Microsoft Entra ID, formerly Azure AD, with policies you can explain.
We design Conditional Access, clean up app registrations, run Entra ID Governance, and set up Microsoft Entra Agent ID so AI agents get their own identities instead of borrowed service principals.
CreateAsManager no longer auto-granted from 4 Nov 2026 (MC1506728)
release watch
Entra Agent ID generally available
Conditional Access and ID Protection for AgentsJul 2026
connects with
in short·15-second read
Microsoft Entra ID is the new name for Azure Active Directory.
Cohash designs Conditional Access, hybrid identity with Entra Connect or Cloud Sync, app registration clean-up and Entra ID Governance. For AI agents, we set up Microsoft Entra Agent ID, now generally available, with blueprints, sponsors, access packages and Conditional Access for agents, and we prepare tenants for Microsoft's November 2026 permission change.
you probably need this if
Conditional Access has grown to dozens of policies and nobody can say which one blocked a sign-in.
AD FS servers still get patched every month for a handful of relying parties.
App registrations are full of client secrets that never expire, owned by people who left years ago.
terms on this pageConditional accessdefinitionRules evaluated at each sign-in that look at conditions such as user, device or location, and then allow, block or demand more proof.explained in a field note →
Conditional Access policy catalog with an owner, purpose and exclusions per policy
Report-only impact analysis from sign-in logs before each policy enforces
App registration inventory with owners, credential expiry and Graph permissions
+ 3 more documents
who does it
Microsoft Entra ID engineer (Conditional Access)Entra ID Governance engineerHybrid identity engineer (Entra Connect, Cloud Sync)
Microsoft Certified: Identity and Access Administrator Associate
Jul 2026Conditional Access and ID Protection for Agents New service plans, GA rollout early July to early August 2026. Included with Microsoft Agent 365 and Microsoft 365 E7 (MC1395007). source ↗
today · Oct 22, 2026
04 Nov 2026aheadAgentIdentity.CreateAsManager no longer granted automatically An agent that creates its own agent identities now needs an admin to consent explicitly. Anything still relying on the old grant gets a 403 (MC1506728). source ↗
no date yetEntra Agent ID generally availableBlueprints for agent identities, sponsor lifecycle workflows, access packages and Conditional Access templates for agents. Agent registry experiences are moving to Microsoft Agent 365.source ↗
the story · microsoft entra id estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Microsoft Entra ID estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · microsoft entra id estate3 open
openConditional Access has grown to dozens of policies and nobody can say which one blocked a sign-in.
recurringAD FS servers still get patched every month for a handful of relying parties.
blockedApp registrations are full of client secrets that never expire, owned by people who left years ago.
exposure
Conditional Access designHybrid identityApp registrations and workload…Entra ID GovernanceEntra Agent IDMoving off AD FS
startrehearsehandover
Tenant assessment
Policies in report-only mode
Hybrid identity and AD FS
Workload and agent identities
Governance and handover
we are here
ready to hand over
Policies each have an owner and a purpose someone wrote down.
Every agent has a sponsor, scoped permissions and a Conditional Access policy for agents.
Conditional Access policy catalog with an owner, purpose and exclusions per policy
Report-only impact analysis from sign-in logs before each policy enforces
chapter 01 · where it hurts
Why teams reach out
Conditional Access has grown to dozens of policies and nobody can say which one blocked a sign-in.
AD FS servers still get patched every month for a handful of relying parties.
App registrations are full of client secrets that never expire, owned by people who left years ago.
chapter 02 · what we change
How we solve it
Conditional Access design
Hybrid identity
App registrations and workload identities
Entra ID Governance
Entra Agent ID
Moving off AD FS
chapter 03 · how it runs
Our approach
Tenant assessment
Policies in report-only mode
Hybrid identity and AD FS
Workload and agent identities
Governance and handover
chapter 04 · where you end up
What changes
Policies each have an owner and a purpose someone wrote down.
Every agent has a sponsor, scoped permissions and a Conditional Access policy for agents.
Conditional Access policy catalog with an owner, purpose and exclusions per policy
Report-only impact analysis from sign-in logs before each policy enforces
what we do
Our Microsoft Entra ID work
6 kinds of Microsoft Entra ID work, each run by engineers who have done it on live tenants.
A policy set built from Microsoft's templates, tested in report-only mode, with break-glass accounts and every exclusion documented.
Entra Connect or Entra Cloud Sync configured or rebuilt, with sync scope, source anchor and password hash sync decisions written down.
