Your AI Agent Just Got a Mailbox: Onboard It Like an Employee, Offboard It Like One Too

On 15 October 2026 Microsoft announced account-based agents for Copilot Studio, rolling out through its Frontier programme. NeoTeo’s report says a published agent gets its own Microsoft Entra ID identity, a mailbox and a Microsoft 365 presence. It can start work from an incoming email or a schedule, with no one typing a prompt.

That describes an employee-shaped object. Most IT teams have a joiner-mover-leaver (JML) process for people and none for this.

What Microsoft shipped

The details below come from that report, which attributes them to Microsoft’s announcement and preview documentation. Read Microsoft’s own pages before you act on any of them.

• Triggers. A configured external signal, such as an email, or a set cadence starts an agent cycle.
• Shared memory. Memory is shared among the people who work with the agent. The preview has “no user privacy boundary for that memory and no option to opt out”.
• Guardrails. The agent cannot respond to people outside the tenant, cannot read documents protected by labels such as “Confidential”, and limits email replies to conversations within the tenant of up to 250 people.
• Licensing. Makers need Microsoft 365 E5 with the Agent 365 add-on, or E7. Each published agent account also needs a Frontier for AI Teammates licence. Usage-based billing may consume Copilot Credits.

The identity does not authorise everything. The report notes that the account “does not automatically authorize every connected tool”, so permissions are configured per tool.

Why “it’s just a bot” is the wrong model

An identity with a mailbox and triggers is a service account that anyone can reach by sending it an email. Its inbox is an input channel. Anything the agent will read, an attacker can write.

The identity layer is better prepared than most teams assume. Microsoft Learn’s page on Entra Agent IDs says Copilot Studio creates an Entra Agent ID for each new agent, with audit logging, lifecycle management and integration with Entra ID Governance. Connector permissions appear as API permissions on the identity, and Conditional Access can target them. That page covers Copilot Studio agents in general, not the preview account-based type, so confirm how the preview behaves in your tenant.

The tooling exists. What is usually missing is the process around it.

Joiner: approve, own, scope

Before an agent account is created, require four things:

1. A named human owner. One person is accountable for what the agent does, and a team alias is not enough.
2. A purpose statement. One sentence on the task it performs and the data it needs.
3. Scoped tool permissions. Grant each connector only what the purpose requires. The Learn page shows these as API permissions, so you can review them in the Entra admin center.
4. A recorded licence and cost owner. Agent accounts carry licence and credit costs that someone must budget for.

Record all four in the same register you use for service accounts. ISO 27001:2022 Annex A control 5.16 (identity management) and 5.18 (access rights) apply to non-human identities as much as to staff.

Mover and reviewer: check access on a schedule

Agents drift. Someone adds a connector, widens a scope or changes the trigger. Run a quarterly access review for each agent account that asks:

• Does the owner still work here, and still own this agent?
• Does the purpose statement still match what the agent does?
• Does every connector permission still have a reason?
• What did the agent do last quarter, and on whose behalf?

Entra’s sign-in and audit logs answer the last question for authentication. Add the agent’s own action history to the same review pack, so you can answer an auditor with evidence.

Leaver: set an end date and define what is left behind

Every agent account gets an expiry date at creation, extended only by its owner. When the date arrives, or the owner leaves, disable the account first and decide about its data second.

Learn says deleting an agent in Copilot Studio also deletes its Entra Agent ID. It does not tell you what happens to the mailbox or to shared memory. The report adds that turning memory off does not delete stored memories. Write down your own answer before you enable the feature: who exports what, who deletes it, and when.

The POPIA question

Shared memory with no privacy boundary is a data protection question as well as a security one. Three sections of the Protection of Personal Information Act apply:

• Section 13 requires collection for a specific, lawful purpose. Your agent’s purpose statement is where that purpose gets documented.
• Section 14 limits retention. Memory that accumulates facts about the people an agent works with needs a retention rule and a deletion route.
• Section 19 requires appropriate security safeguards, which covers who can read the agent’s memory.

Answer these before the feature is switched on, and run a POPIA impact assessment if the agent will handle personal information about customers or staff.

The tool layer still matters

An agent’s tools are where its authority becomes action. A study summarised by GBHackers (ToFu, posted to arXiv on 9 October) found 253 verified vulnerabilities in 118 open-source MCP servers covering 343 tools, from a corpus of 273 servers. The vulnerability classes include path traversal, log injection, data exfiltration and command bypass.

The root cause is that tools trust the arguments the model hands them. As the report puts it, “a correctly formatted invocation does not guarantee that its arguments are safe or authorized”, and tool descriptions often do not match the code. The reported mitigation is to enforce documented restrictions at execution time and treat schema-valid arguments as untrusted input. That means limits belong in the tool, not in the prompt.

For the identity programme, this means each MCP server your agents call is a privileged proxy. Put it in the same register, give it an owner, and include it in the access review.

FAQ

Do account-based agents need their own JML process?

Yes. They hold an identity, a mailbox and standing access. Your existing service-account process is the right starting point.

Is the preview safe to enable for a pilot?

Treat it as you would any preview that stores shared memory with no privacy boundary. Restrict it to a small group, avoid personal information and keep the opt-in with the administrator.

Who should own an agent?

A named person in the business unit that benefits from it. IT owns the platform and the review process, and the business owns the agent.

The report says an administrator has to activate the agent template and account setting, so the decision to allow these accounts sits with IT. Write the owner, the purpose and the end date requirements before you flip that switch, so the first agent account arrives with a process waiting.

Sources: NeoTeo, 16 October 2026 ( https://www.neoteo.com/en/microsoft-announces-persistent-agents-for-copilot-studio); GBHackers, 13 October 2026 ( https://gbhackers.com/researchers-discover-253-security-vulnerabilities/); Microsoft Learn, Manage Entra Agent IDs ( https://learn.microsoft.com/microsoft-copilot-studio/admin-use-entra-agent-identities) . Account-based agent details are as reported in secondary coverage; Microsoft’s own announcement was not reviewed. This is not legal advice.