Unmanaged Agents

    An agent is considered unmanaged when ManageEngine SecureAI has discovered it but it has no owner. The Unmanaged Agents tab lists these agents from every AI platform configured in your setup, allowing you to close ownership gaps from one place.

    Owners are required for governance workflows in SecureAI. The owner of an agent approves or rejects the access requests raised for it and reviews the entitlements assigned to it. If an agent does not have an owner, its access requests have no approver and its entitlements are not reviewed. This applies even when the agent holds roles and API permissions or can reach MCP servers and knowledge bases.

    How an agent becomes unmanaged

    On each sync, SecureAI adds the agents from your configured AI platform instances to the AI Agents inventory, then tries to assign an owner to each one. SecureAI first assigns ownership using the native owner, the owner recorded in the agent's source platform. If a native owner is not available, SecureAI evaluates the agent ownership policies in the order of their priority and checks them against the agent's attributes. The first policy that matches is used to assign the owner. The attributes available in a policy condition vary by platform and include agent name, model, MCP server, knowledge base, and (for Microsoft platforms) Microsoft Entra ID role and API permission. An agent that is not assigned an owner from either of these sources is listed under Unmanaged Agents, with Assign Owner shown in its Owners column.

    The list of unmanaged agents is updated as agents are discovered and as owners are assigned. Assigning an owner manually both removes the agent and excludes it from the ownership policies from that point onwards. The agent is skipped when it is fetched again during a sync and when a policy is run manually.

    Prerequisites

    • Log in as a Super Admin or a help desk technician assigned the Governance Manager role.
    • At least one AI platform instance must be added in Application Settings, with the relevant service associated—for example, Microsoft Copilot Studio, Gemini Enterprise Agent Platform, or Zia Agents. SecureAI does not discover agents from platforms that are not configured.
    • The instance must show the Sync completed status. Agents are listed only after a successful sync.
    • The users that you want to assign as owners must be available in a directory or application configured in SecureAI or as SecureAI users.
    Note:
    • You cannot return an agent to policy-based ownership after assigning an owner to it manually.
    • Assigning an owner does not change what an agent can access.
    • You cannot see ownership changes made in the source platform until the next successful sync.

    Configuration instructions

    1. Navigate to Governance > AI Inventory > AI Agents and select the Unmanaged Agents tab. The agents with no owner are listed on this tab.
    2. Click View Graph in the Access Graph column of an agent to display what that agent can access. The graph shows the roles, API permissions, guardrails, knowledge bases, tools, MCP servers, models, and other agents associated with it.
    3. To assign owners to an agent, click Assign Owner in its Owners column. To assign the same owners to several agents, select those agents and click Update Owner.
    4. Check the Assign owners only from native/agent ownership policy option to restrict the selection to the users identified by the native ownership and agent ownership policies, or clear it to assign any user.
    5. Click Save then Proceed in the confirmation prompt. The agents are no longer listed as unmanaged and their owners are shown in the All tab.

    Tips

    • Configure an agent ownership policy with no conditions and the lowest priority so that agents matching no other policy still get an owner at discovery.
    • A rise in unmanaged agents after you onboard a platform usually means no existing policy matches that platform's agents. Check the policy conditions for it.
    • Use the access graph to decide the order of assignment. Agents holding administrative roles or reaching MCP servers need owners sooner.
    • Assign a second owner to agents used in critical processes so that requests are not held up when one owner is unavailable.
    • Assign ownership to the team that operates the agent, not the team that administers the platform.
    • An unmanaged agent has no owner to review its entitlements. Scope an access certification campaign to these agents using Filter by Report. This ensures that their entitlements are reviewed while ownership is unresolved.