Security & Compliance5 min

Your agents need logins, not API keys: Okta Agent SSO, Microsoft Agent 365, and what UK buyers should demand

Okta Agent SSO and Microsoft Entra Agent ID and Agent 365 turned agent identity into a licence feature in 2026. Why it is trending, what it means for Grok Bot, n8n and Dust, and a UK buyer checklist: inventory, owner, identity not key, revocation drill.

Erhan Timur1 November 2026Founder, Digital by Default

Share:X LinkedIn

Your agents need logins, not API keys: Okta Agent SSO, Microsoft Agent 365, and what UK buyers should demand

Every post we have written this autumn ends in the same place. Grok Bot can hold your logins in a Vault. n8n lets a workflow act with a person's credentials. Dust agents read whatever the data permissions allow. The question underneath all of them is: who is the agent, as far as your systems are concerned?

In 2026 the identity vendors finally answered. This note covers what Okta and Microsoft shipped, why it is trending now, and what a UK business should ask for before the next agent gets a credential.

Why it is trending

A Gartner figure doing the rounds this month says only 13 percent of organisations are confident they can govern the agents they expect to run
UBS reported more than 12,700 personal AI agents in use across its workforce in its Q3 2026 results
IBM, Okta, Microsoft, Snowflake and Vercel all shipped agent identity, permission or memory products in October, and the newsletters covering agents have moved from "which model" to "who signs the agent in"

The pattern is familiar from the cloud years: adoption first, then the audit finding, then the identity project.

What Okta shipped

Okta Agent SSO went generally available on 24 August 2026 and is included in core Okta SSO at no extra cost. It applies to agents that support Cross App Access, and it lets an agent be registered as an identity in Okta's Universal Directory, with its own lifecycle, owner and policies, instead of a static API key living in a config file.

Okta's broader "Okta for AI Agents" positioning treats every agent as a non-human identity you can discover, govern and revoke. The October release notes add Shadow AI Agent Discovery for Endpoints (early access, with CrowdStrike), which finds agents running on laptops, maps them to a human owner, and pulls them into central lifecycle governance. One Okta page gives an earlier May date for GA; the August date is better supported.

What Microsoft shipped

Entra Agent ID arrived in April 2026: agents get first-class identities in Entra, with the same conditional access and lifecycle tooling as users. Agent 365 is positioned as the control plane for agents across Microsoft 365, and includes Runtime Protection to monitor and evaluate agent behaviour in real time. Licensing per third-party summaries: included with Microsoft 365 E7, available as an add-on to E5, A5 and Business Premium. Confirm with your reseller; licensing changes faster than blog posts.

What this means for the tools you are evaluating

Tool	How it identifies itself today	What to ask for
Grok Bot	Signs into your tools with your credentials, optionally from the Vault	Enterprise tier with per-user isolation; SSO; an owner per Bot; a revocation drill
n8n	Project or personal credentials; admin node rules (2.44)	A credential per workflow owner, not a shared service account; node rules enforced
Dust	Data-access rights separated from agent-usage rights; SSO/SCIM	Space-level permissions reviewed quarterly; publish approval
Twilio Agent Connect / Pipecat	Whatever credentials your code holds	Secrets in a vault, rotated; the agent's phone identity logged per call
Any SaaS "AI agent" feature	Usually the vendor's own service identity	Support for Cross App Access or Entra Agent ID on the roadmap, in writing

A UK buyer's checklist

Inventory. List every agent, including the ones in browser extensions and personal subscriptions. Okta's endpoint discovery or a simple survey; either is better than nothing
Owner. Each agent has a named human owner, the same as a service account under ISO 27001 or Cyber Essentials
Identity, not key. Prefer tools that can take an identity from Okta or Entra over tools that only accept an API key you paste in
Least privilege by default. A new agent has no access until someone grants it, which is the Grok Bot Enterprise and Dust model
Revocation drill. Time how long it takes to cut off one agent everywhere. If it is more than five minutes, you have a project
Logs you can read. Every agent action attributable to the agent identity and its owner, kept for as long as your retention policy says
Procurement clause. Add "supports agent identity via our IdP" to the RFP template now; it will be table stakes within a year

Who should care, who should wait

Act now: regulated firms (financial services, legal, health), anyone on Okta or Entra already, and any business with more than a handful of agents in production. The tooling is included in licences you may already pay for.

Wait: a five-person team with one n8n instance and one Grok Bot. Write down the owner and the revocation steps on one page and revisit when agent count hits double figures.

Bottom line

Agent identity is the governance layer that lets the rest of the stack grow safely. Okta and Microsoft have made it a licence feature rather than a project, which removes the usual excuse. The ask for UK buyers is modest: know your agents, name an owner for each, give them an identity rather than a key, and prove you can switch one off. Everything else in agent governance builds on that.