Identity

Essential Eight won't ask about your clients' AI agents

Your clients are connecting AI tools to their mailboxes and drives faster than anyone tracks. A quarterly agent access review an MSP can trial next month.

By Edwin Ashdown7 minute read

In this post 7 sections
  1. Eight places access hides, in five consoles
  2. The native tools, and what they cost
  3. Where Essential Eight and CIS stop
  4. The one-page scope
  5. Why this matters more each quarter
  6. Where this goes next
  7. Sources

One line in Microsoft’s documentation explains why this review has to exist. When an admin tightens who can consent to apps in Entra, “Existing consent grants remain unchanged, and users continue to have access based on the permissions previously granted.”

So the meeting-notes tool a client’s office manager connected to their mailbox last year keeps its access after you lock consent down this year. So does the AI assistant someone in sales linked to the shared drive. Nothing in your hardening work goes back and finds them. A review does.

If you run IT or security for small and mid-sized businesses on Microsoft 365 or Google Workspace, this is a recurring piece of work you can package now. Here is the scope, what the native tools need, and where the frameworks you already sell against stop. Licences and admin paths below are as at October 2026, and several changed this year.

Eight places access hides, in five consoles

In a typical small business tenant, an AI tool or agent can hold access in at least eight places.

On the Microsoft side:

  1. Entra enterprise apps and their consent grants. The default for a new tenant is now a Microsoft-managed policy that blocks users from consenting to mail, chat, calendar and tenant-wide file and site permissions, and lets them consent to many others. Grants made before the policy changed are still there.
  2. The Agent Registry in the Microsoft 365 admin centre, which lists agents, flags “Agents without owners”, and exports a CSV. Microsoft notes shared agents “can become ownerless when you delete the user who created them”.
  3. Copilot Studio and Agent Builder agents and flows, in the Power Platform inventory. Admins on Microsoft’s community forums report they can’t stop users building agents in Agent Builder even after removing Copilot Studio licences.
  4. Copilot connectors, including MCP-based ones that Microsoft says gain write actions from early October 2026.
  5. Teams apps, where team owners can grant resource-specific permissions themselves. An Entra-only review misses those.
  6. Personal Copilot on work documents, which is on unless switched off in Cloud Policy.

On the Google side:

  1. Third-party app access. The default setting is to “Allow users to access any third-party apps”, and the Accessed apps list shows what has.
  2. Gemini and domain-wide delegation. Workspace apps in Gemini are “on by default”, and domain-wide delegation lets an app reach users’ data “bypassing end user consent”.

That is the Entra admin centre, the Microsoft 365 admin centre, the Power Platform admin centre, the Teams admin centre and the Google Admin console, plus Google Cloud if a client uses domain-wide delegation.

The native tools, and what they cost

You can list Entra consent grants with an admin role and no extra licence. Grants that users approved can’t be revoked in the portal, though, only through Graph or PowerShell, and revoking one “doesn’t stop users from re-consenting” unless the consent setting changes too.

The tools that do this well cost more. Entra access reviews need ID Governance or the Entra Suite, and they review which people can reach an app, which is different from the permissions the app itself holds. Defender for Cloud Apps app governance gives the best single view of OAuth apps across Microsoft 365, Google Workspace and Salesforce, and it needs a Defender for Cloud Apps licence that isn’t in Business Premium on its own. Risk signals in the Agent Registry need Agent 365, which Microsoft lists at US$15 per user a month standalone.

On Google, the OAuth audit log is searchable on every edition. The investigation tool is in Enterprise and some other tiers, so Business Starter, Standard and Plus clients get the list and the log, without the tool.

So most Business Premium and Workspace Business clients have lists and logs and no review. That gap is the service.

Microsoft’s own threat report this year describes the problem in plain terms: agents “acquire access over time that’s rarely revoked”, and “without a human accountable for each agent’s access (a sponsor), there’s no one to contact when something goes wrong.”

