# Machine Identity Governance

SailPoint addresses Machine Identity Governance by integrating non-human identities such as service accounts and bots into its unified SailPoint platform. This approach eliminates security silos by managing human and machine identities under a single governance framework. This comprehensive approach ensures that machine identities maintain the principle of least privilege, reducing the attack surface and enhancing organizational compliance across complex hybrid and multi-cloud environments.

> [!IMPORTANT]
>
> Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. For more information, refer to[SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

Microsoft Entra ID SaaS connector supports the following AI agents management:

## Azure AI Foundry Agents Management

> [!IMPORTANT]
>
> Microsoft has deprecated Classic Azure AI Foundry agents. Because of this, the Microsoft Entra SaaS connector now supports discovery (aggregation) of New Azure AI Foundry agents only. It no longer aggregates Classic Azure AI Foundry agents.

Azure AI Foundry Agent Service enables you to create AI agents that automate tasks and workflows. This platform provides:

- A framework for building agents that reason, act, and learn
- Access to diverse models, knowledge sources, and tools
- Real-world interaction capabilities through search, action connectors, and code execution

Applications range from simple task automation to complex, multi-agent workflows. The platform offers a unified experience for developers and IT administrators through:

- A web portal
- Software Development Kit (SDK)
- Application Programming Interfaces (APIs)
- Use these tools to build, deploy, and manage your AI agents efficiently.

> [!IMPORTANT]
>
> Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. For more information, refer to[SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

### Supported Features

- Aggregation of classic Azure AI Foundry agents
- Aggregation of new Azure AI Foundry agents

  For more information, refer to [Azure AI Foundry Agents Attributes](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/schema/azure/machine_identity_attributes.html#azure-ai-foundry-agents-attributes>).
- Activate and deactivate new Azure AI Foundry agents

### Required Permissions

| API / Role | Permission / Role Name | Type | Description / Purpose |
| --- | --- | --- | --- |
| Microsoft Graph API | Application.Read.All<br>OR<br>Directory.Read.All | Application | Read application data<br>Read directory data |
| Azure Service Management API | user\_impersonation | Delegated | Access Azure Resource Manager as organization users |
| Azure RBAC Role on your subscription | Reader | Role-based | View all resources, but does not allow you to make any changes. |
| Azure RBAC Role on your subscription | Cognitive Services Data Contributor (Preview) | Role-based | Allows to call data plane APIs, but not any control plane APIs for Microsoft Cognitive Services. This role is in preview and subject to change. |

### Assigning Reader and Cognitive Services Data Contributor (preview) Role in Azure for Your Subscription:

Follow these steps to assign the Cognitive Services Data Contributor (Preview) Role in Azure for your subscription :

1. Go to Azure Portal.
2. Select your active **Azure Subscription** under **Use** option.
3. Go to **Access Control (IAM)** for the subscription.
4. Select **\+ Add \> Add role assignment**.
5. Assign the Reader role:

   1. Under **Role**, select **Reader**.
   2. In the **Members** section, search for and select your **Registered Application**.
   3. Select **Review + assign** to apply the role.
6. Assign the Cognitive Services Data Contributor (Preview) role:

   1. Under **Role**, select **Cognitive Services Data Contributor (Preview)**.
   2. In the **Members** section, find and select your **Registered Application**.
   3. Click on **Review + assign** to apply the role.

This grants the necessary permissions to your Registered Application for Cognitive Services data access.

> [!IMPORTANT]
>
> If you have multiple subscriptions in your Azure tenant, repeat the role assignment process for each subscription from which you want to manage resources (agents).

### Enabling Machine Identity Governance

To enable Azure AI Foundry aggregation, follow these steps:

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/agent_governance.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/agent_governance.png>)

1. Go to Microsoft Entra ID SaaS source configuration page within SailPoint.
2. Select **Machine Identity Governance Settings** tab.
3. Select **Enable Azure AI Foundry Agents**. This enables Agent Governance support for your environment.
4. Select **Save**.

### Supported Resources

For more information, refer to [Microsoft Foundry Resources](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-foundry-resources>).

