AI agents: who answers for each one?
Agents now sign in, hold credentials and reach data like any other identity. Microsoft Entra Agent ID gives each one a sponsor and an owner. Assay checks that those people still exist, still work at your company, and that the agent's access matches what was approved.
The agent register
One row per agent, with a clear state in every column:
| Column | What Assay checks |
|---|---|
| Sponsor | Is there a sponsor, and do they still work here according to your identity governance platform? |
| Owner | Is there an owner who is still active? |
| Credentials | Secrets and certificates on the agent's blueprint: expired, expiring soon, or usable from other organisations' tenants |
| Access | Permissions, admin roles and group memberships, including what the blueprint passes on to its agents |
| Known to governance | Was this access approved in your identity governance platform? |
| Activity and risk | When the agent last signed in, and whether Microsoft flags it as risky |
| Lifecycle | Agents acting for someone who has left |
- Sponsor
- Is there a sponsor, and do they still work here according to your identity governance platform?
- Owner
- Is there an owner who is still active?
- Credentials
- Secrets and certificates on the agent's blueprint: expired, expiring soon, or usable from other organisations' tenants
- Access
- Permissions, admin roles and group memberships, including what the blueprint passes on to its agents
- Known to governance
- Was this access approved in your identity governance platform?
- Activity and risk
- When the agent last signed in, and whether Microsoft flags it as risky
- Lifecycle
- Agents acting for someone who has left
A cell is green only when the check ran and passed. When Assay can't confirm something, the cell says "not checked" and why. It never says "fine" by default.
What it finds
- Sponsor has left. Entra ID still names a sponsor who has left according to your identity governance platform, even when the account is still enabled.
- Nobody left to look after it. Every owner of the agent has left the company or had their account disabled, so nobody is responsible for it day to day.
- Too much access. An agent with an admin role or application permissions to mail, files or the directory.
- Shadow agents. Ordinary apps that behave like agents but are not registered as one.
- Blueprints that pass on everything. A blueprint that gives all its agents every permission it holds.
Works when your governance tool only manages Active Directory
If your identity governance platform provisions Active Directory and Active Directory syncs to Entra ID, Assay still matches sponsors to people by employee ID or email. A sponsor it can't match shows as "not checked", never as "fine".