AI Agents and Admin Accounts: A Readiness Check

What Most "AI for MSPs" Pages Leave Out

Most of what ranks for AI for MSPs is about what AI can do for you: triage tickets, write scripts, summarise calls, find upsell. Very little covers what an AI agent can do to a client once it has admin rights, which is the question an MSP has to answer before switching one on.

The difference matters because an assistant that drafts a reply reads data, while an agent that resets a password, changes a group or runs a script on an endpoint acts with whatever privileges you gave it. Once it can act, it belongs in the same conversation as your technicians' admin accounts.

Why an AI Agent Is a Privileged Identity

OWASP's Top 10 for Agentic Applications (December 2025) puts identity at the centre. Three of its ten risks are the ones an MSP should read first:

ASI03, Identity and Privilege Abuse: agents whose "leaked credentials let them operate far beyond their intended scope."
ASI02, Tool Misuse: agents that "bent legitimate tools into destructive outputs."
ASI09, Human-Agent Trust Exploitation: "polished explanations misled human operators into approving harmful actions."

NIST's National Cybersecurity Center of Excellence has opened a project on software and AI agent identity and authorization and is taking comments on a rolling basis. There is no finished standard yet, which is why the questions below are written to work with any vendor.

Two Incidents That Show the Risk

Neither incident below involved an MSP's own AI agent. Both show what happens when an identity that isn't a person can read or change more than its job needs.

EchoLeak, Microsoft 365 Copilot, June 2025. Microsoft disclosed CVE-2025-32711, "AI command injection in M365 Copilot" that let an unauthorized attacker "disclose information over a network", and rated it 9.3 (Critical). Microsoft fixed it on its side. The lesson for an MSP: whatever an AI assistant can read, a crafted prompt can try to get it to repeat.
ConnectWise Cloud Backup app, October 2026. This wasn't AI, but it's the same identity problem. Huntress confirmed unauthorized sign-ins in more than 160 Microsoft 365 tenants using a vendor app's credential. In about 50 tenants it watched, the vendor's apps gave themselves admin roles, and in one the Teams app made itself Global Administrator. Our write-up of that incident covers what to check. An AI agent with standing directory write rights in every client tenant has the same blast radius.

The Agent Readiness Check: Seven Questions

Ask these of any AI agent before it gets admin rights in a client environment, whether it's built into your RMM, your PSA, a service desk tool or a PAM platform. Each question has what good looks like and what to ask the vendor.

Identity. The agent has its own named identity in each client, not a shared technician account or an integration key that every client uses. Ask: "What identity does the agent act as in my client's tenant, and is it separate per client?"
Standing privilege. The agent holds no admin rights while it isn't doing an approved task. Ask: "What can the agent do in a client tenant right now, with nobody asking it to do anything?"
Credential custody. The agent never sees or stores a reusable admin password or secret; the platform uses the credential on its behalf. Ask: "Can the agent read a credential, or only request an action that uses one?"
Approval. Routine actions can run by rule, and sensitive ones (admin password resets, role changes, anything on a domain controller) wait for a named person. Ask: "Which actions can I require a human to approve, and can I set that per client?"
Logging. Every action records what the agent did, in which tenant, at whose request and who approved it. Ask: "Can I show a client every action the agent took in their environment last month?"
Model location. You know which model processes prompts that contain client data, who operates it, and whether a third-party model provider sees those prompts. Ask: "Which model provider sees my clients' data, and under what terms?"
Blast radius. A compromise of the agent, or of its connection to one client, reaches one client, not all of them. Ask: "If the agent's access to one client is compromised, what can the attacker reach at my other clients?"

A vendor that can't answer 2, 3 and 7 plainly is asking you to give an untested identity standing admin rights across your client base.

