Microsoft Entra: New service plans for Conditional Access and ID Protection for agents

Microsoft is adding new Entra service plans—Conditional Access for Agents and ID Protection for Agents—to Microsoft Agent 365 and Microsoft 365 E7, enabling secure agent identity management. Rollout starts July 2026, with automatic enabling and no policy changes. No action required, but license review is recommended.

[What and Why]

Microsoft is adding new Microsoft Entra service plans for Conditional Access for agents and ID Protection for agents to Microsoft Agent 365 and Microsoft 365 E7. This change strengthens enterprise-ready AI by enabling organizations to apply identity protection and conditional access policies to agent scenarios using familiar Microsoft Entra capabilities.

By aligning agent identity protections with existing Entra licensing, this update helps organizations manage agents securely while reducing licensing complexity.

The new service plans are:

• Entra Conditional Access for Agents (Part number: ENTRA_CONDITIONAL_ACCESS_FOR_AGENTS)
• Entra ID Protection for Agents (Part number: ENTRA_ID_PROTECTION_FOR_AGENTS)

[Rollout Schedule]

• General Availability (Worldwide): Rollout will begin in early July 2026 and is expected to complete by early August 2026.

[Impact on Your Organization]

Who is affected

• Organizations with Microsoft Agent 365 or Microsoft 365 E7 subscriptions
• Admins managing Microsoft Entra, identity, and security configurations

Platforms/Services

• Microsoft Entra
• Microsoft Agent 365
• Microsoft 365 E7

What will happen

• Microsoft will automatically add the following new Microsoft Entra service plans:
  • Entra Conditional Access for Agents (Part number: ENTRA_CONDITIONAL_ACCESS_FOR_AGENTS)
  • Entra ID Protection for Agents (Part number: ENTRA_ID_PROTECTION_FOR_AGENTS)
• These service plans formally enable Conditional Access and ID Protection capabilities for agent scenarios within Microsoft Agent 365 and Microsoft 365 E7
• Enabled by default: The service plans will be added automatically.
• Existing Conditional Access or ID Protection policies and configurations will not change.
• Customers using Conditional Access or ID Protection for agents without Microsoft Agent 365 or Microsoft 365 E7 licensing will need the appropriate license to continue using these capabilities.

[Action Required/Recommendations]

No action is required to receive this update.

However, we recommend that you:

• Review your licensing to ensure you have Microsoft Agent 365 or Microsoft 365 E7 if you use or plan to use Conditional Access or ID Protection for agents.
• Share this update with your IT, identity, security, and licensing teams.
• Review Microsoft Entra Conditional Access and ID Protection capabilities and agent security configurations.
• Update internal documentation or helpdesk guidance as appropriate.

Learn more: Microsoft Licensing FAQ

[Compliance considerations]

No compliance considerations identified, review as appropriate for your organization.