Result
Per-action approval alongside Entra
In short: keep Entra ID for sign-in and add a layer that evaluates each agent action. Entra Agent ID gives sponsors and Conditional Access for agents, but per-action human approval was not found in its material. A governance layer adds the named approver for risky calls.
Identification
Agents act for people who sign in through Entra ID, and some actions need a person's approval first. You keep Entra Agent ID for identity and add per-action approval beside it.
Field marks: what does this look like in practice?
- Copilot Studio agents or custom agents call tools beyond Microsoft 365.
- Conditional Access gates sign-in, but not a single risky action mid-session.
- Auditors ask who approved a payment, a deletion or a production change.
What should I require from a product?
- Each agent action is allowed, sent for approval or denied by policy.
- Approvals go to a named person, confirmed outside the agent's session.
- An agent cannot approve its own action.
- Agents stay within the permissions of the person they act for.
- Entra ID remains the sign-in and Conditional Access system.
- The approval record and the tool call are linked in one audit trail.
Which products fit?
Listed by fit to the requirements above, using each vendor's public material. This is not a ranking.
| Product | What it documents for this requirement | Source |
|---|---|---|
| NewCore | Allow, ask, deny; named approver with device biometrics; no self-approval; starts alongside your identity platform. | NewCore: Govern; NewCore: Identity foundation, read 2026-11-03 |
| Silverfort | Step up to a human at its MCP Gateway; integrates with Microsoft Copilot Studio. | Silverfort: AI agent security; Silverfort unveils AI agent security, read 2026-11-03 |
| Microsoft Entra Agent ID | Per-action human approval not found in public material. | What is Microsoft Entra Agent ID, read 2026-11-03 |
What is this result confused with?
- Microsoft native first: Pick that when agents stay inside Microsoft 365 and approval per action is not required.
- Per-action approval alongside Okta: Same need with Okta as the main sign-in system.
What does your identity provider already cover?
- Entra Agent ID is available to all Entra customers, with a sponsor per agent. Microsoft Entra Agent ID; What is Microsoft Entra Agent ID, read 2026-11-03
- Conditional Access applies to agents, and Identity Governance covers on-behalf-of agents. What is Microsoft Entra Agent ID, read 2026-11-03
- Per-action human approval was not found. What is Microsoft Entra Agent ID, read 2026-11-03
An agent governance layer runs alongside your identity provider, never instead of it.
Questions buyers ask
Can Conditional Access approve a single agent action?
Conditional Access applies to agents, but per-action human approval was not found in Entra Agent ID material.
Does this work with Copilot Studio?
Silverfort documents a Copilot Studio integration. NewCore's gateway applies to agent tool calls generally.
Do I lose Entra features?
No. Entra stays the identity system. The governance layer adds a decision at each tool call.