Unauthorized AI Agents: How to Control Agents in Microsoft 365

On October 22, Axios reported that major U.S. banks are detecting unvetted third-party AI agents inside customer accounts, and that some agents attempted actions that appeared independent of what the customer asked. Banks are responding by blocking or restricting outside agents. The same problem exists inside your company: AI agents and AI-powered apps can reach your mail, files and Teams through an OAuth consent prompt or a shared sign-in, and most small and mid-sized tenants have never looked.

What actually happened at the banks

Here is what is confirmed, and what is not, as of October 22, 2026:

• Reported: Axios, citing unnamed sources, said several of the largest U.S. banks found unauthorized AI agents in customer accounts, and some agents also contacted bank call centers. Reuters said it could not immediately verify the report.
• How agents get in: mostly by customers handing their own username and password to an AI tool, which bank terms prohibit. Banks say they often cannot tell a person from an agent, or an approved agent from a rogue one.
• What banks are doing: several large banks have said they block or restrict third-party agents from logging in or moving money. Wells Fargo has published an updated online access agreement, effective November 24, 2026, that treats requests made through third-party AI agents as the customer's own and reserves the right to block AI tools.
• Not established: we found no documented case of an AI agent moving money without authorization. The OCC has not issued agent-specific guidance; the Comptroller said banks have been preparing for months.

The lesson for any business is the same one the banks are learning: an AI agent acting with a person's credentials looks like that person. The fix is to give agents their own, visible, limited identity, and to stop them from borrowing a human's.

How AI agents get into a Microsoft 365 tenant

Step 1: Restrict user consent to apps

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
2. Go to Entra ID > Enterprise apps > Consent and permissions > User consent settings.
3. Choose Allow user consent for apps from verified publishers, for selected permissions (Microsoft's recommended setting), or Do not allow user consent if you want every app reviewed.
4. Save. The change applies to future consents only; existing grants stay until you remove them in Step 3.

To set the recommended policy with Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"
# Keep any existing managePermissionGrantsForOwnedResource.* entries in this list
Update-MgPolicyAuthorizationPolicy -BodyParameter @{
  permissionGrantPolicyIdsAssignedToDefaultUserRole = @("ManagePermissionGrantsForSelf.microsoft-user-default-low")
}

Run Get-MgPolicyAuthorizationPolicy first and carry over any existing managePermissionGrantsForOwnedResource values, or the update removes them.

Step 2: Turn on the admin consent workflow

Blocking consent without a request path pushes staff toward workarounds such as sharing passwords. Give them a way to ask.

1. Go to Entra ID > Enterprise apps > Consent and permissions > Admin consent settings.
2. Set Users can request admin consent to apps they are unable to consent to to Yes.
3. Pick reviewers (users, groups or roles), turn on email notifications and reminders, and set how many days a request stays open.
4. Save. Microsoft notes it can take up to an hour to take effect.

Step 3: Find and revoke risky app and agent grants

In the portal, open Entra ID > Enterprise apps > All applications, select the app, then Permissions. Admin-consented permissions can be revoked from the Admin consent tab. User-consented permissions cannot be revoked in the portal; use PowerShell.

To list and remove every delegated grant and app role assignment for one app (needs Cloud Application Administrator or higher):

Connect-MgGraph -Scopes "Application.ReadWrite.All","DelegatedPermissionGrant.ReadWrite.All","AppRoleAssignment.ReadWrite.All"
$sp = Get-MgServicePrincipal -ServicePrincipalId "<object-id>"

# Delegated (user or admin consented) permissions
Get-MgOauth2PermissionGrant -All | Where-Object { $_.ClientId -eq $sp.Id } |
  ForEach-Object { Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $_.Id }

# Application permissions (app roles) granted to this app
Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All |
  ForEach-Object { Remove-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $sp.Id -AppRoleAssignmentId $_.Id }

Start with apps that hold broad scopes such as Mail.ReadWrite, Files.ReadWrite.All, Sites.ReadWrite.All or offline_access, apps from unverified publishers, and any AI assistant, notetaker or "agent" you did not approve.

