Nobody Deprovisions the Agent When the Project Ends
November 10, 2026
Jillian, CMO— AI-assisted and reviewed prior to publication.
An AI agent identity gets created in minutes, usually by whoever is building a workflow, not by the identity team. When the project ends, the person who built it moves on, and the credential keeps working because almost nobody owns the step where it gets switched off. That gap, not agent creation, is where the real exposure sits.
Why Is Agent Offboarding Different From Employee Offboarding?
Employee offboarding has a trigger everyone recognizes: HR records a termination date, and identity governance tools disable accounts automatically. Agent offboarding has no equivalent trigger because nothing in most organizations marks an agent's "job" as finished.
A human account gets reviewed because someone notices the person is gone. An agent keeps running, keeps authenticating, and keeps holding whatever permissions it was given on day one, because its absence from a desk never happens. Microsoft's own documentation on governing agent identities in Microsoft Entra now treats this directly, extending lifecycle governance to agents the same way it already applies to employee and guest accounts, specifically because the default behavior without that extension is accumulation, not cleanup.
How Big Is the Orphaned Agent Identity Problem Right Now?
It is bigger than most security teams realize, and it is growing faster than teams can review it. Research from Entro Security found that nonhuman identities now outnumber human identities at a ratio of 144 to 1, up from 92 to 1 just one year earlier, and those identities include the service accounts, API tokens, and agent credentials that quietly accumulate behind every automation project.
The permissions attached to those identities are frequently excessive from the moment they are created. A 2025 Obsidian Security report cited in Cloud Security Alliance research found that 90% of deployed AI agents are over-permissioned relative to the actual scope of their assigned tasks. Combine broad permissions with no offboarding trigger and you get a credential that can do a lot of damage and that nobody is watching.
Dormant credentials are already a documented breach vector, not a theoretical one. Industry analysis of 2024 incidents found that 27% of cloud breaches involved misuse of dormant credentials, including orphaned and local accounts that nobody had reviewed in months. Agent identities inherit that same risk profile, except they are being created at a pace that outstrips how fast most identity teams can even inventory them.
What Federal Guidance Already Says About This
This is not a new category of problem invented by AI agents, which is useful, because it means there is already authoritative guidance on the underlying discipline. The Center for Internet Security's Control 5 on account management calls for organizations to delete or disable dormant accounts after a period of 45 days of inactivity, where supported, and to maintain an inventory that names an owner for every account. That standard predates agentic AI, but it describes exactly the gap agent identities are falling into.
CISA's own threat hunting work backs this up in practice. The agency's joint advisory on cyber hygiene gaps found at a U.S. critical infrastructure organization documented credential management weaknesses that look structurally identical to what identity researchers are now describing in agent environments: accounts with no clear owner, no review cadence, and no automatic disablement when their purpose ends. The lesson from that advisory applies directly to agent identities: an account without a documented owner and a defined lifecycle is a liability whether a human or a workflow is driving it.
Why This Falls Through the Cracks Between Teams
The honest answer is that agent offboarding sits between two teams that each assume the other is handling it. Identity and access teams think of agents as an application concern, something the platform team provisions and manages inside its own tooling. Platform and automation teams think of credential lifecycle as an identity governance concern, something that belongs to IAM. Both are partly right, and the result is that neither team puts agent deprovisioning on a recurring calendar.
This is a staffing and skills problem as much as a process problem. Review the inventory your identity team actually tracks and you will likely find:
- Service accounts and API tokens tied to projects that wrapped up months ago
- Agent credentials with standing access to data stores that the original use case no longer touches
- No documented owner for a meaningful share of non-human identities, consistent with what industry research keeps finding across enterprise environments
Closing that gap takes people who understand identity governance fundamentals and people who understand how agent platforms actually provision and retire credentials. CompTIA SecAI+ and ISACA's AAISM both address AI-specific security management, but the day-to-day administrative skill of configuring agent lifecycle policies in a platform like Microsoft 365 Copilot is a distinct, narrower competency, and it is the one most teams are currently missing.
Where a Credential Fits Into Closing the Gap
If you work in identity and access management, security operations, or IT administration, this is a visible place to build a skill employers are actively searching for. Microsoft's AB-900: Copilot and Agent Administration Fundamentals certification was built specifically around the administrative work of supporting and protecting an AI-enabled Microsoft 365 environment, including the governance tasks tied to agent lifecycle, not just agent deployment. Microsoft describes the credential as validating that you understand what is required to support and protect an AI-enabled Microsoft 365 environment, which is a different and more specific scope than general identity administration training.
That specificity matters when you are trying to show a hiring manager you can do the work, not just talk about the risk. A resume line that says you understand AI governance in the abstract reads very differently from one that says you can configure agent access reviews and disablement policies in a live tenant. If you are deciding where to start, Forge University's resources page walks through how AB-900 fits alongside identity and security credentials like SC-300, so you can see the full path rather than guessing at prerequisites.
None of this requires you to become a full-time identity architect. It requires knowing where agent identities are created, how long they should live, and who signs off on disabling them when the project that justified them is over. If you want a study plan built around exactly that scope, you can start training whenever you're ready, and work through the administration tasks that actually show up in a live tenant rather than just the exam objectives.
The organizations that get ahead of this will not be the ones that bought the best agent platform. They will be the ones where someone, by name, owns the lifecycle of every agent identity from creation to deletion, the same way account management has always worked for the humans on payroll.