TL;DR: AI agents can create accounts, change group memberships and edit policy settings across Active Directory and Microsoft Entra ID faster than humans can review them, according to Cayosoft's coverage of Gartner's Hype Cycle for AI Governance Technologies, 2026. Access review processes assume changes remain visible long enough to be reviewed; agent-timed edits can outpace that window and force recovery at the change layer instead.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Cayosoft's announcement: AI agent action rollback is emerging as a response to directory and policy changes made by agents across Active Directory and Microsoft Entra ID.
Why it matters: Identity teams now have to treat agent-driven directory edits as operational change events, because a single policy or membership change can cascade across Microsoft 365 access and availability.
Context
The governance gap is not that AI agents can touch identity systems. The gap is that existing controls usually assume a human-paced edit cycle, with review, approval and rollback handled after the fact. When an agent can make a directory or policy change directly, the control point moves from certification to reversal.
That matters most in directory services, where a single group or policy change can alter access across multiple applications. In this environment, the question is less whether the change was intended and more whether the environment can explain, scope and reverse it cleanly when the change was wrong.
This is why identity change management is becoming a frontline issue for agentic AI, especially in Active Directory and Microsoft Entra ID. The same governance assumptions that work for administrators do not hold when a software actor can act at machine speed through delegated permissions.
Key questions
Q: What should teams do first when an AI agent changes identity settings unexpectedly?
A: First isolate the agent’s write path, preserve audit logs and directory state, then revert only the unintended change at the smallest safe scope using directory object granularity. That usually means checking the agent’s delegated rights, the account or token it used, and whether the change came through an API, group policy or admin role before restoring access.
Q: Why do AI agent changes to group membership create wider access risk?
A: Group membership changes can widen access because one membership edit can inherit many downstream permissions through nested groups, role mappings and application entitlements. An AI agent with group write rights can therefore expand access far beyond the immediate account it touched, so those changes need tight approval, logging and rapid rollback.
Q: How does object-level rollback differ from full system restore in identity operations?
A: Object-level rollback restores one identity object, such as a user, group, role or policy entry, without reverting the whole directory or platform. Full system restore rolls back the broader environment, which can undo unrelated changes and create larger operational disruption. object-level rollback is used when the bad change is localised and the rest of the system must stay intact.
Q: How should teams limit AI agent authority in directory services?
A: Limit AI agent authority with minimum identity actions, meaning the agent can only perform the specific directory operations it needs, such as read, create, update or delete on named objects. Combine that with scoped service accounts, time-bound delegation, approval for sensitive writes and separate roles for read and admin actions.
Technical breakdown
How agent-driven directory changes propagate across identity systems
AI agents that operate through delegated permissions do not need a new protocol to cause identity impact. They use the same management APIs, such as Microsoft Graph, that administrators and scripts use to create accounts, edit group membership or adjust policy objects. The risk is propagation: a single change in one directory object can alter authorization decisions across connected services because identity is the trust layer for Microsoft 365 and related applications. Once a policy or group object changes, downstream services inherit the new state immediately. In practice, the technical problem is not only mutation but blast radius, because the affected object often controls access far beyond the object itself. See the Active Directory and Entra ID Hardening Guide.
Practical implication: Map which identity objects fan out into multiple services before granting agent access to them.
Why standard backup and restore is too blunt for agent-caused drift
Conventional backup and restore captures a point in time, but it does not automatically isolate the exact changes made by one actor. In mixed-admin environments, restoring a directory or policy snapshot can roll back legitimate changes that occurred after the bad edit, which creates operational friction and can introduce fresh breakage. For identity operations, object-level and attribute-level reversal is more precise because it reverts only the targeted change while preserving unrelated state. That distinction matters when the error is a single group membership, policy setting or attribute update rather than a full-directory incident. Recovery design therefore has to align with identity object granularity, not just platform backups.
Practical implication: Use object-level reversal for identity drift instead of depending on full restore points.
What agent-aware logging needs to preserve
Agent-aware logging is more than retaining who changed what. It needs to preserve the actor, the before-and-after value, the object scope and enough context to reconstruct causality later. Native audit logs often retain change records for a limited period, but that is not the same as durable operational evidence. When logs expire or are themselves mutable by the same credentials that made the change, incident responders lose the ability to prove exactly which edit happened and whether it was isolated or part of a broader sequence. For identity governance, this is a traceability problem as much as a recovery problem. See the AI Agent Observability, Audit and Incident Response Guide.
Practical implication: Retain immutable change history for identity objects that agents can touch.
Breaches seen in the wild
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
- Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI agent rollback marks a shift from preventive identity governance to corrective identity governance. The control problem is no longer only whether an agent should have access, but whether the organisation can precisely unwind what it changed without disturbing other state. That is a different operating model from classic administration review, because the harmful event may be a normal task executed at machine speed. Practitioners should treat rollback as a first-class identity control, not an afterthought.
