Exercise 2: Secure onboarding & identity governance

Scenario: A department submits a request to deploy an internal HR agent. The admin reviews the agent approval workflow, applies the Entra access packages and permission scopes, and configures lifecycle and expiration policies. The admin publishes the agent, and ensures it runs within approved runtime boundaries-without modifying how the agent was built.

In this exercise, you will apply an access package to a secuirty template for your organiztion's agent.

This exercise should take approximately 20 minutes to perform.

Task 1: Create an access package for agent identities

First, you need to ...

  1. [] in a new browser tab, go to https://entra.microsoft.com.

  2. [] If prompted, sign in with the admin credentials provided.

    Option Value
    Username @lab.CloudCredential(WWLWWLM365withCopilotA365HydratedStakeholderSteveM).AdministrativeUsername
    Password @lab.CloudCredential(WWLWWLM365withCopilotA365HydratedStakeholderSteveM).AdministrativePassword

    [!Alert] You will have to setup your login with the Authenticator app. Please follow the prompts on screen to do so.

  3. [] Navigate to Entra ID in the navigation menu on the left side on the screen.

  4. [] Select Groups -> New Group.

  5. [] In the New Group page, fill out the following fields:

    1. [] Group Type: Security
    2. [] Group Name: agent 365-test group
    3. [] Group description: test group for labs

  6. [] Select Create.

  7. [] On the left hand side of the navigation menu, select ID Governance (you may need to scroll down)

  8. [] Select Entitlement Management.

  9. [] On the center menu, under Catalogs, select Catalogs.

  10. [] Select the Agent 365 Governance catalog.

  11. [] Select Resources.

  12. [] Select + Add Resources

  13. [] Select + Groups and Teams.

  14. [] Search for and then select agent365-test group that was created in step 4

  15. [] Select Select, and then select Add.

  16. [] On the left menu under ID Governance, select Access Reviews.

  17. [] In the center menu under Entitlement management, select Access Packages.

  18. [] Select + New access package.

  19. [] Under the Basics tab fill out the following fields:

    1. [] Name: Agent 365 New Access Package.
    2. [] Description: Access package for lab.
    3. [] Catalog: Select Agent 365 Governance (the Catalog we modified in above) .

  20. [] Select Next: Resource roles >.

  21. [] Under the Resource roles tab, select + Groups and Teams.

    !IMAGEky37bpe0.png

  22. [] In the pop window ,select the checkbox See all Group and Team(s) not in the 'Agent 365 Governance' catalog. You must have the correct permissions to add them in this access package.

  23. [] Select the agent-365-test-group, and then select Select.

  24. [] Select + SharePoint sites.

    !IMAGEqhamjmnp.png

  25. [] In the pop window ,select the checkbox See SharePoint Site(s) not in the 'Agent 365 Governance' catalog. You must have the correct permissions to add them in this access package.

  26. [] Search for and then select Operations Department site, and then select Select.

  27. [] Back under the Resource roles tab, you should see Resource agent-365-test-group in the main grid. In the grid, select the drop down for the field Role. Select Member.

  28. [] Back under the Resource roles tab, you should see resource 'Operations Department' in the main grid. In the grid, select the drop down for the field Role. Select Operations Department Members.

  29. [] Select Next: Requests >.

  30. [] Under the field Who can get access select For users, service, principals, and agent identities in your directory.

  31. [] In the field Select specific scope select All agents.

  32. [] Under Who can request access leave the default Admin as selected.

  33. [] Scroll down to Approval and set Require approval to No.

  34. [] Select Next: Requester Information >.

  35. [] Under the Requester information tab, leave all default values and then select Next: Lifecycle.

  36. [] Under Lifecycle tab, ensure that the checkbox for Require access reviews under Access Reviews is NOT selected.

  37. [] Select Next: Rules >.

  38. [] Under the Custom extensions tab, leave all default values and then select, and then select Next: Review + create >.

  39. [] Under the Review and Create tab, select the Create.

Outcome: You have created an access package.

Task 2: Configure Conditional Access Policies

  1. [] In the left menu under Entra ID, select Conditional Access.

  2. [] In the center menu select Policies.

    !IMAGE4ey5j9nr.png

  3. [] Under Policy name, select the CA: Block High-Risk Agent Identities.

  4. [] Under Users or agents (Preview), select the link 0 users or agents (Preview) selected.

  5. [] In the dropdown for What does this policy apply to?, select Agents (Preview).

  6. [] Under Include, select All agent identities (Preview).

  7. [] Under Conditions, select the link 0 conditions selected.

  8. [] Under Agent risk (Preview), select Not configured.

  9. [] In the Agent risk (Preview) flyout, set Configure to Yes, and select the checkbox for High.

