Skip to content
MitoMito Docs

MT.1206: Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview).
ID MT.1206
Severity Medium
Suite Mito
Product Entra ID
Feature Agent identities
Security area AI and agents
Resource type Agent
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:AC-2(3) Account Management | Disable Accounts
MITRE ATT&CK T1078.004
Reads from Microsoft Graph
Lifecycle Preview

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Enabled Agent Identities should show sign-in activity within the last 180 days.

An enabled Agent Identity that is no longer used can retain directory roles, OAuth permissions, and group memberships. Without active monitoring, these access rights create an unnecessary opportunity for misuse or persistence.

This check reviews interactive, delegated, and application sign-in activity. It reports enabled Agent Identities with no recorded activity during the last 180 days. It also reports an Agent Identity Blueprint when all of its child Agent Identities are inactive and the Blueprint still has a valid credential. This combination indicates that the Blueprint and its credentials may no longer be needed and should be reviewed.

Remediation action:

Section titled “Remediation action:”
  1. Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent identities.
  2. Search for the reported Agent Identity by its Object ID or display name.
  3. Review its Sign-in logs, assigned Permissions, and owners.
  4. If the agent is no longer needed:
    • Select Disable to prevent token exchange and authentication.
    • If decommissioning is approved, follow the delete guidance to remove the agent.
  5. If the agent is needed on a seasonal or scheduled basis, document the business justification.
Section titled “Related links”

Mito check. Author: agnivesh. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.