AI Agent Identity: What Happens When AI Becomes a User of the System?

For years, digital systems have been designed to recognize two main categories: users and applications. A person authenticates to a system and receives access based on their role, while applications and services use technical identities to communicate with one another.

AI Agents are creating a new category. They can use APIs, read documents, access data and perform actions within systems, sometimes on behalf of a user and sometimes autonomously. This introduces a new architectural question: what identity should an AI Agent use when it acts?

This is no longer just a theoretical issue. Microsoft Entra Agent ID, now generally available, introduces dedicated identities for AI Agents, designed to support their authentication, authorization and management in enterprise environments.

The user and the AI Agent are not the same identity

Consider a simple scenario. An employee asks an AI Agent to review a set of documents, retrieve information from another system and update an internal process.

The user initiated the request, but the actions within the system are being performed by the agent. If the system records only the employee’s identity, it becomes more difficult to distinguish between actions performed directly by the user and those carried out by the AI Agent on their behalf.

This is where the agent’s own identity becomes important. Microsoft defines an agent identity as the identity an AI Agent uses to authenticate to systems and access resources. This allows the system to distinguish the agent’s activity from that of users or other applications.

Acting for someone does not mean becoming that person

Not every AI Agent operates in the same way.

An interactive agent may act on behalf of an authenticated user. In this case, the user remains the subject of access, while the agent is identified as the actor performing the action on their behalf. An autonomous agent, by contrast, may operate without an active user and use its own identity and permissions.

This distinction changes how systems can be designed. Instead of reducing every action to the question “Which user did this?”, the system can retain more complete context: which user initiated the process, which AI Agent executed it and under what authorization.

Identity needs clear boundaries

Giving an AI Agent an identity does not mean giving it unlimited access.

If an agent is used to process documents, that does not automatically mean it should have access to every document in the organization. If it can use an API to retrieve information, it does not necessarily need permission to modify that information.

Identity and authorization therefore need to be designed together. In Microsoft’s model, agent identities can receive delegated access when acting on behalf of a user or their own permissions when operating autonomously. These identities can also be governed through dedicated policies and lifecycle management.

The system also needs to know who performed the action

As AI Agents begin to execute real processes, auditing becomes just as important as authentication.

In a traditional system, recording that a user modified a document may be sufficient. In a process involving an AI Agent, the system may need to retain a more complete history: who initiated the request, which agent acted, what access it used and what it changed.

Microsoft is already applying this distinction in some of its own products. For example, actions performed by the Conditional Access Optimization Agent are recorded as activities carried out by an AI Agent, making the origin of the activity distinguishable.

AI Agents are becoming actors within system architecture

For Soft & Solution Group, the development of agent identities reflects a broader shift in how systems that integrate AI will need to be designed.

If an AI Agent only suggests an answer, its identity may have little impact on the rest of the system. But once it starts accessing data, using services and performing actions, the system needs to clearly understand who the agent is, on whose behalf it is acting and how far its authority extends.

As Ermal Beqiri, founder of Soft & Solution Group, explains:

“When AI becomes an active part of a system, it is no longer enough to know which user initiated a process. The system also needs to distinguish the agent that is acting, the authorization it has received and the boundaries within which it can operate. Identity is what makes that distinction clear.”

AI Agents are gradually moving from tools that provide answers to actors capable of performing actions within digital systems. As this shift continues, digital identity will no longer belong only to people and traditional applications.

The AI Agent itself is becoming an identity that the system needs to recognize.