Where Essential Eight and CIS stop

The Essential Eight maturity model, the November 2023 version still current, doesn’t mention OAuth, consent, connected apps or AI. Application control is about executables on workstations. The closest fit is Restrict administrative privileges, which at maturity level two disables privileged access “after 12 months unless revalidated”, and that only applies if you treat an app with tenant-wide permissions as privileged access. That is your reading, so don’t present this review as an Essential Eight control. ASD itself says organisations should add measures beyond the model “where it is warranted by their environment”. Its Blueprint for Secure Cloud also sets Entra user consent to “Do not allow user consent”, which is stricter than Microsoft’s default and worth showing a client.

The small business AI guide that New Zealand’s NCSC published with ASD and COSBOA in January covers what staff paste into AI tools and what vendors do with it. It says nothing about what those tools are connected to.

CIS Controls give you a firmer anchor. Safeguard 5.5 asks for an inventory of service accounts that contains “department owner, review date, and purpose”, with reviews “on a recurring schedule at a minimum quarterly”. An agent or connected app with standing access is a service account in all but name. Safeguard 2.1, the software inventory, applies too. One caution: 5.5 sits in Implementation Group 2, not the baseline group most small clients start with.

The one-page scope

This uses only the tools your clients already have, so you can trial it with one client without buying anything. Time it.

Inputs. Read access to each console (Global Reader on Microsoft, an admin with audit access on Google), someone at the client who can say yes or no to each grant, and last quarter’s report.

Steps.

  1. Export Entra apps with their delegated and application permissions through Graph. Flag anything new, anything that can read or send mail, read or write files, or read chat, and every application permission.
  2. Record the consent settings and compare them with ASD’s “Do not allow user consent” baseline.
  3. Export the Agent Registry and list ownerless and unmanaged agents.
  4. Export the Power Platform inventory, including which agents and flows use which connectors, and note anything owned by a leaver.
  5. Check Teams apps with resource-specific permissions, Copilot connectors, and the personal Copilot setting.
  6. In Google, review Accessed apps, the setting for unconfigured apps, domain-wide delegation clients and scopes, the quarter’s OAuth log, and the Gemini Workspace apps setting.
  7. For every grant and agent, record owner, purpose, scopes, who consented and when, and a decision: keep, narrow, revoke, or keep with a review date.
  8. The client signs off the decisions, then you revoke.

The client report. One page: counts against last quarter, what’s new and who approved it, the high-impact items and the decision on each, settings that have drifted, and the CIS 5.5 and 2.1 evidence it provides.

I found no published price for this exact service. It is the same shape of work as the quarterly review line in a vCISO retainer.

Why this matters more each quarter

Consent prompts are already an attack route. Proofpoint documented a 2025 campaign that used fake Microsoft OAuth apps impersonating brands like Adobe and DocuSign as a lure into credential phishing, affecting nearly 3,000 accounts across more than 900 Microsoft 365 environments. Kaseya’s June 2026 data from over 50,000 small business environments found non-human service principal logins behind 20 per cent of critical security alerts. And the agents your clients connect this year will hold their access next year unless someone looks.

I wrote about why agents shouldn’t hold the keys themselves, and about identity as the control plane for agents. The review is how you find out where that hasn’t happened yet.

Where this goes next

The review finds standing access after the fact. The next step is agents that only ever get access through a layer you manage for the client: each agent with its own identity and only what it was granted, risky actions held for a person, and every action on a record you can put in the quarterly report.

That is what AgentValet does, and the partners page explains how it works for MSPs.

Sources

Filed under

  • msp
  • identity
  • microsoft-365
  • google-workspace

Give your agent only the access it needs

Grant each agent a narrow set of actions, hold the risky ones for your approval, and keep a signed record of every call.

Protect my first agentWatch your agent’s calls live, no signup
All posts

Identity

DCR is deprecated. Your identity provider was right

Your IdP won't do open Dynamic Client Registration and your MCP client says it must. The spec has moved your way. Four routes, and what each one costs.

7 min read

Identity

Your agents have no off switch

Disabling an agent stops new tokens. The ones it already holds keep working. How to run a kill-switch drill and measure time-to-revocation, on open source, Entra or AgentValet.

13 min read