# Entra Agent ID: Protect, detect, respond

DevFeed: [Entra Agent ID: Protect, detect, respond](<https://devfeed.tech/articles/entra-agent-id-protect-detect-respond-8270.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/agent-id-protect-detect-respond/>)

Author: Katie Knowles

Published: 2026-07-06T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [Entra ID](<https://devfeed.tech/topics/entra-id.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [SIEM, Security](<https://devfeed.tech/topics/siem-security.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agents](<https://devfeed.tech/tags/agents.md>), [cloud-siem](<https://devfeed.tech/tags/cloud-siem.md>), [entra-id](<https://devfeed.tech/tags/entra-id.md>), [identity](<https://devfeed.tech/tags/identity.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This concluding article in the Agent ID series explains how administrators and security teams can protect Entra agent blueprints and identities, detect suspicious activity, and respond to compromises. It recommends limiting privileged roles and permissions, reducing reliance on secrets, reviewing third-party blueprints, monitoring agent activity, and disabling or deleting compromised identities or blueprints.

## Source excerpt

This post continues and concludes our series on Agent ID, by outlining steps that an administrator or security team can take to secure blueprints and agent identities created in their local Entra ID tenant.