Free AI Agents, the E7 Bill and AD vs Entra: The Workplace Ninjas US Special

Entra.Chat

0:00

-24:53

Free AI Agents, the E7 Bill and AD vs Entra: The Workplace Ninjas US Special

Four Workplace Ninjas US speakers on free local AI agents, the licence it takes to secure them, and the AD vs Entra cage match.

Merill Fernando

Nov 07, 2026

AI agents are arriving in every Microsoft 365 tenant, and the questions admins ask first are what they cost to run and what it costs to secure them. In this Workplace Ninjas US special, four of the event’s speakers answer from the field: Jon Towles, founder of Workplace Ninjas US, Intune and AI tool builder Ugur Koc, Microsoft 365 security MVP Ru Campbell, and Spencer Alessi, the pen tester who defends Active Directory against Merill in the event’s AD vs Entra cage match.

Key takeaways

AI agents: cheap to run, not free to secure

Overview: Microsoft Entra Agent ID is free for every Entra customer, but Conditional Access for agents needs Microsoft 365 E7, or Agent 365 plus Entra ID P1 or Microsoft 365 E3

Admin agents can run on a laptop. You don’t need Security Compute Units, an E7 licence and Agent 365 just to query Microsoft Graph and reason over the results. Ugur’s answer is a local model that runs on a device with 8 GB of memory. His open-source OpenAdminOS runs agents as readable YAML files, top to bottom, through an MCP server and a local model such as Qwen on Ollama. “You don’t need like 10 SCUs to query your defender portal.”
Review the tools you vibe-code before you share them. Ugur ran an agent-led security review over the new community projects for AwesomeIntune, found enough issues that he sent the authors fixes, and only published once they were merged. Keep API keys and secrets out of your repos, and treat every MCP connection as something to secure.
An agent identity is free; securing it isn’t. Microsoft Entra Agent ID, with agent identities and blueprints, is available to every Entra customer. Conditional Access for agents needs Microsoft 365 E7, or Microsoft Agent 365 with at least Entra ID P1 or Microsoft 365 E3. Jon’s warning from the field: when the people using an agent don’t have Agent 365, “it’ll bypass conditional access when it talks to things like graph”. Budget for the licence before the agents go live.

Fix the baseline with one policy

The one-policy cheat code: one Conditional Access policy for all users and all resources that requires a compliant or hybrid joined device, so managed devices get in and unmanaged ones are blocked

Block everything that isn’t on a managed device. Ru’s opening move when he hardens a new tenant: one Conditional Access policy for all users and all resources that requires a device marked as compliant or Microsoft Entra hybrid joined. “That’s the cheat code to securing Microsoft 365.” Start it in report-only and exclude your break-glass accounts.
Know what each licence adds. Entra ID Free gives you security defaults. Entra ID P1, included in Business Premium, adds Conditional Access and the cheat code. E5 adds risk-based policies with P2. E7 matters once you add agents, because it includes Agent 365.

Cloud-native devices aren’t cloud-native identity

Cloud-native devices and cloud-native identity are two separate decisions: you can have Entra joined, Intune-managed devices while your users still sync from Active Directory

Treat devices and identity as two decisions. Entra joined, Intune-managed devices work with users synced from Active Directory and can still reach file shares and Kerberos apps on-premises. Going cloud-only for identity is a separate, bigger step, and it’s the question behind the AD vs Entra debate.
While AD is still there, keep defending it. Spence, a pen tester who talks mostly about Active Directory, is a fan of Entra and works in it every day. Plenty of tenants will run both for years, so follow the people who know AD as well as the ones who know Entra.

Watch the full conversation for how a Twitter fight became a conference session, the AD vs Entra scorecard, why Jon gives everyone an open bar and a puppy kennel, the 5K for Parkinson’s research, and who will still be running when the apocalypse comes. Explicit language.

Workplace Ninjas US 2027 runs 11-13 January 2027 at The Scott Resort & Spa in Scottsdale, Arizona. Tickets: workplaceninjas.us.

Sponsored by:

ENow Software Introduces New Entra ID App Onboarding Experience

ENow Software Introduces New Entra ID App Onboarding Experience
As user requests for SaaS and AI applications increase, Entra ID and M365 teams face a growing volume of security reviews, added hours of manual research, and bottlenecks.
New! ENow App Governance Accelerator 4.0 introduces App Onboarding, helping teams:
Accelerate app approvals with configurable, multistage workflows.
Evaluate security risks more efficiently with integrated Microsoft Defender for Cloud Apps risk scores.
Reduce manual work with centralized requests, reviews, and approvals.
Improve transparency with a self-service portal for requesters to track status and decisions.
Control app sprawl with an Internal App Catalog of approved applications.
Go beyond Microsoft’s consent and approval capabilities with customizable, structured application governance, from the initial request through ongoing oversight.
Faster Approvals. Less Admin Work. Better Security Posture.
Learn More About ENow App Governance Accelerator 4.0
See It In Action: Request a Demo
Simplify App Onboarding

Subscribe with your favorite podcast player or watch on YouTube

About the guests

Jon Towles (”Mobile Jon”) is the founder of Workplace Ninjas US, an end-user computing practitioner with a long background in identity, and a Microsoft MVP.

→ mobile-jon.com | linkedin.com/in/jontowles

Ugur Koc builds free community tools for Microsoft Intune admins, including AwesomeIntune, IntuneBrew and IntuneAssignmentChecker, and is the creator of OpenAdminOS, an open-source desktop app for running local AI agents against Intune, Entra and Defender. He’s based in Hamburg, Germany.

→ ugurkoc.de | linkedin.com/in/ugurkocde

Ru Campbell is a Microsoft 365 security, compliance, identity and management expert and Microsoft MVP, based in Scotland. At Workplace Ninjas US he co-presents a Conditional Access session and hardens an out-of-the-box tenant live in 60 minutes.

→ campbell.scot | linkedin.com/in/rlcam

Spencer Alessi (”TechSpence”) is a Senior Penetration Tester at SecurIT360 and a Microsoft MVP (Security - Identity & Access). A recovering sysadmin turned pen tester, he writes and talks about Active Directory security and builds free tools such as ScriptSentry, ADeleginator and AppLocker Inspector.

→ spenceralessi.com | linkedin.com/in/spenceralessi

Related Entra.Chat Episodes

How Microsoft Is Securing AI Agents in Entra - Conditional Access, Zero Trust & the “Block” Debate - https://entra.news/p/how-microsoft-is-securing-ai-agents
Microsoft Security Architect: Active Directory Is 10x Harder to Defend Than Entra - https://entra.news/p/microsoft-security-architect-active
Entra Agent Registry: The Corporate Yellow Pages for AI Agents - https://entra.news/p/entra-agent-registry-the-corporate