Copilot Studio Agents Built Before Microsoft Entra Agent ID Still Run on App Registrations, and Three Microsoft Learn Pages Describe Their Migration Differently, October 2026

Copilot Studio agents built before the 2026 rollout run on older identities, and Microsoft's documentation describes their migration three ways. The count of affected agents needs an owner.

An IT administrator and a business content owner review access together at a laptop. — Identity Data

Three Microsoft Learn pages describe Copilot Studio agents built before Microsoft Entra Agent ID in different ways. The Copilot Studio page last updated September 15, 2026 says agents created before the May 2026 rollout continue to use app registrations and can be migrated manually in the Power Platform admin center, with PowerShell scripts, or with Power Platform APIs. A second Copilot Studio page last updated October 13, 2026 says they will migrate automatically with no manual action, and gives no timeline. A Microsoft Entra page last updated June 15, 2026 says no automated or in-place migration path exists, that Microsoft Entra treats these service principals as standard applications and not as AI agents, and that automatic agent identity creation began March 18, 2026.

GOVERNANCE IMPLICATION

Agent-specific controls such as Conditional Access, centralized audit logging, and lifecycle management attach to agent identities, according to the Microsoft Entra page, which says legacy service principals are treated as standard applications. The three pages, dated June to October 2026, disagree on how the older population gets to agent identities: manual migration, automatic migration with no timeline, or no in-place migration at all. Documentation cannot settle which description holds in a given tenant. Observed behavior can, and an inventory comes first. An agent that predates the rollout and has no migration plan is Governance Debt that keeps accruing while the agent keeps working.

SCENARIO

Hypothetical: A health system writes a Conditional Access policy for agents and assumes it covers every Copilot Studio agent in the tenant. An audit sample includes a claims-status agent built in February that still authenticates as an app registration. The policy was written for agent identities, and the team cannot show from documentation alone whether it applies.

THE GOVERNANCE QUESTION

Which of your Copilot Studio agents still authenticate as app registrations, and which agent-specific controls actually apply to them in your tenant?

CONTROL GAP

The population of Copilot Studio agents on legacy identities is not visible from the total agent count. Separating them takes a tenant inventory, and the documentation of which controls cover them differs between pages.

PRIMARY SOURCE

Agent identities and authentication for Copilot Studio

Microsoft Learn

October 13, 2026

Read the primary source ->

Read the next intelligence note.

Back to Identity Data

FEBRUARY 19, 2026

Identity Data

Microsoft Entra Agent ID governance requires a named human sponsor for every agent identity throughout its lifecycle to prevent orphaned agent IDs

Entra Agent ID governance establishes that every agent identity must have a designated sponsor — a human owner accountable for the agent's access and lifecycle. If the sponsor leaves the organization, sponsorship transfers automatically to their manager. Lifecycle workflows notify cosponsors and managers of impending sponsorship changes.

Read note ->

<- Back to all intelligence notes