Access review assumes access persists long enough to be observed. That assumption was designed for human administrators and service accounts with stable states. It fails when an agent acquires permission, performs a change and moves on before any review cycle can see the intermediate state. The implication is not simply faster monitoring. It is that review-based governance does not fully describe agent-timed identity change, so the programme has to account for reversal at the moment of mutation.
Identity systems are becoming the highest-value recovery plane for agentic AI. When an agent changes a group, policy or account object, the result can ripple into Microsoft 365 access, device compliance and administrative privilege. That creates a recovery dependency that sits below the application layer and above the infrastructure layer, which is why identity teams are now part of resilience planning. AI agent authorisation becomes more relevant when authority can be granted and consumed within the same workflow.
Precise reversal is the named concept practitioners should carry forward. The issue is not generic restore capability. It is the ability to identify the exact object, attribute and actor involved, then reverse only that corruption while preserving everything else that legitimately changed afterward. That is the operational bar agentic identity governance now has to meet, especially where directory state drives every downstream trust decision. Teams should measure recovery against specificity, not just availability.
From our research library:
- 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Rollback will become a baseline control for agentic identity programmes. Once agents can modify accounts, policies and permissions directly, the programme has to assume that some changes will be wrong and must be reversed with high precision. That shifts maturity from change detection alone to recoverability of identity state.
AI agent governance and identity governance are converging. Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey. The practical consequence is that many teams still lack the operating model needed to contain agent-made directory changes.
Directory state is becoming part of resilience planning. If an agent can alter a policy object and immediately reshape access across Microsoft 365, then identity rollback, logging and recovery design belong in the same conversation as availability and incident response. Teams should watch for governance models that still treat identity as a static control plane.
For practitioners
- Define rollback scope for identity objects Classify which accounts, groups, policies and device settings can be reversed safely at object or attribute level instead of restored wholesale.
- Separate agent permissions from broad directory control Limit agent access to narrowly scoped identity actions so a single workflow cannot rewrite unrelated access policy or group state.
- Preserve durable identity change evidence Keep immutable before-and-after records for directory edits, including actor identity, object scope and the exact values changed.
- Test recovery against downstream access impact Validate whether reversing one directory change also restores dependent access in Microsoft 365, rather than assuming the platform state will self-correct.
Key takeaways
- AI agents are changing the identity recovery problem by making directory edits faster than human review cycles can keep up with.
- The critical failure mode is not just unauthorized access but uncontrolled identity state change that spreads across connected services.
- Practitioners need precise rollback, durable audit evidence and tightly scoped agent authority to keep directory changes recoverable.
Related NHI Mgmt Group resources: AI Agent Observability, Audit and Incident Response Guide · AI Agent Authorisation Guide · Agentic AI Identity Guide · Agentic AI Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent-driven directory changes hinge on overbroad identity authority and privilege misuse. |
| Recommendation — Constrain agent authority so directory writes cannot exceed the minimum task scope. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | AI agents acting through service principals fit the overprivileged non-human identity pattern. |
| Recommendation — Audit agent permissions against least privilege and remove directory write rights that are not essential. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article centers on permissions that let agents alter identity state faster than humans can review. |
| Recommendation — Restrict identity write access to the narrowest set of permissions needed for each agent task. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Directory edits change entitlements and authorizations across connected services. |
| Recommendation — Track and review entitlement changes so agent-made identity edits can be detected and reversed quickly. | ||
| MITRE ATT&CK | TA0004; TA0008 — Privilege Escalation; Lateral Movement | Identity changes can elevate privilege and cascade access across services. |
| Recommendation — Hunt for privilege escalation and lateral movement patterns when agents modify groups or policies. | ||
Key terms
- AI Agent Action Rollback: AI Agent Action Rollback is the ability to reverse changes made by an AI agent after those changes have affected data, identities, configurations, or infrastructure. It focuses on restoring prior state, not just blocking future action. The control matters when an authorised agent makes a harmful but legitimate looking change.
- Conditional access policy: A policy that grants, restricts, or revokes access based on live attributes or signals. In NHI and agentic environments, those conditions can include exposure risk, anomalous behaviour, or task context. The operational value is that authorization becomes responsive instead of purely historical.
- Microsoft Graph: Microsoft Graph is the access and data layer that connects Microsoft 365 services, including mail, files, chats, and sites. In Copilot workflows, it becomes the retrieval surface that determines what information the assistant can assemble into a response.
- Object-Level Rollback: Object-level rollback is the restoration of a single changed object, such as a user account, group, policy or credential record, instead of reverting an entire system or directory. It is used in identity operations to undo a narrow mistake while keeping unrelated state, permissions and logs in place.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org