Securing Non-Human Identities with Microsoft Entra

Non-human identities, service principals, managed identities, and now AI agents, outnumber human users in most Microsoft Entra tenants, and most of them run without anyone actively watching. This lab series follows a single real non-human identity, the Conditional Access Optimization Agent that Microsoft Entra provisions for you, from the moment it is registered through governing it over time and finally responding to a security incident involving it.

The three labs are meant to be done in order, in the same tenant, against the same agent identity. What you register and govern in Lab 1 is what drifts and gets remediated in Lab 2, and what gets attacked and defended in Lab 3. That continuity is the point: real non-human identity security is not a one-time setup, it is something you maintain and defend across the whole life of the identity.

• Give security practitioners hands-on experience securing non-human identities (NHIs) in Microsoft Entra, using a real agent.
• Build the habit of applying least-privilege, accountability, and monitoring to identities that have no human actively watching them.
• Connect a real, disclosed vulnerability (CVE-2026-42901) to the defensive controls that mitigate it, so learners understand both the attack and the remediation.
• Register and govern a Microsoft Entra agent identity, including assigning a sponsor and reviewing its permissions.
• Apply a Conditional Access baseline that targets agent identities by risk level
• Detect an under-governed or inherited-sponsor agent identity and re-establish accountable ownership
• Scope an agent identity's access using an access package, and configure recurring access reviews
• Configure a Lifecycle Workflow to maintain sponsorship continuity automatically
• Detect and respond to agent risk using Microsoft Entra ID Protection
• Demonstrate and then remediate an agent-identity privilege escalation, using least privilege, Privileged Identity Management, and Conditional Access enforcement.
• Verify remediation through audit logs and soft-delete confirmation.

• Windows (Windows 10 or 11 / Server)
• Microsoft Edge (the walkthroughs specify Edge + InPrivate throughout; it's the required browser)
• PowerShell 7 (Provisioned)
• Microsoft Graph PowerShell module (Provisioned)
• Microsoft Entra tenant (lab tenant)
• Licensing: Microsoft Entra ID P1/P2, plus Microsoft Agent 365 
• Security Copilot provisioned (Lab 1 activates the CA Optimization Agent through it)