/
← Voltar ao feed
low

Tenable One Cloud Exposure adds Microsoft Entra Agent ID support to inventory AI agent identities

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 10:17 · coletado há 2 dias

Tenable announced that Tenable One Cloud Exposure now brings Microsoft Entra Agent ID agentic AI identities into its unified asset and identity inventory. The post argues that treating AI agents as ordinary non-human identities (NHIs) is risky, because agents make non-deterministic, runtime decisions through LLMs, which makes baselining their behavior difficult. It is a product and best-practice article, not a report of an incident or active threat. The author presented related research with Ron Popov at fwd:cloudsec North America 2026.

Detalhes técnicos

  • Microsoft Entra Agent ID is built on Entra ID and uses a four-object model: agent identity blueprint, agent identity blueprint principal, agent identity and agent user.
  • Blueprints reside only in the agent provider's home tenant and create cross-tenant links that, according to Tenable, increase exposure to potential supply-chain attacks.
  • Hardening relies on permission boundaries, cascade rules and "on-behalf-of" user plus agent dual authentication.
  • Conventional IAM tools may not recognize or monitor these new identities, which creates security blind spots.

Remediação

  • Assess your current maturity level and build an action plan to secure agent identities.
  • Use native cloud provider tools or Tenable One Cloud Exposure to locate and catalog every AI agent in the environment.
  • Do not assign human identities or over-privileged service accounts to vendor-deployed AI agents. Require vendors to adopt official identity models such as Microsoft Entra Agent ID.
  • Monitor agent identities, the primary entities for oversight of agent behavior.

Linha do tempo

  1. tenable.com ↗ · pub. 19/10/2026 10:17 · coletado 19/10 18:00 primeiro registro

    Tenable One Cloud Exposure adds Microsoft Entra Agent ID support to inventory AI agent identities

    ler a análise desta fonte

    Tenable announced that Tenable One Cloud Exposure now brings Microsoft Entra Agent ID agentic AI identities into its unified asset and identity inventory. The post argues that treating AI agents as ordinary non-human identities (NHIs) is risky, because agents make non-deterministic, runtime decisions through LLMs, which makes baselining their behavior difficult. It is a product and best-practice article, not a report of an incident or active threat. The author presented related research with Ron Popov at fwd:cloudsec North America 2026.

    Technical Details

    • Microsoft Entra Agent ID is built on Entra ID and uses a four-object model: agent identity blueprint, agent identity blueprint principal, agent identity and agent user.
    • Blueprints reside only in the agent provider's home tenant and create cross-tenant links that, according to Tenable, increase exposure to potential supply-chain attacks.
    • Hardening relies on permission boundaries, cascade rules and "on-behalf-of" user plus agent dual authentication.
    • Conventional IAM tools may not recognize or monitor these new identities, which creates security blind spots.

    Remediation

    • Assess your current maturity level and build an action plan to secure agent identities.
    • Use native cloud provider tools or Tenable One Cloud Exposure to locate and catalog every AI agent in the environment.
    • Do not assign human identities or over-privileged service accounts to vendor-deployed AI agents. Require vendors to adopt official identity models such as Microsoft Entra Agent ID.
    • Monitor agent identities, the primary entities for oversight of agent behavior.