u/Muted_Math2750

Years getting conditional access right for humans device state, risk, mfa dead proud of it.

Then the AI stuff shows up, copilot agents, service principals someone stood up for a bot, app registrations with client secrets older than half my team. CA fires on interactive sign-ins, so all of this slides right under the controls I trust.

I can see the sign-ins after the fact. I can't put the same posture and least-privilege story on a service principal that I put on a person. That's the gap an auditor jabs at, and I've got no answer.