Your Dynamics 365 Security Roles Were Designed for People

Open a mature Dynamics 365 environment and look at the role catalogue. It encodes years of assumptions about how humans work. A job title. One span of responsibility. Somewhere above it, a manager who notices when something looks odd. Those assumptions held while every security principal was a person. Entra Agent ID for Dataverse removes that condition.

What Does Entra Agent ID Change?

It gives the agent a security principal of its own. Microsoft published Entra Agent ID for Dataverse in public preview in August 2026. The post calls it an extension of Microsoft Entra, with identity built for AI agents.

The mechanic is short. An admin makes a Dataverse agent user and links it to the agent’s Entra identity. That agent user becomes the security principal inside the environment. The admin then gives it a dedicated, least-privileged Dataverse security role. Microsoft’s framing is pointed. An agent should not inherit broad permissions or run under a shared identity.

Why Do Human Roles Not Fit an Agent?

Because human roles are generous on purpose. A person needs room to handle the unexpected. A credit controller’s role covers tables they touch twice a year. The role assumes judgement, fatigue and a working day. It also assumes somebody will query an odd transaction before it becomes a pattern.

An agent brings none of that. It applies the role evenly, at speed, at three in the morning, across every record that matches. Give an agent a human role and you have not granted the same access. You have granted something different.

How Should You Build an Agent Role Instead?

From the process, never from the person. Cloning a human role is fast. It is also the most common way an agent ends up with too much access. Write the agent’s job as a numbered list of steps instead. Each step names a table and an operation. Anything not on that list falls out of scope. The result is narrower than any human role in your catalogue. That is the point, not a side effect.

Why Split Read From Write?

Because the two carry different risk and different cost. Read access is cheap to grant and hard to abuse at speed. Write access is where the danger sits, and the licence cost with it. Restricted Dataverse tables need a Dynamics 365 licence to create, update or delete. That line also decides how multiplexing applies to an agent. If the agent only reads, say so in the role, and prove it in testing.

What Should the Agent Never Do Alone?

Least privilege answers what the agent can reach. It says nothing about what the agent should escalate. Write a short list of operations that always need a human decision. Anything above a value limit. A posting into a closed period. Creating a master data record. Build those as steps in the process, then confirm the role cannot route around them. A narrow role and a named reviewer are two halves of one control, not alternatives.

How Do You Test a Role Built for an Agent?

Against volume, not against examples. A human role gets tested with a handful of cases, because a person will spot the rest. An agent role has no such backstop. Run it over a real month of transactions. Then look at everything it touched, not only at what it got right. Then review it when the process changes, not at the yearly access review. A person’s role drifts when they change jobs. An agent’s role drifts when the process under it changes, and nobody thinks about identity on that day.

Frequently Asked Questions

What is Entra Agent ID for Dataverse?

An identity model that gives an AI agent its own Dataverse agent user. That user links to the agent’s Entra identity and acts as the security principal in the environment.

Is it generally available?

No. Microsoft published it in public preview in August 2026. Microsoft says preview capabilities are meant for evaluation and may be limited.

Can an agent reuse an existing security role?

It can, and that is the problem. Microsoft’s guidance is that an agent should not inherit broad permissions or run under a shared identity.

Does read access carry the same licensing weight as write?

No. Restricted Dataverse tables require a Dynamics 365 licence to create, update or delete, so write operations carry the heavier consequence.

What to Change Before the Next Agent Ships

Role design is where agent risk and agent cost are both set, and it happens long before either reaches a report. So build the role from the process. Split read from write. Name the steps that always need a person. Test against volume. Then put the review on the process calendar, not the access calendar. Entra Agent ID for Dataverse is in public preview and may change. Check how it behaves in your own environment. Confirm licensing with the partner who holds your contract before you act on any of this.

We have argued before that your security roles are now your AI control model. Entra Agent ID makes that literal. The control model now has an identity of its own to attach to. At DAX Software Solutions, role design sits inside our data governance work rather than beside it. If agents in your estate hold roles built for people, talk to our team.