Entra ID AI Agent Added to Group

Goksel Atakan@gokselatakan

•updated Aug 24, 2026•16•0•30

Detects when an AI agent (agentic identity as identified by Entra ID agentType) is added to a group. This activity could represent legitimate provisioning of agent-based workflows, but if unexpected, it may indicate potential privilege escalation or persistence via group-based role assignments.