Entra Agent ID: Protect, detect, respond

This Datadog SecurityLabs post explains risks related to Microsoft Entra Agent ID blueprints and agent identities and provides actionable Protect, Detect, and Respond guidance: limit blueprint-management roles and risky permissions, review and remove high-risk agent privileges and secrets (replace with certificates or FICs), identify third-party blueprints using secret-based sign-ins, monitor for added blueprint credentials and suspicious agent activity, and disable or delete compromised agents using the Entra admin center and Microsoft Graph.