  10. [] Select Done, and then select Save.

  11. [] Under Policy name, select the CA: Block Unapproved Agent Identities.

  12. [] Under Users or agents (Preview), select the link 0 users or agents (Preview) selected.

  13. [] In the dropdown for What does this policy apply to?, select Agents (Preview).

  14. [] Under Include, select All agent identities (Preview).

  15. [] Under Conditions, select the link 0 conditions selected.

  16. [] Under Agent risk (Preview), select Not configured.

  17. [] In the Agent risk (Preview) flyout, set Configure to Yes, and select the checkbox for High.

  18. [] Select Done, and then select Save.

Outcome: You have configured conditional access policies.

Task 3: Configure Custom security attributes

  1. [] In the left menu under Entra ID, select Users, and then select All Users

  2. [] Search for and then select MOD Administrator

  3. [] Select the number next to Assigned roles.

    !IMAGE07jrn6v9.png

  4. [] Select + Add assignments

  5. [] In the dropdown for Select role, search for and then select the role Attribute Assignment Administrator

  6. [] Select Next.

  7. [] Under assignment type, select Active

  8. [] Under Enter justification, enter to access custom security attributes.

  9. [] Select Assign.

  10. [] Select + Add assignments

  11. [] In the dropdown for Select role, search for and then select the role Attribute Assignment Reader

  12. [] Select Next.

  13. [] Under assignment type, select Active

  14. [] Under Enter justification, enter to access custom security attributes.

  15. [] Select Assign.

  16. [] Select + Add assignments

  17. [] In the dropdown for Select role, search for and then select the role Attribute Definition Administrator

  18. [] Select Next.

  19. [] Under assignment type, select Active

  20. [] Under Enter justification, enter to access custom security attributes.

  21. [] Select Assign.

  22. [] Select + Add assignments

  23. [] In the dropdown for Select role, search for and then select the role Attribute Definition Reader

  24. [] Select Next.

  25. [] Under assignment type, select Active

  26. [] Under Enter justification, enter to access custom security attributes.

  27. [] Select Assign.

  28. [] Select Refresh to confirm the assignments were added.

  29. [] In the left menu under Entra ID, select Custom security attributes.

  30. [] Select the AgentGovernance security attribute.

  31. [] Select Department

  32. [] Select the ellipses … on the right and then select Edit attribute.

  33. [] Ensure Compliance is listed under Predefined values.

  34. [] Select the x at the top right of the window.

Outcome: You have configured a custom security attirbute.

Task 4: Create a new security template for Agents

  1. [] Return to the Microsoft 365 admin center browser tab.

  2. [] Select Agents, and then select Settings.

  3. [] Select Templates.

  4. [] Select + Add a new template.

  5. [] For Template name, enter HR Helper agent template.

  6. [] For Template description, enter Test template for labs.

  7. [] Select Next.

  8. [] Under the Security policies and protections page, select the following checkboxes:

    1. [] Conditional Access: ensure the CA: Block High-Risk Agent Identities, and CA: Block Unapproved Agent Identities are selected and grayed out.
    2. [] Access Packages: set the drop down to Agent 365 New Access Package, which you created in Task 1 of this exercise.
    3. [] Custom Security Attribute: set the drop down fields to Department and Compliance.

  9. [] Select Next.

  10. [] Select Save template.

  11. [] Select Finish.

Outcome: You have configured a custom security attirbute.

Task 5: Assign an agent identity to the access package

  1. [] Select Agents, and then select All agents.

  2. [] Select Requests.

    !IMAGE3zgrhcby.png

  3. [] Select the HR Helper Agent.

  4. [] Select Publish to store.

    !IMAGEn6v4thek.png

  5. [] In the Publish agent to selected users page select the following options:

    1. [] Under Select users or groups who can install the agent, select All users.
    2. [] Under Select users or groups who will have the agent pre-installed (optional), select All users.

  6. [] Select Next.

  7. [] In the Template dropdown, select HR Helper agent template

  8. [] Review all the policies in the Default section to learn more about which policies can be managed in different platforms, and then select Next.

  9. [] Select Next.

  10. [] Select Publish.

  11. [] Select Done.

Outcome: You have applied the agent identity to the access package.

Optional Task 6: Test your agent's access

  1. [] In a new browser tab connect to https://m365.cloud.microsoft/chat.

  2. [] On the left navigation pane, select …All agents.

  3. [] In the search box search for and then select the HR Helper Agent,

  4. [] Type the following prompt and select enter: What can you do for me? wait for the agent to respond and then type in any other prompt. For example, What can you tell me about Contoso Ltd.'s open positions?

Outcome: Your agent should respond with tasks it can do for you.