MT.1210: Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview).
| ID | MT.1210 |
| Severity | High |
| Suite | Mito |
| Product | Entra ID |
| Feature | Agent identities |
| Security area | Privileged access |
| Resource type | Agent |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:AC-6(5) Least Privilege | Privileged Accounts |
| MITRE ATT&CK | T1078.004, T1098.003 |
| Reads from | Microsoft Graph |
| Lifecycle | Preview |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Agent Users should not have privileged directory roles or membership in role-assignable groups.
An Agent User is an Entra user account created specifically for an AI agent to access services that require user-context authentication (e.g. Teams, Exchange mailboxes, SharePoint sites). Because Agent Users represent non-human workloads, they should never be assigned Entra directory roles or added to role-assignable security groups.
This check inspects all Agent Users in the tenant and verifies that they do not possess direct directory role assignments or memberships in role-assignable groups.
Remediation action:
Section titled “Remediation action:”- Open the Microsoft Entra admin center and navigate to Entra ID > Users.
- Locate the reported Agent User using its Object ID or user principal name.
- Check Assigned roles and remove any directory administrative roles.
- Check Groups and remove the user from any role-assignable security groups.
- If the agent only requires access to specific mailboxes or SharePoint sites, configure direct resource-level permissions (e.g. Mailbox delegation or SharePoint site sharing) rather than tenant-wide administrator roles.
Related links
Section titled “Related links”Mito check. Author: agnivesh. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.