# Monitor risky agents and keep agent governance current > Source: > Published: 2026-07-09 15:15:01+00:00 This article is part of a multi-part series on Microsoft Entra Agent ID governance. For the full sequence and recommended reading order, start from the [Governing AI agents with Microsoft Entra Agent ID and Agent 365](https://dev.to/stepbysteptocloud/governing-ai-agents-with-microsoft-entra-agent-id-and-agent-365-3a7g) Agent governance does not finish when inventory, custom security attributes, Conditional Access policies, access packages, and lifecycle workflows are configured. That is only the foundation. The real operating model starts after that. Agents will continue to be created. Sponsors will move roles. Access packages will expire. Some agents may become risky. Some may become unused. Some may lose ownership. If the organisation does not monitor these signals, the governance model will slowly become stale. The final stage of the agent governance journey is **continuous monitoring and operational review**. A governed agent estate should not be treated as a one-time project. It should behave more like an identity governance programme. The organisation should be able to answer these questions on an ongoing basis: `ReviewRequired` state for too long?If these questions are not reviewed periodically, the environment may drift back into unmanaged state. The monitoring layer should focus on a few practical areas instead of trying to inspect every detail manually. | Monitoring area | Why it matters | Recommended action | |---|---|---| Risky agents | Agent identities may show risky behaviour or unusual access patterns. | Review high-risk agents, block access if required, disable the agent, or move it back to `ReviewRequired` . | Sign-in logs | Shows whether agents are authenticating and accessing resources as expected. | Validate Conditional Access impact and check unexpected access behaviour. | Audit logs | Helps track changes to agent identity, ownership, sponsorship, attributes, and access assignments. | Review important changes and investigate unauthorised or unexpected updates. | Owner and sponsor gaps | Agents without accountability become governance risks. | Re-run ownership and sponsorship gap reports periodically. | Access package expiry | Agent access should not remain permanent without review. | Track expiring assignments and ensure sponsor or approver validates continued need. | Custom security attribute drift | Incorrect attribute values can lead to wrong policy targeting. | Review agents with missing, stale, or inconsistent attribute values. | Conditional Access impact | Policies may block or allow agents unexpectedly if scope is wrong. | Review report-only results and policy impact before broad enforcement. | Lifecycle workflow outcomes | Sponsor transition workflows depend on accurate user and manager data. | Verify sponsorship transfers and notifications worked as expected. | Identity Protection for agents should be treated as an operational review point. If an agent is marked as high risk, the organisation should not simply ignore the signal. The response should depend on the agent’s business criticality, access level, and sensitivity. Recommended actions include: `ReviewRequired` if the risk is unclear.The key point is that risky agents should not remain silently approved. The monitoring process becomes easier when agents have clear governance states. | Governance state | Meaning | Monitoring action | |---|---|---| Approved | Agent is classified, accountable, and allowed to operate. | Monitor normally. | ReviewRequired | Agent has missing or uncertain metadata, risk, or ownership issue. | Do not treat as production-ready until reviewed. | Rejected | Agent should not be used. | Ensure access is blocked or removed. | Orphaned | Agent has no valid owner or sponsor. | Start claim-or-retire process. | Retiring | Agent marked for removal or decommissioning. | Track until disabled or deleted. | Disabled | Agent no longer allowed to operate. | Confirm access and assignments removed. | These states should be reflected in custom security attributes or the governance tracker so that operations teams can filter and act quickly. Conditional Access policies for agents should be reviewed after deployment. The review should check whether policies are doing what they were designed to do: This is especially important because on-behalf-of agents, autonomous agents, and agent users may follow different access models. A strong review question is: Is this policy controlling the right identity subject for the right access pattern? If the answer is unclear, reassess the policy before enforcement. Access packages provide time-bound access, but they only deliver value if expiry and extension are reviewed. For agents, access package monitoring should focus on: The recommendation is simple: approved access should not become permanent access by accident. If access is still needed, extension should follow approval. If no one validates the need, access should expire. Owner and sponsor data should be reviewed periodically. Useful checks include: This connects directly with lifecycle workflows. If sponsor transition workflows run, the organisation should still validate whether the new sponsor is appropriate. Automatic transfer can help continuity, but it should not replace business accountability review. Custom security attributes are only useful if they remain accurate. Common drift examples: `Approved` but sponsor missing.`Prod` but actually used for testing.`Low` sensitivity but now accesses confidential data.`ReviewRequired` after approval completed.`OwnershipStatus` not updated.`Active` .Build a simple periodic review around these mismatches. The goal is not perfect metadata. The goal is trusted enough metadata to drive policy decisions safely. The cadence can vary by organisation size and risk, but the operating model should include recurring checks. | Cadence | Review item | |---|---| Daily or frequent | High-risk agents, blocked access events, critical policy failures. | Weekly | New agents, agents in `ReviewRequired` , owner or sponsor gaps, report-only CA impact. | Monthly | Access package expiry, sponsor validity, orphaned agents, attribute drift. | Quarterly | Overall agent governance posture, policy effectiveness, exception review, retired agent cleanup. | For large environments, this should be report-driven and automated where possible. For smaller environments, a lightweight review process may be enough. A mature agent governance monitoring model should show: The complete governance journey should now look like this: Monitoring is what keeps agent governance alive. Inventory creates visibility. Custom security attributes create structure. Conditional Access and access packages create control. Lifecycle workflows maintain accountability. Monitoring ensures the model does not drift over time. For AI agents, the goal is not just to approve access once. The goal is to continuously confirm that each agent is still known, accountable, justified, correctly classified, and operating within policy.