As of this year, Copilot Studio no longer lets organizations skip identity assignment for new AI agents. Every agent now automatically receives a Microsoft Entra Agent ID, and the environment-level opt-out that used to exist is gone. The mechanism is specific: Copilot Studio adds a human owner to each agent identity as a sponsor with limited permissions, distinct from a full owner, specifically to reduce the risk that a sponsor could quietly expand an agent's access. Microsoft frames this as solving a traceability problem that predates the feature — agents used to ride on generic Azure app registrations, indistinguishable in Entra from any other application, which made it hard to tell which GUID belonged to which bot, let alone which employee was responsible for it. The rollout has moved in stages. Automatic identity creation for new agents began in March 2026, and by July the platform removed the ability to opt out at the environment level entirely — a one-way door. Older agents built on legacy app registrations aren't forced to migrate, but Microsoft is pushing self-service migration for them, with a gradual rollout of that tooling starting in late August. What this buys an organization, according to Microsoft's own documentation, is that audit and sign-in logs now attribute actions to the specific agent identity rather than a shared app registration, and that agent lifecycle — creation, permission changes, retirement — becomes visible and governable the same way human account lifecycle already is in Entra. Conditional Access policies that previously applied only to people can now apply to agent sign-ins too. This is a narrower claim than it might sound. It doesn't address what an agent is permitted to do once it has a token, and it doesn't solve cross-platform accountability — an agent built on Copilot Studio gets this treatment, but an agent assembled from open-source frameworks or hosted elsewhere does not. What it does establish is a default: inside Microsoft's own agent-building surface, the question "who owns this" now has to be answered before the agent can be published at all, not after someone asks during an incident review. The accountability gap that security teams have been describing for the past year — agents nobody can account for because nobody had to name an owner — gets closed in exactly one ecosystem, by making the previously optional mandatory. Whether this becomes the template other vendors converge on, or stays a Microsoft-specific pattern that doesn't interoperate with agents built elsewhere, is still open.