Do new Copilot Studio agents get Entra Agent IDs automatically?

You’re right to want agents on the same identity plane as users and workloads. App-registration sprawl was never a governance strategy — it was an accident of how the platform used to provision.

Here’s what’s going on. For agents on the standard harness, Copilot Studio integrates with Microsoft Entra Agent ID. Before May 2026, each new agent typically got an Azure app registration. After May 2026, Copilot Studio automatically creates a Microsoft Entra Agent ID for each new agent; you manage it in the Entra admin center. Starting May 2026 you cannot opt out of automatic Agent ID creation at environment level. Existing agents that still use app registrations continue to work; Microsoft plans automatic migration in a future update, and you can optionally migrate earlier via Power Platform admin center Advisor, PowerShell, or APIs. Governance capabilities apply to both identity types during the transition. When a maker publishes, connector permissions appear as API permissions on the Agent ID — Entra and Microsoft 365 admins can see what the agent can call without opening PPAC, and can target those scopes with Conditional Access (network, device, risk). The first Agent ID in an environment also brings a tenant blueprint (Microsoft Copilot Studio agent identity blueprint). Deleting the agent deletes the Agent ID. Confirm the GUID under Copilot Studio Settings → Advanced → Metadata → Entra Agent ID. Agent Builder agents in Microsoft 365 Copilot are a different story — they don’t use these Agent IDs the same way.

Steady Identity (Pane 04) before agent scale: register, sponsor, review — don’t wait for orphaned principals. Schofield’s Third Law (historically attributed) still holds — once an agent can reach connectors easily, so can anyone who compromises that identity path.

Options that actually work:

1. Treat May 2026+ agents as Agent ID by default, inventory legacy app-registration agents, and migrate priority agents (high-privilege connectors, production channels) ahead of Microsoft’s backfill. Best Steady path.
2. Wait for Microsoft’s automatic migration for low-risk internal bots; still assign sponsors and access reviews now. Acceptable if the register is short.
3. Recreate every agent from scratch “to be safe.” Only needed for some recreate-and-deprecate paths called out in Entra migration docs — don’t burn the farm unless Learn says in-place isn’t available for that case.
4. Ignore Agent ID and keep governing only in Copilot Studio. You lose Entra audit clarity, CA on connector scopes, and registry convergence with Agent 365.

12 Panes action / comms: Tell IAM: New Studio agents are Agent IDs — fold them into access reviews and sponsor checks. Tell makers: Publish with least connectors; Security can see scopes in Entra. CISO: CA on agent connector permissions is available — design policies, don’t wait for a breach narrative.

Benefits / risks: Unified audit and lifecycle; migration and doc paths still evolve (preview notes appear on some migrate articles — verify before a big cutover). Blueprint sharing across Studio agents simplifies management but means tenant-level blueprint hygiene matters.

I’d suggest this week: list agents still on app registrations, migrate one production agent as a dress rehearsal, and add Agent ID sponsors to your quarterly orphan review. You’ll have Steady Identity under the agent programme without waiting for the backfill to surprise you.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer