When software acts on behalf of a user, identity and authorization have always been fundamental security boundaries. AI agents make that boundary much harder to define.

An agent may read documents, call APIs, access business systems and trigger workflows, sometimes across multiple Microsoft services. If the agent inherits too much of the user's authority, one incorrect decision can have consequences far beyond a bad chatbot response.

This session explores identity and authorization for agentic applications, focusing on how to reason about agent identity, delegated permissions, least privilege, tool access and human approval when autonomous systems act on behalf of people.

We will map the identity flow from user to agent to tool and examine where traditional application permissions become insufficient. We will also look at practical patterns using Microsoft Entra and cloud services to constrain what an agent can access and what it is allowed to do.

The goal is to give developers and architects a practical security model for agents that can act without turning every autonomous workflow into an uncontrolled privileged account.