## Microsoft Copilot Studio Agents Management

Microsoft Copilot Studio Agents are part of the Microsoft Power Platform ecosystem, rather than standalone Azure resources. They operate across three integrated layers:

- **Experience Layer (Copilot Studio)**: Where the agent is designed and managed.
- **Data Layer (Dataverse)**: Where the agent's configuration and metadata are stored.
- **Identity Layer (Azure AD/Entra ID)**: Where the agent's identity is managed for secure authentication and service access.

Every Copilot belongs to a Power Platform environment. The environment determines where to store the agent and which Dataverse database belongs to that environment.

> [!IMPORTANT]
>
> Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. For more information, refer to[SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

### Supported Features

- Aggregation of Microsoft Copilot Studio agents
- Activate and deactivate Microsoft Copilot Studio agents

### Prerequisites

Make sure the service principal configured on the SailPoint platform for Microsoft Entra ID SaaS connector is added as an application user in every Power Platform environment where you want to manage Microsoft Copilot Studio agents.

Steps to add the service principal as an application user Power Platform Admin Center:

1. Sign in to the Power Platform Admin Center.
2. Go to **Manage**.
3. Select the environment.
4. Go to **Settings \> Users + permissions \> Application users**.
5. Select **New app user \> Add an app**.
6. Select the service principal used by the Entra ID SaaS connector, then select **Add**.

### Required Permissions

Copilot agents reside within Power Platform environments, and their metadata is stored in Dataverse. Consequently, your user account must have specific permissions within the Power Platform Admin Center to view or manage these agents.

#### Required Security Roles

| PI / Role | Permission / Role Name | Type | Description / Purpose |
| --- | --- | --- | --- |
| Security Role | Global Discovery Service Role | Role-based | Lets the app call the Global Discovery API and get the list of instances. |
| Custom Security Role | BotReader (custom role: Read = Organization on bot + botcomponent) | Role-based | Lets the app call the bots API and read agent metadata and components. |

#### Required Dataverse Privileges

To activate or deactivate Copilot Studio agents, the SailPoint application user in Power Platform requires the Write privilege on the Bot (Agent) and Bot Component tables in Dataverse, in addition to the read privileges required for aggregation.

<table class="span-table"> <tr> <td>Privilege</td> <td>Dataverse Table</td> <td>Level</td> <td>Required For</td> </tr> <tr> <td>Read (<code>prvReadbot</code>)</td> <td>Bot / Agent</td> <td colspan="1" rowspan="4">Organization</td> <td>Aggregation (read agents)</td> </tr> <tr> <td>Write (<code>prvWritebot</code>)</td> <td>Bot / Agent</td> <td>Activate and deactivate agents</td> </tr> <tr> <td>Read (<code>prvReadbotcomponent</code>)</td> <td>Bot Component</td> <td>Aggregation (read components)</td> </tr> <tr> <td>Write (<code>prvWritebotcomponent</code>)</td> <td>Bot Component</td> <td>Enable and disable agents</td> </tr> </table>

**Steps to configure these privileges in the Power Platform Admin Center:**

1. Sign in to the [Power Platform Admin Center](<https://admin.powerplatform.microsoft.com/>).
2. Select your environment and go to **Settings \> Users + Permissions \> Security Roles**.
3. Open the **BotReader** security role assigned to the SailPoint application user. If this role doesn't exist, create it.
4. On the Custom Tables tab, find the Agent (`bot`) and Agent Component (`botcomponent`) tables.
5. Set the Write column to Organization level for both tables.
6. Select **Save**.
7. Go to **Application Users**, select the SailPoint app, select **Manage Security Roles**, and confirm the updated role is assigned.

### Enabling Machine Identity Governance

To enable Copilot Studio agents aggregation, follow these steps:

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/copilot_agent.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/copilot_agent.png>)

1. Go to Microsoft Entra ID SaaS source configuration page within SailPoint.
2. Select **Machine Identity Governance Settings** tab.
3. Select **Enable Microsoft Copilot Studio Agents**. This enables Copilot agent aggregation in your environment.
4. Select **Save**.

### Supported Resources

For more information, refer to [Microsoft Copilot Studio Resources](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-copilot-studio-resources>).

## Microsoft Agent 365 Catalog Management

Microsoft Agent 365 provides a unified catalog of Microsoft 365 Copilot agents across multiple platforms. The Microsoft Entra ID SaaS connector aggregates catalog packages from this catalog as machine identities through the Microsoft Agent 365 dataset.

