Conditional Access can only block an agent identity
The skills list names the skill. A practice question asks the part the list leaves out: which control a policy can enforce on an agent.
What the skills list says
Microsoft's AB-650 study guide lists, under implementing and managing agents, "Secure agent access, including access packages and conditional access." It doesn't say what a Conditional Access policy can do to an agent once it targets one. Microsoft's AB-650 study guide
What a practice question asks
Litware's autonomous agents authenticate with their own agent identities and no signed-in user. A Conditional Access Administrator builds a policy that includes All agent identities and targets a payroll API registered in Microsoft Entra ID. Which access control can the policy enforce on the agents: an authentication strength, multifactor authentication, a compliant device, or block access?
The answer, and why the other three fail
Block access. Microsoft's page on targeting agent identities lists it as the only available option for agent identities, because there's no interactive remediation possible. Agent identities don't support grant controls, so the policy can't require multifactor authentication, an authentication strength or a compliant device. Microsoft's page on grant controls
An agent's user account is a separate target
A policy on an agent identity doesn't apply to the agent's user account, the account an agent uses when it acts as a user. Neither does a policy that targets all users. Agents' user accounts are a separate target, currently in preview. Microsoft's page on agents that act as users
One more detail a question can turn on: a policy that targets an agent identity blueprint covers every agent identity created from it, including ones created later.
Where this comes from
The question is C35 in the AB-650 Administering Microsoft 365 and AI Services Practice Questions, 251 questions across the exam's three skill areas, each answer explained against a Microsoft Learn page. Microsoft has no practice assessment for AB-650 yet. Microsoft's AB-650 exam page
The card below links the book.
The book
AB-650 Administering Microsoft 365 and AI Services Practice Questions
251 practice questions for Exam AB-650, each answered with the reason the right option holds and the trap the others set.