AI 61013 - Identity governance for agents — sponsors assigned, entitlement-management channel exists, and lifecycle automation in place

src/powershell/public/Get-ZtGraphScope.ps1

@@ -32,6 +32,7 @@
         'EntitlementManagement.Read.All'
         'IdentityRiskEvent.Read.All'
         'IdentityRiskyUser.Read.All'
+        'LifecycleWorkflows-Workflow.Read.All'
         'Policy.Read.All'
         'Policy.Read.ConditionalAccess'
         'Policy.Read.PermissionGrant'

src/powershell/tests/Test-Assessment.61013.md

@@ -0,0 +1,18 @@
+Microsoft Entra Agent ID requires every agent identity and every agent identity blueprint to have at least one sponsor — a human user (or supported group) who carries business accountability for the agent's lifecycle: deciding when the agent is no longer needed, requesting access packages on the agent's behalf, approving extensions when access expires, and authorising suspension during incidents. Sponsorship is the entry point for the rest of identity governance: lifecycle workflows route sponsor-leaving notifications to managers and cosponsors, access-package expiry escalations are sent to the sponsor, and entitlement-management approvers rely on the sponsor relationship to validate that an agent's continued access reflects current business need. An agent identity that exists in the tenant without a sponsor is governance-invisible. Sponsorship alone, however, is not enough: the workshop guidance also requires that agent permissions — group memberships, Microsoft Graph and other API permissions — flow through Microsoft Entra entitlement management rather than through direct grants. An access package is the unit of bundled grant; an assignment policy attached to that package decides who may request or be assigned the package, who must approve, how long the resulting assignment lasts, and how the assignment is reviewed for continued business need. When an organisation enables agent workloads but does not author at least one access package whose policy targets agent identities, every permission an agent receives must instead be granted directly — through `appRoleAssignment`, `oauth2PermissionGrant`, group `members/$ref`, or directory-role assignment — outside the entitlement-management control loop. Direct grants have no built-in expiration, no approver, no sponsor-driven extension notification, and no access-review schedule; once made, they persist until an administrator notices and removes them. A threat actor who later compromises the agent — through credential theft, blueprint compromise, or a malicious access-package request that no governance pipeline existed to intercept — operates against an identity whose permissions were never reviewed against current business need, the precise standing-privilege condition that lifecycle workflows, sponsor approvals, and time-bounded access packages are designed to prevent. This check verifies the two foundational conditions together: every agent identity and blueprint has at least one sponsor currently resolvable in the directory, and at least one access package in the tenant has an assignment policy whose `allowedTargetScope` is `allDirectoryAgentIdentities` — the Microsoft Graph value corresponding to the portal's *For users, service principals, and agent identities in your directory* → *All agents* selection.
+
+**Remediation action**
+
+- [Administrative relationships in Microsoft Entra Agent ID](https://learn.microsoft.com/en-us/entra/agent-id/identity-platform/agent-owners-sponsors-managers)
+- [Governing agent identities](https://learn.microsoft.com/en-us/entra/id-governance/agent-id-governance-overview)
+- [Agent identity sponsor tasks in Lifecycle Workflows (Preview)](https://learn.microsoft.com/en-us/entra/id-governance/agent-sponsor-tasks)
+- [Add sponsors to an agent identity](https://learn.microsoft.com/en-us/graph/api/agentidentity-post-sponsors?view=graph-rest-1.0)
+- [Manage agents in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/agent-id/manage-agent)
+- [Access packages for agent identities](https://learn.microsoft.com/en-us/entra/agent-id/agent-access-packages)
+- [Create an access package in entitlement management](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package-create)
+- [Create an assignment policy via Microsoft Graph](https://learn.microsoft.com/en-us/graph/api/entitlementmanagement-post-assignmentpolicies?view=graph-rest-beta)
+- [Delegation and roles in entitlement management](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-delegate)
+- [Lifecycle Workflow built-in tasks](https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-tasks)
+- [Create a workflow via Microsoft Graph](https://learn.microsoft.com/en-us/graph/api/identitygovernance-lifecycleworkflowscontainer-post-workflows?view=graph-rest-1.0)
+
+<!--- Results --->
+%TestResult%