Investigating suspicious AI workflows in Microsoft Entra Agent ID: Agent’s user account

{
  "TenantId": "855f09b2-b284-45cb-af48-6d9ee72abb2b",
  "SourceSystem": "Azure AD",
  "TimeGenerated": "2026-05-08T13:08:24.0156057Z",
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "Category": "NonInteractiveUserSignInLogs",
  "ResultType": "0",
  "ResultSignature": "SUCCESS",
  "ResultDescription": "",
  "DurationMs": "0",
  "CorrelationId": "763730e5-d671-4457-b429-fc78d823daaf",
  "ResourceGroup": "Microsoft.aadiam",
  "Identity": "Mr. Roboto",
  "Level": "",
  "Location": "US",
  "AADTenantId": "adcb5820-70a1-4272-b79c-32f2bba44ddc",
  "Agent": {
    "agentType": "agenticAppInstance",
    "parentAppId": "beddadf7-4f3b-4e9b-8443-0b0cf777446e",
    "agentSubjectType": "agentIDuser",
    "agentSubjectParentId": "8cd0a10f-0be8-413a-9bf2-f44bc568d1e4"
  },
  "AlternateSignInName": "MrRoboto4@ContosoCorp.onmicrosoft.com",
  "AppDisplayName": "Agent001",
  "AppId": "8cd0a10f-0be8-413a-9bf2-f44bc568d1e4",
  "AppliedEventListeners": null,
  "AppOwnerTenantId": "",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [],
  "AuthenticationMethodsUsed": "",
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Oauth Scope Info",
      "value": ["ChannelMessage.Send","Group.Read.All","Mail.ReadWrite","MailboxSettings.ReadWrite","openid","Team.ReadBasic.All","TeamSettings.ReadWrite.All","User.Read","User.Read.All","profile","email"]
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "singleFactorAuthentication",
  "AuthenticationRequirementPolicies": [],
  "AuthenticatorAppLocation": "",
  "AutonomousSystemNumber": "14618",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "federatedIdentityCredential",
  "ConditionalAccessAudiences": [
    "cc15fd57-2c6c-4117-a88c-83b1d56b4bbe",
    "00000002-0000-0ff1-ce00-000000000000",
    "00000003-0000-0ff1-ce00-000000000000",
    "00000002-0000-0000-c000-000000000000"
  ],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": null,
  "ConditionalAccessStatus": "notApplied",
  "CreatedDateTime": "2026-05-08T13:05:41.1244053Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "",
    "browser": "",
    "isCompliant": false,
    "isManaged": false
  },
  "FederatedCredentialId": "2b890532-58b1-46f6-adb5-7f6a7a31efa1",
  "GlobalSecureAccessIpAddress": "",
  "HomeTenantId": "adcb5820-70a1-4272-b79c-32f2bba44ddc",
  "HomeTenantName": "",
  "Id": "6a158c1f-d5e1-4ec6-8331-6cce73636d00",
  "IncomingTokenType": "none",
  "IPAddress": "51.3.97.221",
  "IsInteractive": "false",
  "IsRisky": null,
  "IsTenantRestricted": "false",
  "IsThroughGlobalSecureAccess": "false",
  "LocationDetails": {
    "city": "Ashburn",
    "state": "Virginia",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 39.043701171875,
      "longitude": -77.47419738769531
    }
  },
  "MfaDetail": "",
  "NetworkLocationDetails": {
    "networkType": "namedNetwork",
    "networkNames": [
      "USA"
    ]
  },
  "OriginalRequestId": "6a158c1f-d5e1-4ec6-8331-6cce73636d00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMs": "175",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "4e881284-c6b3-489e-b241-ec8f35c65dd6",
  "ResourceTenantId": "adcb5820-70a1-4272-b79c-32f2bba44ddc",
  "RiskDetail": "none",
  "RiskEventTypes": "[]",
  "RiskEventTypes_V2": "",
  "RiskLevelAggregated": "none",
  "RiskLevelDuringSignIn": "none",
  "RiskState": "none",
  "ServicePrincipalId": "8cd0a10f-0be8-413a-9bf2-f44bc568d1e4",
  "SessionId": "004d8baa-b221-0d98-bc8a-53e765d90db9",
  "SessionLifetimePolicies": "[]",
  "SignInEventTypes": ["nonInteractiveUser"],
  "SignInIdentifierType": "",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "none",
    "signInSessionStatusCode": 1002
  },
  "Status": {
    "errorCode": 0
  },
  "TokenIssuerName": "",
  "TokenIssuerType": "AzureAD",
  "UniqueTokenIdentifier": "H4wVauHVxk6DMWzOc2NtAA",
  "UserAgent": "Mozilla/5.0 (Macintosh; macOS 26.4.1; en-US) PowerShell/7.6.1",
  "UserDisplayName": "Mr. Roboto",
  "UserId": "5e411314-4d6a-4c6d-b8e7-fd75d22c1bdd",
  "UserPrincipalName": "mrroboto4@ContosoCorp.onmicrosoft.com",
  "UserType": "Member",
  "Type": "AADNonInteractiveUserSignInLogs"
}

Copy code