What Microsoft Already Gives You

Microsoft now treats agents as identities in Entra. Microsoft Entra Agent ID "extends Microsoft Entra capabilities to AI agents", including Conditional Access for agents. ID Governance for agents adds a human sponsor for each agent, access packages that can grant groups, API permissions and Entra roles, and end dates: if nobody extends it, "the access package assignment automatically expires on its end date, and the agent identity loses access."

Where it stops:

It governs agents that have an agent identity in that tenant. An AI feature in a third-party tool that acts through the tool's own integration or a technician's session isn't covered unless the vendor built it on Agent ID. Ask.
It's per tenant. At an MSP that means setting it up, and paying for it, in each client.
It's licensed: Microsoft says governing agent identities needs Microsoft 365 E7, or a Microsoft Agent 365 license with at least Entra P1 or Microsoft 365 E3.
It covers Microsoft cloud identities. Local admin on endpoints and on-premises Active Directory are outside it, as with Entra PIM.

What Changes at an MSP

One AI agent connected to 40 client tenants is the same risk as one technician with standing Global Administrator in all 40: one compromise, every client. Three things follow.

Connect per client. Give the agent a separate connection in each client, so a compromise in one doesn't carry to the rest.
Write approval rules into each client's runbook. A regulated client may want every admin action approved; a small office may accept rules for password resets. Decide per client, in advance.
Name a sponsor. Someone at the MSP owns each agent: what it can do, which clients it reaches, and when it's switched off.

Where This Sits in the PAM Journey

An AI agent is one more identity for the eight phases to cover. Four of them do most of the work:

Phase 1, discover: include identities used by AI agents in the inventory for each client, next to service accounts and enterprise apps.
Phase 3, vault: credentials the agent's actions depend on live in a vault the agent can't read.
Phase 6, just-in-time access: the agent's rights exist only for the approved task. The JIT admin access guide covers the native options for people; the same rule applies to agents.
Phase 7, audit: every agent action is logged and attributable, so you can answer a client's question in one query.

How CyberQP Handles It

Panthera discovers the identities used by AI agents in each connected client, along with service accounts and enterprise apps. Panthera's own AI runs on a model that is ours, fine-tuned and hosted on our own infrastructure, and nothing privileged goes to a public model provider. The agent never holds a credential. Every agent action is checked against your roles and approvals, logged, and can require human approval. The AI is included in the licence, with no per-token charge.

What Done Looks Like

Every AI agent with access to a client environment has a named identity, a named sponsor and a list of the clients it reaches.
No agent holds standing admin rights or a readable admin credential.
Sensitive agent actions wait for a person, by rules written per client.
You can show any client what an agent did in their environment, when and on whose approval.
You know which model provider, if any, sees your clients' data.

Frequently Asked Questions

Is it safe to let an AI agent run admin tasks in client Microsoft 365 tenants?

Only with the same controls you'd put on a technician: its own identity per client, no standing admin rights, a credential it can't read, human approval for sensitive actions, and a full log. Without those, it's a standing admin account that can be talked into things.

Should an AI agent have Global Administrator?

Not as a standing assignment. Grant the narrowest role the task needs, for the length of the task, and require approval for anything that touches admin accounts or roles.

Does Microsoft Entra Agent ID solve this?

For agents built on it, in the tenants where you set it up and license it, it covers identity, Conditional Access, sponsors and expiring access. It doesn't cover AI features in third-party tools that act through their own integrations, local admin on endpoints or on-premises Active Directory.

Where does client data go when an AI tool works a ticket?

To whichever model processes the prompt. Ask every vendor which model provider that is, who operates it and whether prompts containing client data are kept or used for training.

Sources (checked 9 November 2026): OWASP GenAI Security Project, Top 10 for Agentic Applications (9 Dec 2025); NIST NCCoE, Software and AI Agent Identity and Authorization; Microsoft Security Response Center, CVE-2025-32711 (11 Jun 2025); Huntress, Vendor credential enables unauthorized access (16–17 Oct 2026); Microsoft Learn, What is Microsoft Entra Agent ID; Microsoft Learn, ID Governance for agent identities.