Microsoft has published formal guidance in its Cloud Adoption Framework telling enterprises to stop treating AI agents as an afterthought to app security and instead build a dedicated governance layer around them. The core instruction is blunt: assign a single owner, keep one inventory, and monitor continuously — or accept that agents will sprawl the way shadow IT once did. The guidance frames agents as carrying the same organizational risk as human identities and applications, and says leaders must know which agents exist, who owns them, what they can access, and how to intervene when behavior falls outside policy. It explicitly warns against untracked or "shadow" deployments, calling them a security and cost risk, and instructs organizations to require every agent be recorded in a single organizational inventory tracking ownership, purpose, platform, and access scope. The mechanism Microsoft is pushing is Microsoft Entra Agent ID — the same identity plane used for humans and service accounts, now extended to make agents first-class identities with their own credentials, lifecycle, and audit trail. Where Agent 365 is deployed, it becomes the authoritative registry; where it isn't, Entra Agent ID fills that role. The framework also tells teams to use the platform's Agent Map and Tools page to see which MCP servers and AI tools are actually running, and to block the ones that aren't sanctioned, rather than discovering them after an incident. This is notable less for novelty than for source: it's Microsoft codifying, at the level of formal enterprise architecture guidance, something the industry has been circling for months — that an agent without a registered identity and a named owner is a liability, not a productivity feature. The guidance ties governance explicitly to existing cloud governance structures rather than inventing a parallel model, telling organizations to assign agent oversight to the same leaders already responsible for cloud governance, security, and compliance. What's missing from the guidance is any cross-organizational standard — it's Entra-centric, meaning the registry and identity model only hold within a Microsoft-anchored tenant. An agent that crosses into a partner's infrastructure still needs some other proof of who it is and who owns it. Microsoft's framework solves the inside-the-perimeter version of the identity problem; it doesn't touch the harder cross-boundary case that protocols like did:* and agent credential standards are trying to address.