core-concept · Operating model · maturing · Reviewed
Continuous recertification & retirement
Scheduled and event-driven reassessment that renews, restricts, transfers, suspends, or ends an agent’s authority—and verifiably revokes its identities, credentials, tools, dependencies, and retained data at retirement.
Definition
Scheduled and event-driven reassessment that renews, restricts, transfers, suspends, or ends an agent’s authority—and verifiably revokes its identities, credentials, tools, dependencies, and retained data at retirement. Production authorization decays as owners, models, data, tools, and operating conditions change.
Access recertification is established; complete agent product-lifecycle governance is still developing.
Why it matters
Production authorization decays as owners, models, data, tools, and operating conditions change.
The operating shift is from “One-time launch approval” to “Expiring, continuously renewed authority.”
System anatomy
- Practice 1
- Require an owner heartbeat and authorization expiry
- Practice 2
- Trigger reassessment after change, drift, incident, or organizational transfer
- Practice 3
- Prove credential revocation, dependency removal, and data disposition
Important distinctions
- One-time launch approval
- This concept moves the engineering system toward expiring, continuously renewed authority.
Implementation signals
- Require an owner heartbeat and authorization expiry
- Trigger reassessment after change, drift, incident, or organizational transfer
- Prove credential revocation, dependency removal, and data disposition
Failure modes
- Dormant agents retaining valid credentials and integrations
- Ownership transfer assumed rather than explicitly authorized
Sources and further study
- Microsoft Agentic Center of Excellence — Manage the agent lifecycle
A product-lifecycle model spanning intake, deployment, monitoring, improvement, ownership, evaluation, and deliberate retirement.
Use in this library: Official guidance. Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.
guidance · guidance · Published 2026-07-14 - Microsoft Entra ID Governance — Governing Agent Identities
An identity-governance model for agent sponsors, access packages, ownership continuity, lifecycle workflows, and enable or disable decisions.
Use in this library: Official guidance. Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.
guidance · guidance · Published 2026-06-16 - Microsoft Entra Agent ID — Administrative relationships in Microsoft Entra Agent ID
Separates technical ownership from business sponsorship and assigns sponsors lifecycle, access-review, and incident-response decisions.
Use in this library: Official guidance. Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.
guidance · guidance · Published 2026-04-08