Two years ago, I wrote about Microsoft's 2024 Digital Defense Report and its warning that identity had become the prime target for threat actors. The 2026 Microsoft Digital Defense Report goes a step further. Microsoft now calls identity the primary control plane for defense and says plainly that this control plane spans both human and non-human identities, including applications and AI agents.
That sentence makes application governance in Entra ID a core identity security job. Below are the report's findings that matter most for app security, and what you should do about them.
What Changed in the Digital Defense Report Since 2024?
In 2024, the headline was volume: roughly 600 million identity attacks per day. Microsoft noted that MFA was working, so attackers were moving up the chain to bypass authentication and exploit applications. The 2026 report shows where that shift landed.
Microsoft's Detection and Response Team (DART) sums it up neatly. Identity compromise, credential reuse, privilege escalation, and access misuse are unchanged. What changed is the scale of access, the speed of execution, automation, and the growing use of non-human identities.
| Finding |
2026 figure |
| Valid-account intrusions followed by more credential theft |
52.2% |
| Incident response cases where phishing was the initial access vector (up from 7% in 2025) |
23% |
| Attack techniques against critical infrastructure using cloud identity abuse |
78% |
| Intrusions that involved data theft |
63% |
| Enterprises already experimenting with AI agents |
88% |
How Do Attackers Turn One Compromised Identity Into Many?
DART describes a consistent four-step pattern:
- A human identity is compromised (through phishing, password spray, or token theft).
- The attacker finds non-human credentials, such as service principals, secrets, and API keys.
- Privileges escalate using access that already exists. (No exploit is needed when an app already holds tenant-wide Graph permissions).
- The attacker acts on the objective, usually data exfiltration and/or command-and-control deployment.
The report's Storm-2885 case shows how this plays out. The attacker compromised a highly privileged cloud identity, then used a legitimate Entra ID application with Microsoft Graph access to read hundreds of thousands of emails across hundreds of mailboxes. Microsoft notes the activity blended into expected cloud application behavior, making it hard to tell apart from legitimate use.
Everything the attacker needed was already in the tenant: a legitimate app with more permission than anyone was watching. It echoes the app-abuse tactics Midnight Blizzard used in 2023 against Microsoft's own environment, and it helps explain why Microsoft measured a significant increase in dwell time this year.
Key Takeaway
The Microsoft Digital Defense Report 2026 calls identity the primary control plane for defense, and that includes apps and AI agents. Attackers compromise one human account, find service principals, secrets, and API keys, then use permissions those apps already hold to steal data. Governing Entra ID app credentials and permissions helps break that chain.
How Do Attackers Persist Through Entra ID Apps and Service Principals?
Getting in is only half the attack. The report lists how attackers stay in across multiple layers. While persistence is distributed across endpoints, infrastructure, identity, and the cloud, the Identity and Cloud layers are where Entra ID applications come into play:
A password reset on the compromised user leaves every one of these in place. A consent grant or a forgotten app with Mail.Read across the tenant keeps working long after the incident ticket is closed. Part of the challenge is visibility: app registrations, enterprise applications, and service principals sit on separate pages in the Entra admin center, so a credential added to a service principal is easy to miss. ENow's Unified App View brings all three into a single dashboard.
This is why I keep coming back to ownership, the theme of our Hot Potato series. An app with no owner has no one reviewing its secrets, its permissions, or whether it should still exist. Writing about developer access, Microsoft makes a point every identity team should take to heart, and it applies more broadly than just for developers: you need a graph on top of your inventory, because what matters is what an identity, and the automation acting for it, can actually reach.
Why Are AI Agents an App Governance Problem?
In the 2026 Digital Defense Report, Microsoft reports that 88% of enterprises are experimenting with AI agents, and industry projections point to roughly 1.3 billion agents in production by 2028. From an app governance perspective, an agent is many times an app with ambition: it authenticates, holds permissions, calls Graph, and acts on data, often with little human supervision.
The report names three risks: ungoverned agent proliferation, overprivileged access that is rarely revoked, and no human accountability. Its recommendations follow directly. Every agent needs its own identity, a human sponsor, and least-privilege access, with automated cleanup when that access is no longer needed. As Microsoft puts it, no environment should ever have an agent without a human to answer for it. The report also treats time to revoke a compromised agent as a measured outcome.