> [!IMPORTANT]
>
> Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. For more information, refer to[SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

### Supported Features

- Aggregation of Microsoft Agent 365 catalog packages
- Activate and deactivate (enable and disable) catalog packages for Azure AI Foundry, Microsoft 365 Copilot Agent Builder platforms, and other platforms

  > **Note**
  >
  > Copilot Studio agents appear in the Microsoft Agent 365 catalog for visibility, but block and unblock operations are not supported for Copilot Studio catalog packages. To manage Copilot Studio agents, select **Enable Microsoft Copilot Studio Agents** instead. For more information, refer to [Microsoft Copilot Studio Agents Management](<#microsoft-copilot-studio-agents-management>).

### Prerequisites

- To enable Microsoft Agent 365 requires a Microsoft Agent 365 tenant license.
- The Microsoft Agent 365 catalog configuration requires a refresh token grant type. Provide a refresh token with the required permissions to aggregate and manage Microsoft Agent 365 agents.

  > **Note**
  >
  > Note Configure the refresh token based on your source [Connection Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/connecting.html#connection-settings>):
  >
  > - If source connection settings uses the Refresh Token grant type - No action needed. The connector automatically uses the refresh token from your main connection settings.
  > - If source connection settings uses the Client Credentials grant type - You must generate a separate refresh token and enter it in the **Refresh Token** field under **Machine Identity Governance Settings**.

  For more information, refer to [Generating a Refresh Token](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/configuring_for_integration.html#generating-a-refresh-token>).

### Required Permissions

The Microsoft Graph API requires delegated permissions and a refresh token to aggregate and manage Microsoft Agent 365 catalog packages. In your Microsoft Entra app registration, add the following delegated API permissions:

| API | Permission | Type | Description / Purpose |
| --- | --- | --- | --- |
| Microsoft Graph | CopilotPackages.ReadWrite.All | Delegated | Aggregate and manage (block and unblock) Microsoft Agent 365 catalog packages. Admin consent is required. |
| Microsoft Graph | offline\_access | Delegated | Issues a refresh token for persistent access. |
| Microsoft Graph | User.Read | Delegated | Required for the sign-in flow to obtain the initial refresh token. |

> [!IMPORTANT]
>
> Grant admin consent for `CopilotPackages.ReadWrite.All` before configuring Microsoft Agent 365 in the source.

### Enabling Machine Identity Governance

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/microsoft_agent_365_catalog.png>)](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/img/microsoft_agent_365_catalog.png>)

1. In SailPoint, go to your Microsoft Entra ID SaaS source configuration page.
2. Select the **Machine Identity Governance Settings** tab.
3. Select **Enable Microsoft Agent 365** if your tenant is licensed for Microsoft Agent 365. When enabled, all platform checkboxes below are checked by default, and the connector aggregates packages from every platform:

   - Manage Azure AI Foundry Agents
   - Manage Microsoft Copilot Studio Agents
   - Manage Microsoft 365 Copilot Agents
   - Manage Other Platform Agents

   Clear any checkbox to stop aggregating packages from that platform.
4. (Optional) If your source uses the Client Credentials grant type, enter a separately generated refresh token in the **Refresh Token** field.
5. Select **Save**.

> [!NOTE]
>
> - If the platform checkboxes appear unchecked on an existing source, follow these steps to reset them:
>
>   1. Turn off **Enable Microsoft Agent 365** and select **Save**.
>   2. Turn it back on and select **Save** again.
>
>   This resets all platform checkboxes to their default (checked) state.
> - If you do not have an Microsoft Agent 365 tenant license, choose one of these options based on what you use:
>
>   - Enable Azure AI Foundry Agents. For more information, refer to [Azure AI Foundry Agents Management](<#azure-ai-foundry-agents-management>)
>   - Enable Microsoft Copilot Studio Agents. For more information, refer to [Azure AI Foundry Agents Management](<#azure-ai-foundry-agents-management>) and [Microsoft Copilot Studio Agents Management](<#microsoft-copilot-studio-agents-management>).

### Supported Resources

For more information, refer to [Microsoft Agent 365 Catalog Resources](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/saas/help/datasets/ai_agent_resources.html#microsoft-agent-365-catalog-resources>).