An inventory of app registrations and service principals, owners assigned, stale secrets removed, and federated credentials used where they fit.
Lifecycle workflows, access packages and access reviews connected to HR, so joiners and leavers run without tickets.
Agent identity blueprints, sponsors and owners, access packages for agents acting for users and on their own, and Conditional Access templates for risky or autonomous agents.
Federated domains converted to cloud authentication, relying parties moved to Entra ID, and the AD FS servers retired.
capability 01 / 06in production
Conditional Access design
A policy set built from Microsoft's templates, tested in report-only mode, with break-glass accounts and every exclusion documented.
Agent identity blueprints, sponsors and owners, access packages for agents acting for users and on their own, and Conditional Access templates for risky or autonomous agents.
We pieced these together from Microsoft Entra ID situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Seventy Conditional Access policies, and three nobody will touch
composite · not a client story
Beforethe situation
A tenant has grown to seventy Conditional Access policies across several reorganizations. Three exclude a group with 900 members, MFA prompts vary by app for no clear reason, and the helpdesk can't say which policy blocked a sign-in.
What we dothe work
We export every policy and a month of sign-in logs, then map each policy to the users and apps it actually hits. A smaller set built from Microsoft's templates runs in report-only mode beside the old one. When the results match expectations, groups switch over one at a time.
Afterwhere you end up
Policies each have an owner and a purpose someone wrote down. Exclusions are documented and get reviewed, and a blocked sign-in can be traced by the helpdesk to a single policy in the sign-in log.
case file 02
Copilot Studio agents on app registrations with tenant-wide mail access
composite · not a client story
Beforethe situation
Business units built Copilot Studio and custom agents on ordinary app registrations. Several hold application permissions such as Mail.ReadWrite across the tenant, their secrets never expire, and one agent creates agent identities through the automatic CreateAsManager grant.
What we dothe work
We inventory agents and their Graph permissions, assign sponsors, and move each agent to Entra Agent ID with a blueprint and an access package. For the agent that creates identities, an admin grants AgentIdentity.CreateAsManager through admin consent and we test app-only creation before enforcement.
Afterwhere you end up
Every agent has a sponsor, scoped permissions and a Conditional Access policy for agents. The November permission change passes without 403 errors in production.
We don't start a step until the last one has produced something you can check.
step 01
Tenant assessment
We export Conditional Access policies, app registrations, sign-in logs and sync settings, then map gaps and exclusions before changing anything.
step 02
Policies in report-only mode
We run new Conditional Access policies in report-only mode against real sign-ins first, so you see what they'd block before they enforce anything.
step 03
Hybrid identity and AD FS
Entra Connect or Cloud Sync set up or rebuilt, federated domains moved to cloud authentication through staged rollout, and AD FS relying parties moved app by app.
step 04
Workload and agent identities
We give service principals owners and federated credentials, and move agents onto Entra Agent ID with sponsors and access packages before the November 2026 consent change.
step 05
Governance and handover
We tie lifecycle workflows and access reviews to HR data, and write up the policies and break-glass procedures so your team can run them without us.
ai on microsoft entra id
Where AI fits on Microsoft Entra ID, and where it needs guardrails.
Microsoft Entra Agent ID is generally available, and it extends blueprints, sponsors, access packages and Conditional Access to agents. In preview there's also an MCP Server for Enterprise that answers read-only directory questions through Graph. Two things need doing. Move agents off broad app registrations, and prepare for the CreateAsManager consent change on 4 November 2026.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
Microsoft Entra IDdoes the work
Microsoft runs the MCP Server for Enterprise at mcp.svc.cloud.microsoft/enterprise. It's read-only, in preview, and it honors the user's roles and granted scopes. Log it through Graph activity logs filtered on its appId. Any write should go through Graph instead, with a scoped agent identity and approval.
Microsoft Entra Agent ID
Agent identity blueprints, sponsor lifecycle workflows, and access packages for agents (acting for a user or on their own). For us the work is moving agents off plain app registrations, assigning each one a sponsor and scoping its Graph permissions.
Conditional Access and ID Protection for Agents
Agent policies rolled out from July 2026 (MC1395007) and require Microsoft Agent 365 or Microsoft 365 E7. Check licensing first. We then build the policies from Microsoft's templates and leave them in report-only mode.
The CreateAsManager change on 4 November 2026
AgentIdentity.CreateAsManager stops being granted automatically (MC1506728). Agents that create agent identities need admin consent or they fail with a 403. We find those agents and test app-only creation before enforcement.
