With the rise of AI Agents being used, organizations encounter more scenarios where they need to find out what an AI Agent exactly did in an environment. A great example of that is when an Agent has the possibility to read, write, or delete files and messages in Office 365 via AI Tools. In that case, we need to be able to easily search in Defender XDR tables for all events that specific Agent did. But is it that easy to find this? Let's explore.

With Microsoft launching Agent ID at the end of 2025, a new kind of identities were born in Entra ID. These identities are specially built for dynamic requirements of AI Agents, and is therefore a completely now concept to understand for Identity Administrators. But more importantly, how is your organization going to respond if one of these new identities are compromised? We will go over it here, focussing specifically on how to remediate the identities linked to the agent.