Risky Agents

Detects identity-based risk on agents that have a Microsoft Entra Agent ID — such as sign-in spikes, unfamiliar resource access, suspicious credential usage, and directory reconnaissance — and surfaces them in a Risky Agents report that can trigger risk-based Conditional Access.