---
name: Entra Agent Identity Sponsorship Lifecycle
description: Audits the Microsoft Entra agent identity sponsorship model — verifying every agent has an active human sponsor, that sponsor-departure triggers ownership transfer, and that agents without valid sponsors are flagged for decommissioning.
---

# Entra Agent Identity Sponsorship Lifecycle

> **TL;DR:** This skill audits the Microsoft Entra agent identity sponsorship model to confirm every deployed agent has an active human sponsor, that sponsor-departure triggers automatic ownership transfer, and that agents with no valid sponsor are escalated for immediate decommissioning review.

## What does the Entra agent identity sponsorship lifecycle audit examine?

Microsoft Entra agent identities — non-human identities created for Copilot Studio agents, declarative agents, and Microsoft Agent 365 — require a human sponsor: a named employee who is accountable for the agent's actions and permissions. The sponsorship model (introduced alongside Entra Agent ID GA in May 2026) is an entitlement-governance concept: when the sponsor's Entra account is deactivated, the agent identity should be automatically transferred to the sponsor's manager or flagged for decommissioning. Without this lifecycle control, agent identities become orphaned, accumulating permissions that outlive their business justification and creating persistent access risks equivalent to a former-employee account that was never offboarded. This skill audits the current sponsorship coverage, identifies agents with inactive or no sponsors, verifies the sponsor-departure transfer workflow, and reports the compliance status against the Microsoft Entra ID Governance agent lifecycle recommendations.

## When should you run this skill?

- "Audit Entra agent sponsorship coverage"
- "Find agents without an active human sponsor"
- "Check if sponsor-departure triggers agent ownership transfer"
- "Review agent identity lifecycle governance"
- "Produce evidence of agent identity governance for IRAP"
- "Identify orphaned Copilot Studio agents"

## How this skill works, step by step

1. Query Entra ID for all agent identities: `Get-MgServicePrincipal -Filter "tags/Any(t:t eq 'AgentIdentity')"` or via the Entra portal → Enterprise applications → Application type: Managed identities + Agent identities
2. For each agent identity, retrieve the assigned sponsor (owner attribute linked to a user object)
3. Check each sponsor's account status: enabled, disabled, or deleted
4. Flag agents with: no sponsor assigned, sponsor account disabled or deleted, sponsor who has not signed in for more than 90 days (potential departure precursor)
5. Review the Entra ID Governance lifecycle workflow: Settings → Lifecycle Workflows — confirm a "sponsor departure" workflow exists that either reassigns agent ownership to the manager or raises an access review for the agent's permissions
6. For agents flagged as orphaned (no active sponsor), check when the agent last authenticated — if last sign-in within 30 days, escalate as High risk (active orphaned agent)
7. Produce the register below and recommend: Transfer (reassign to manager), Decommission (no business justification), Review (sponsor inactive but agent unused)

## Output format

| Agent Name | Agent ID | Sponsor | Sponsor Status | Last Agent Sign-in | Lifecycle Workflow | Risk | Recommendation |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Travel-Booking-v2 | app-id | J. Smith | Disabled | 2026-06-15 | Not configured | High | Decommission or transfer to manager |
| HR-Onboarding-Agent | app-id | M. Lee | Active | 2026-06-20 | Configured | Low | Compliant |
| Research-Copilot | app-id | None | — | 2026-04-01 | Not configured | High | Assign sponsor or decommission |

Summary:

- Total agent identities: N
- Agents with no sponsor: N
- Agents with inactive or departed sponsor: N
- Agents without sponsor-departure lifecycle workflow: N
- Active agents (last 30 days) with no valid sponsor: N (escalate immediately)

## Scope and safety

Read-only — this skill does NOT:

- Disable or decommission agents
- Reassign sponsors or modify ownership attributes
- Trigger lifecycle workflows

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Microsoft Entra agent identity enumeration and ownership review | Microsoft Entra ID P1 |
| Lifecycle workflows for sponsor-departure automation | Microsoft Entra ID Governance (P2 or Governance add-on) |

### Least-privilege roles

- Global Reader (read-only review of all agent identities, owners, and lifecycle workflow configuration)
- Identity Governance Administrator (read lifecycle workflow configuration)

### Microsoft Graph permissions (read-only)

- `Application.Read.All` — enumerate agent identity service principals and their owner attributes
- `Directory.Read.All` — resolve sponsor user object status (enabled/disabled) and manager relationships
- `LifecycleWorkflows.Read.All` — read Entra ID Governance lifecycle workflow definitions and scope

## Sources and compliance

- [Governing agent identities in Microsoft Entra ID Governance (Microsoft Learn)](https://learn.microsoft.com/en-us/entra/id-governance/agent-id-governance-overview)
- [Microsoft Entra Agent ID — General Availability (May 2026)](https://learn.microsoft.com/en-us/entra/identity/conditional-access/agent-id)
- Supports Essential Eight ML2 evidence for Control 5 (restrict administrative privileges — non-human identity lifecycle governance)
- Aligns with the Starter Leaver Access Review skill for a unified joiner-mover-leaver + agent lifecycle governance practice
- Pair with Entra Agent ID Audit for complete agent identity risk coverage
- Output in Australian English