Kill switch for one app

To stop an app for everyone right away, open the enterprise app, go to Properties and set Enabled for users to sign-in? to No. This blocks all token issuance for the app. In PowerShell:

Update-MgServicePrincipal -ServicePrincipalId $sp.Id -AccountEnabled:$false

Step 4: Inventory agents in Microsoft 365 and Entra

• Microsoft 365 admin center: go to Agents > All agents > Registry. Review the Total agents, Agents without owners and Unmanaged agents cards, filter by publisher and platform, and export to CSV. To block one, open the agent and choose Block. The Risks column needs Microsoft 365 E7 or Agent 365.
• Microsoft Entra: go to Entra ID > Agents > Agent identities to see every agent identity, and use Disable for any you do not recognize. Agent blueprints are listed next to it.
• Sign-in logs: in Entra ID > Monitoring & health > Sign-in logs, filter on Is Agent and Agent type to see what agents are actually doing.

Microsoft Entra Agent ID is available to all Entra customers. Extending Entra security controls to agents requires Agent 365, which is included in Microsoft 365 E7 or sold as an add-on to E5, A5 and Business Premium.

Step 5: Block unapproved agents with Conditional Access

If you have the licensing (Microsoft 365 E7, or Agent 365 with Entra ID P1 or Microsoft 365 E3), create a policy that blocks every agent except the ones you approve:

1. Go to Entra ID > Conditional Access > Policies > New policy.
2. Under Users, agents or workload identities, set What does this policy apply to? to Agents. Include All agent identities and exclude your approved agents.
3. Set target resources to All resources and the grant control to Block.
4. Start in Report-only, review sign-in logs for a week, then turn it on.

With Entra ID P2 or E5 you can also add the agent risk condition (preview) to block agents Microsoft rates as high risk.

Step 6: Close the shared-password path

• Write it down. Add a line to your acceptable use or AI policy: never enter a work password into an AI tool or let an AI browser sign in as you. Approved agents get their own access through IT.
• Use phishing-resistant MFA and device-based Conditional Access (compliant or hybrid-joined devices) so a password alone, typed into some other system, is not enough.
• Consider token protection for Exchange Online, SharePoint Online and Teams on Windows, macOS and iOS native apps. It binds sign-in tokens to the device. Browser support is still preview, so pilot in report-only first.
• Turn on app governance in Microsoft Defender for Cloud Apps (Defender portal > Settings > Cloud Apps > App governance) if you own it, to get alerts on OAuth apps with unusual data access.

How to verify it worked

1. As a test user, try to add an unverified third-party app. You should see a request-approval prompt instead of a consent prompt.
2. Confirm the request reaches your reviewers by email.
3. Re-run the Get-MgOauth2PermissionGrant query for revoked apps and confirm it returns nothing.
4. Check Conditional Access report-only results in sign-in logs for agent sign-ins that would have been blocked.
5. Export the agent registry and make sure every agent has a named owner.

Frequently asked questions

Can AI agents get into my Microsoft 365 tenant without IT knowing? Yes. If users can consent to apps, an AI tool can get delegated access to mail and files through a consent prompt. A browser agent can also act inside a user's session. Restricting consent and reviewing grants closes the first path; MFA, device-based Conditional Access and a clear policy reduce the second.

Does revoking an app's permissions stop it for good? No. Users can consent again unless you restrict user consent. To stop an app for everyone immediately, set Enabled for users to sign-in to No.

What license do I need for Conditional Access for agents? Microsoft lists Microsoft 365 E7, or Agent 365 with Entra ID P1 or Microsoft 365 E3. Agent risk needs Entra ID P2 or E5.

Can Conditional Access block every AI agent? No. Delegated agent access follows the user's policies, user-only policies miss agent user accounts, and API-key agents bypass Conditional Access. Use consent controls, inventory and monitoring together.

Is it true that AI agents emptied bank accounts? Not based on public reporting so far. Axios reported agents in accounts, citing unnamed sources; Reuters could not immediately verify it, and no documented unauthorized money movement has been published.