If that reads like an application governance policy, that's because it is. If your team already governs its apps well, you have a head start on agents.
How to Turn the 2026 Report Into an Entra ID App Governance Plan
Microsoft's first priority for organizations is to report identity exposure and agent permissions to leadership. For Entra ID, that means being able to answer six questions:
- Which apps can read mail or files across the organization? Review application permissions such as Mail.Read and Files.Read.All, and scope them down with RBAC for Applications or Sites.Selected.
- Which apps and agents have no owner? Every one needs an accountable human.
- Which apps rely on long-lived secrets? Move to certificates or workload identity federation, and check service principals, not just app registrations.
- What consent has been granted? Restrict user consent and review existing grants.
- How fast can you revoke a compromised identity? Run a drill with a test user, app, and agent, then make that number shrink.
- Which apps are dormant? Apps with no sign-ins in 90 days or more are candidates to disable and, after a waiting period, remove. A dormant app with live credentials is an open door nobody is watching.
At the front door, require phishing-resistant MFA or passkeys for admins and block device code flow with a Conditional Access authentication flows policy, which the report says is now a preferred credential theft method. Users sign in on Microsoft's real device sign-in page while attackers collect the tokens, bypassing passwords and MFA.
Where Should You Start Governing the Identity Control Plane?
The 2024 report told us identity was the prime target. The 2026 report tells us where inside identity the real risk sits: in the apps, service principals, and agents that hold broad access and rarely get reviewed. We predicted this back in January in our Identity Security Predictions for 2026.
Microsoft says identity is the control plane. Application governance is a key part of how you keep your hands on it.
Entra ID App Governance
See Which Apps in Your Tenant Hold Too Much Access
The free AppGov Score scans your Entra ID tenant and surfaces risk signals and a scored baseline of enterprise applications, app registrations, and tenant settings. It gives you a starting point to understand your application governance posture.
ENow's App Governance Accelerator is your platform for ongoing application governance and lifecycle workflows and remediation. Its Unified App View puts app registrations, enterprise applications, and service principals on one dashboard, while Alternate Owner tracking, credential expiration alerts, and automated workflows support ongoing reviews and validation.
Frequently Asked Questions About the Microsoft Digital Defense Report 2026
What is the Microsoft Digital Defense Report 2026?
It is Microsoft's yearly report on the threats it tracks and responds to. The 2026 edition names identity as the primary control plane for defense and says that control plane includes non-human identities such as applications and AI agents.
What does Microsoft mean by "identity is the control plane"?
Access runs through identity, so whoever controls an identity controls what it can reach. Microsoft applies that to apps and AI agents as well as people. In Entra ID, any app registration or service principal with broad permissions is part of your attack surface.
How do attackers use Entra ID apps to steal data?
In the Storm-2885 case, the attacker compromised a highly privileged cloud identity, then used a legitimate Entra ID app with Microsoft Graph access to read hundreds of thousands of emails across hundreds of mailboxes. The activity looked like normal app behavior, which made it hard to spot.
Why doesn't a password reset remove an attacker's access?
Many persistence methods live in the application layer: new app secrets, OAuth consent grants, credentials added to service principals, and dormant apps with long-lived credentials. All of them keep working after the user's password changes, so review app credentials and consent grants in every identity incident.
How should you govern AI agents in Entra ID?
Microsoft recommends giving every agent its own identity, a named human sponsor, and least-privilege access, with automated cleanup when that access is no longer needed. Measure how long it takes to revoke a compromised agent and work that number down. If you already govern apps this way, extend the same policy to agents.
How do I find dormant or overprivileged apps in Entra ID?
Start with apps that hold tenant-wide permissions such as Mail.Read or Files.Read.All, then look for apps with no sign-ins in 90 days or more. Check service principals as well as app registrations, since credentials can be added to either. ENow App Governance Accelerator surfaces overprivileged apps along with abandoned and unmonitored ones, while its free AppGov Score gives you an overall benchmark score of your Entra ID app governance posture.
What is device code phishing, and how do you block it?
Attackers send a user to Microsoft's real device sign-in page and collect the tokens that sign-in produces, bypassing passwords and MFA. The 2026 report calls it a preferred credential theft method. Block device code flow with a Conditional Access authentication flows policy and allow it only where you have a documented need.
Sources
