opens in a new tab)Microsoft · Vendor-reported
  2. What is Microsoft Entra? (opens in a new tab)Microsoft · Vendor-reported
  3. Microsoft Entra Conditional Access: Zero Trust policy engine (opens in a new tab)Microsoft · Vendor-reported, Recommendation
  4. Passkeys (FIDO2) authentication method in Microsoft Entra ID (opens in a new tab)Microsoft · Vendor-reported
  5. Get started with a phishing-resistant passwordless authentication deployment in Microsoft Entra ID (opens in a new tab)Microsoft · Vendor-reported
  6. Microsoft Entra ID Governance (opens in a new tab)Microsoft · Vendor-reported
  7. What is Microsoft Intune? (opens in a new tab)Microsoft · Vendor-reported
  8. What is Microsoft Entra Agent ID? (opens in a new tab)Microsoft · Vendor-reported
  9. What is Microsoft Defender XDR? (opens in a new tab)Microsoft · Vendor-reported

Fill out the form below to request your copy.

Name(Required)