Agent 365: an approval lifecycle for agents in Entra Agent ID
Conditional Access for agents only has one grant: Block, so the pattern is an allow-list driven by a custom security attribute. Microsoft documents the mechanism. What I couldn’t find was the lifecycle around it: who moves an agent from New to IT_Approved, what takes it back, and how it relates to the other approvals and lifecycle features in Entra and Agent 365. Here’s the map I drew, the approval lifecycle behind the attribute, and how I built it in my lab.