MT.1206 - Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview)
Overview
Enabled Agent Identities should show sign-in activity within the last 180 days.
An enabled Agent Identity that is no longer used can retain directory roles, OAuth permissions, and group memberships. Without active monitoring, these access rights create an unnecessary opportunity for misuse or persistence.
This check reviews interactive, delegated, and application sign-in activity. It reports enabled Agent Identities with no recorded activity during the last 180 days. It also reports an Agent Identity Blueprint when all of its child Agent Identities are inactive and the Blueprint still has a valid credential. This combination indicates that the Blueprint and its credentials may no longer be needed and should be reviewed.
Remediation action:
- Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent identities.
- Search for the reported Agent Identity by its Object ID or display name.
- Review its Sign-in logs, assigned Permissions, and owners.
- If the agent is no longer needed:
- Select Disable to prevent token exchange and authentication.
- If decommissioning is approved, follow the delete guidance to remove the agent.
- If the agent is needed on a seasonal or scheduled basis, document the business justification.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1206 |
| Severity | Medium |
| Suite | Maester |
| Category | Entra |
| PowerShell test | Test-MtEntraAgentInactive |
| Tags | Entra, Graph, LongRunning, Maester, MT.1206, Preview, Severity:Medium |
Source
- Pester test:
tests/Maester/Entra/Test-MtEntraAgentSecurity.Tests.ps1 - PowerShell source:
powershell/public/maester/entra/Test-MtEntraAgentInactive.ps1