At RSAC 2026, Microsoft has signaled a major expansion of its identity stack to cover the "wild west" of unsanctioned AI applications and autonomous agents.
Why identity is the control plane for shadow AI
Shadow AI is the unsanctioned use of AI apps, copilots, and model APIs outside approved tooling. Employees paste code, customer records, and strategy docs into tools that never went through security review. The risk is not only data leaving the perimeter—it is that those tools gain lasting access to mail, files, and SaaS tenants with little visibility into who authorized them or what they can still reach.
Microsoft Entra’s direction at RSAC 2026 treats this as an identity problem first. Unsanctioned AI apps behave like any other OAuth client or service principal: they request scopes, store tokens, and act on behalf of users. Expanding the identity stack means discovering those relationships, constraining what they can request, and making “who can act as whom” enforceable policy rather than a spreadsheet after an incident.
Agentic security: non-human actors need human-grade controls
Autonomous agents change the threat model. A person clicks once; an agent may chain tools, spawn sub-agents, and call APIs for hours with the same credentials. If that identity is a broad user token or a shared service account, blast radius scales with the agent’s autonomy. Agentic security means treating agents as first-class principals—issued deliberately, scoped tightly, and monitored for abnormal chains of access—not as scripts that inherit a developer’s full privileges.
Practical design choices follow from that framing. Prefer short-lived, task-scoped credentials over long-lived secrets. Separate the agent’s identity from the human who launched it so you can revoke the agent without locking out the person. Require step-up or policy checks when an agent attempts high-impact actions (export, delete, privilege change) even if the original user session was trusted.
What “expanding the identity stack” should cover in practice
Covering the wild west of AI apps and agents is less about a single product toggle and more about closing gaps that classic workforce identity left open:
- Discovery of AI-related apps, connectors, and agent registrations that already hold tokens in your tenant
- Consent and admin approval paths that block broad scopes for unreviewed AI clients
- Conditional access and continuous evaluation that apply to non-interactive and agent-driven sessions, not only browser sign-ins
- Audit trails that attribute actions to a specific agent or app, not only to the human identity it borrowed
- Lifecycle controls so offboarding a user or project also retires the agents and app registrations they spawned
Teams that already run Entra for workforce SSO and MFA should map AI and agent use onto the same governance habits: least privilege, least standing access, and review cycles for high-risk grants. The goal is one policy surface for people, apps, and agents—not a parallel “AI exception” path that bypasses the stack.
How security and platform teams should respond now
Inventory first: list approved AI tools, known agent platforms, and OAuth clients with AI-related names or scopes. Then decide which can keep access, which need re-consent under stricter scopes, and which should be blocked at the identity layer until review. Pair that with developer guidance: agents get dedicated identities, secrets never live in prompts or notebooks, and production agents only receive the APIs they need for a defined job.
RSAC 2026’s signal from Microsoft is that identity vendors see unsanctioned AI and autonomous agents as core identity workload, not a side channel. Organizations that fold shadow AI discovery and agent lifecycle into Entra (or equivalent) controls will reduce surprise access paths before the next incident forces the same work under pressure.