MT.1122: AI agents should not have orphaned ownership.
| ID | MT.1122 |
| Severity | Medium |
| Suite | Mito |
| Product | Copilot Studio |
| Feature | Agents |
| Security area | AI and agents |
| Resource type | Agent |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”AI agents should not be orphaned without an active owner.
Agents whose owners have been disabled or deleted in Entra ID lack active governance. No one is responsible for maintaining their configuration, reviewing their security settings, or responding to incidents involving the agent.
How to fix
Section titled “How to fix”Assign an active user as the owner of each orphaned agent in Copilot Studio. If the agent is no longer needed, unpublish or delete it.
Learn more: Agent Registry in the Microsoft 365 admin center and share agents with other users
Mito check. Author: lnfernux. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.