Dataverse Agent Users: Giving AI Agents Their Own Identity

September 22, 2026 | Power Platform & AI | 5 min read

Dataverse Agent Users: Giving AI Agents Their Own Identity


As AI agents move from simply answering questions to actually working with business data and performing actions, one question becomes increasingly important:

Who is the AI agent and what is it allowed to do?

While exploring the new Dataverse capabilities in the 2026 release wave, I came across an update that I found particularly interesting - creating Dataverse agent users with Microsoft Entra agent identity.

From my perspective as a Technical Product Owner working with Dynamics 365, Power Platform and AI, this is more than just another security feature. It is an important step toward treating AI agents as a proper part of an enterprise application's architecture.


What is a Dataverse Agent User?

Traditionally, when we think about Dataverse security, we think about users, teams, business units and security roles.

AI agents introduce a new type of actor.

An agent may need to read Dataverse records, update information or perform actions on behalf of users. Microsoft is introducing the ability to provision these agents as Dataverse agent users using enterprise-managed Microsoft Entra agent identities.

This means an agent can have:

  • Its own identity
  • Dedicated Dataverse security roles
  • Least-privileged access
  • Auditable actions
  • Enterprise security and compliance controls

The important point for me is simple:
The agent is no longer just "something running in the background." It can have an identity that can be managed and governed.


Why Does This Matter?

Imagine an AI agent working with project data. It may need to:

  • Read project information
  • Analyse project risks
  • Update selected project fields
  • Create follow-up actions
  • Retrieve information for a user

The easy approach would be to give the agent broad permissions.

But is that really what we want? Probably not.

Microsoft's approach is based on giving agents dedicated, least-privileged security roles according to their intended capabilities. That is an important concept as AI becomes more capable.


👉 Identity for AI Agents

One thing I particularly like about this capability is the identity model.

For a human user, we normally know: Who is the user?
For an AI agent, we should be able to ask the same question: Which agent performed this action?

With Microsoft Entra agent identity and Dataverse agent users, organizations can establish an identity-based security model for agents. This becomes especially important when multiple agents are working across the same Dataverse environment.

For example:

  • Project Status Agent → Reads project and task information
  • Risk Management Agent → Analyses risks and creates alerts
  • Approval Agent → Performs specific approval-related actions

Each agent can have its own intended responsibilities and corresponding access.


👉 Least Privilege for AI

For me, this is probably the most important part.

When we build an AI agent, there is always a temptation to give it more permissions because it makes development easier. But an AI agent with broad permissions can also have a much broader impact if something goes wrong.

The better approach is: Give the agent only the access it actually needs.

For example, if an agent only needs to read project information and identify potential risks, it shouldn't automatically have permission to modify every project record. This is where the traditional principle of least privilege becomes very relevant to AI.


👉 Security + Auditability

There is another part of this feature that I find important - traceability.

Microsoft states that identity-based role assignment and auditing of agent-driven actions can help organizations maintain traceability of data access and changes within Dataverse.

For me, this brings three important questions together:

  • Identity: Who is the agent?
  • Security: What is the agent allowed to do?
  • Audit: What did the agent actually do?

As AI agents become more autonomous, these three questions will become increasingly important.


How I See This in a Dynamics 365 / Power Platform Solution

Let's take a simple example. Suppose we have a Project Management solution built on Dataverse. We introduce an AI agent that monitors project information and helps project managers.

The agent might be allowed to:

  • Read project details
  • Read project tasks
  • Analyse project risks
  • Update specific fields
  • Create follow-up activities

But we may not want that same agent to:

  • Delete projects
  • Modify security roles
  • Access unrelated business data
  • Perform administrative operations

With a dedicated agent identity and appropriate security role, we can design the agent around its actual business responsibility. For me, this is where AI architecture and security architecture start coming together.


What This Means for Product Teams

As a Technical Product Owner, I think this also changes the questions we should ask when defining an AI feature.

Previously, we might ask: "What should the AI agent do?"

Now I think we should also ask:

  • What data should it access?
  • What actions should it perform?
  • What permissions does it really need?
  • Which actions should still require a human?
  • How will the agent be identified?
  • How will its actions be audited?

These questions should become part of the product design itself, not something we think about after development.


AI Agents Need More Than Intelligence

This is the part that interests me most. We often talk about making AI agents smarter. But as agents become capable of taking real business actions, intelligence alone is not enough.

They also need:

Identity → Permission → Governance → Auditability

An enterprise AI agent should not simply be able to perform an action. We should know which agent performed it, why it was allowed to perform it and what happened as a result.


My Takeaway

For me, the introduction of Dataverse agent users with Microsoft Entra agent identity is an important step toward making AI agents a more natural part of the enterprise application architecture.

I particularly like the direction because it connects AI, security and governance instead of treating them as separate areas.

As someone working across Dynamics 365, Power Platform and AI, I see this becoming increasingly important as we move from AI assistants that suggest actions to AI agents that can actually perform them.

The question is no longer only: "What can my AI agent do?"
It is also: "What should my AI agent be allowed to do?"


Conclusion

AI agents are becoming active participants in business applications. When they can access and modify business data, giving them the right identity and permissions becomes essential.

The new Dataverse agent user capability provides a foundation for this by allowing organizations to use enterprise-managed Microsoft Entra agent identities, dedicated least-privileged security roles and auditing of agent-driven actions.

For me, the key message is simple: AI agents should not just be intelligent - they should also be identifiable, controlled and auditable.

That is an important foundation for building responsible and enterprise-ready AI solutions on Dataverse.

```