● Agentic & Non-Human Identity Security · Microsoft
Raj Penchala
Securing non-human and agentic identities — where identity meets AI.
Machine identities outnumber humans 82:1 — and AI agents just added autonomy. I secure them.
Latest articles
RSSYour over-permissioned users are your over-permissioned agents
When an agent acts on behalf of a user it inherits that user's access, so your half-governed pile of human permissions becomes agent attack surface. Why agent blast radius starts upstream, with people, and how to right-size both sides of the identity ledger.
Governing a LangChain agent on Azure Container Apps with Microsoft Entra Agent ID and Agent 365
Every Microsoft Graph, Entra SDK and Agent 365 SDK call needed to give a containerized LangChain agent its own identity, access control and audit trail, in the order they have to be made, and why.
Governing a LangChain agent on AWS with Microsoft Entra Agent ID and Agent 365, without a single secret
The AWS, Microsoft Graph, Entra SDK and Agent 365 SDK calls that give an agent on Amazon ECS and Amazon Bedrock a Microsoft Entra identity, access control and an audit trail in Purview and Defender, in the order they have to be made, and why.
Agentic Defense-in-Depth: A Tri-Cloud Reference Architecture for AI Agents
Seven defense layers from network edge to data plane for agents on Azure AI Foundry, AWS Bedrock AgentCore, or GCP Vertex AI — native + best-of-breed controls, A2A and MCP protection, deployment gates, and a crosswalk to OWASP, MITRE ATLAS, NIST AI RMF, and DASF 3.0.
Your Non-Human Identities Have Owners. Half of Them Quit.
A recorded owner who left the company. A dormant identity nobody measures. A directory-role admin that reads as "scoped." Non-human identity assessment keeps mistaking a value being present for a control being satisfied — and a false green is worse than a red.
What 614 Non-Human Identities Taught Me — and the False Positive That Almost Cried Wolf
I pointed nhi-scan at a real Entra tenant with 614 non-human identities. The 80:1 ratio became a worklist — and the top finding was a false positive: 53 "long-lived secrets" that were really 1. What a real NHI scan reveals, and why context beats raw counts.
Making an NHI Scanner Production-Ready: What a 600-Identity Run Taught the Tool
Running my NHI tool against a real 600+ identity Entra tenant exposed three things unit tests missed: it didn't run on Windows, the enriched scan took 40 minutes, and it mistook managed identities for stored secrets. The fixes — including a 20x speedup — and why dogfooding matters.
What an AI Agent Must Never Be Allowed to Do
Buried in a Microsoft Graph reference is a list of permissions that cannot be granted to an AI agent identity at all. Read backwards, it's the first enforced authority model for agents — six prohibitions worth applying to every agent platform you run, not just Entra.
MCP Triage: Turning Scanner Noise Into a Six-Item To-Do List
MCP security scanners are smoke alarms that go off every time you make toast — one audit found 21 of 27 alerts were false. mcp-triage is the layer that sits on top of any scanner and sorts the noise into the handful that matter, then governs the fleet against the OWASP MCP Top 10.
Drift Detection for Agent Identities: When Reach Grows and the Tier Doesn't Move
An AI agent's reach is the one thing that can grow without anyone touching the identity — give it a new tool or connector and its blast radius expands while privilege, credential age, and owner all look unchanged. Here's why point-in-time posture scans miss it, and how to close the gap.