MCP Server for Enterprise
Microsoft's preview MCP server turns natural-language questions into read-only Graph calls on users, groups, apps and devices, and each user gets 100 calls per minute. Helpdesk and audit reporting fit it well. Turn on Graph activity logs and you can trace each call, so we do.
How Entra ID ties on-prem AD, HR and agents to Microsoft 365
Active Directory syncs into Entra ID and HR drives inbound provisioning, so Entra ID holds every workforce identity. Conditional Access then decides each sign-in to Microsoft 365, Dynamics 365, SaaS apps and Azure, while Entra Agent ID gives AI agents identities of their own.
01 · Sources
Active Directoryusers · groups · devices → Microsoft Entra ID · Connect or Cloud Sync
HR systemWorkday · SuccessFactors → Microsoft Entra ID · inbound provisioning
AI agentsCopilot Studio · custom agents → Entra Agent ID · agent identity
02 · Microsoft Entra
Microsoft Entra IDConditional Access · ID Governance → Microsoft 365 · Conditional Access→ Dynamics 365 · group membership→ SaaS apps · SAML · SCIM→ Azure resources · RBAC
What a Microsoft Entra ID engagement leaves behind
These are working documents, written against your configuration, so your team can run them without us.
inventory01
Conditional Access policy catalog with an owner, purpose and exclusions per policy
yours to keep
report02
Report-only impact analysis from sign-in logs before each policy enforces
yours to keep
inventory03
App registration inventory with owners, credential expiry and Graph permissions
yours to keep
runbook04
AD FS relying-party migration tracker with a cutover date per app
yours to keep
design05
Agent identity blueprint design with sponsors and access packages
yours to keep
tests06
Break-glass account procedure, tested and signed off
yours to keep
talent and delivery · microsoft entra id
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your Microsoft Entra ID work. The ones who've done it answer differently from the ones who've read about it.
Q1
Before you enforce a new Conditional Access policy, how will you show us who it would have locked out?
Report-only mode records what a policy would have done on real sign-ins. Skip it, and service accounts and legacy clients get locked out on a Monday morning.
Q2
Do any of our agents still depend on the automatic AgentIdentity.CreateAsManager grant, and which ones?
Microsoft stops granting it automatically from 4 November 2026. Agents that create agent identities app-only will get 403 errors unless an admin grants the permission first.
Q3
What is the plan for break-glass accounts, and who tests them?
Emergency access accounts sit outside most policies, so they need protection of their own. If nobody tests one by signing in on a schedule, its first real test will be the outage it was created for.
Q4
Do we hold the licenses that Conditional Access for Agents needs? How will you check?
It comes with Microsoft Agent 365 or Microsoft 365 E7. Build agent policies in a tenant that has neither and they may never enforce, because enforcement checks for the service plan.
Q5
How will you move AD FS relying parties without a single big-bang cutover?
Staged rollout moves groups of users to cloud authentication while AD FS still serves the rest. Claim rules on each relying party have to be rebuilt in Entra ID, and custom rules take longest.
01Is Azure AD the same as Microsoft Entra ID?
It is. Microsoft renamed Azure Active Directory to Microsoft Entra ID and nothing changed in tenants, sign-ins or APIs. We kept the page address for people still searching for Azure AD.
02What should we do before the AgentIdentity.CreateAsManager change?
First check whether any agent creates its own agent identities and relies on the automatic grant, which Microsoft says stops from 4 November 2026. For each agent that does, grant the Microsoft Graph permission through admin consent and test app-only agent identity creation before enforcement.
03Do Conditional Access policies for agents need extra licenses?
Microsoft says Conditional Access for Agents and ID Protection for Agents are included with Microsoft Agent 365 and Microsoft 365 E7. Tenants using those features without either license need to add one. Confirm the details against your own Microsoft agreement.
04Should we use Entra ID Governance or SailPoint?
It works well when most of your applications already sign in through Entra ID. If there's a big on-premises estate, or complex ERP rules, you often need a dedicated IGA platform. We check your application list and audit scope before saying which.
05Should we use Entra Connect Sync or Entra Cloud Sync?
That comes down to your forests, your custom sync rules and your writeback needs. Cloud Sync doesn't do everything Connect Sync does, and Microsoft's own comparison says so. We hold your rules up against that list before we recommend anything.
services
Related services
Projects on Microsoft Entra ID usually end up touching one of these, so they're worth a look.
