--- title: "Entra Agent IDs: How to Stop AI Privilege Escalation" description: "Map the four objects behind a Microsoft Entra Agent ID, follow four documented paths to tenant control, and apply eight controls in risk order." canonical: "https://adamtheautomator.com/entra-agent-id-privilege-escalation/" --- # Entra Agent IDs: How to Stop AI Privilege Escalation > Map the four objects behind a Microsoft Entra Agent ID, follow four documented paths to tenant control, and apply eight controls in risk order. Source: https://adamtheautomator.com/entra-agent-id-privilege-escalation/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Entra Agent IDs: How to Stop AI Privilege Escalation](https://adamtheautomator.com/wp-content/uploads/publisher/4065d9c85b2b81bf9605cb37d967f788/a9812525518a5125a43d2341858253da973f79467a0eba39ef631295b5a8807b.png) # Entra Agent IDs: How to Stop AI Privilege Escalation [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)5 November 202610 min. read Categories: [AI Agents](/category/ai-agents/) Tags:[Microsoft Entra](/tag/microsoft-entra/)[Security](/tag/security/)[AI](/tag/ai/)[Microsoft Graph](/tag/microsoft-graph/) Table of Contents * [Where an Entra Agent ID Keeps Its Credentials](#where-an-entra-agent-id-keeps-its-credentials) * [The Four Objects Behind an Agent Identity](#the-four-objects-behind-an-agent-identity) * [Why the Blueprint Holds the Risk](#why-the-blueprint-holds-the-risk) * [Check GA and Preview Status Before You Design](#check-ga-and-preview-status-before-you-design) * [Four Paths From an Agent to Global Admin](#four-paths-from-an-agent-to-global-admin) * [Path 1: A Blueprint Credential Reaches Every Tenant That Trusts It](#path-1-a-blueprint-credential-reaches-every-tenant-that-trusts-it) * [Path 2: Ownership Plus a Credential Takes Over a Service Principal](#path-2-ownership-plus-a-credential-takes-over-a-service-principal) * [Path 3: The Permission Allowlist Covers Part of the Graph Surface](#path-3-the-permission-allowlist-covers-part-of-the-graph-surface) * [Path 4: Azure RBAC Sits Outside the Agent Restrictions](#path-4-azure-rbac-sits-outside-the-agent-restrictions) * [Prerequisites](#prerequisites) * [Map and Close the Credential Path: Controls 1 Through 4](#map-and-close-the-credential-path-controls-1-through-4) * [1\. Inventory the Agents You Already Have](#1-inventory-the-agents-you-already-have) * [2\. One Blueprint per Trust Boundary, One Identity per Agent](#2-one-blueprint-per-trust-boundary-one-identity-per-agent) * [3\. Remove Standing Credentials From Every Blueprint](#3-remove-standing-credentials-from-every-blueprint) * [4\. Narrow Who Can Touch a Blueprint](#4-narrow-who-can-touch-a-blueprint) * [Contain and Watch the Blast Radius: Controls 5 Through 8](#contain-and-watch-the-blast-radius-controls-5-through-8) * [5\. Scope Conditional Access at the Blueprint](#5-scope-conditional-access-at-the-blueprint) * [6\. Block the Permissions That Come Back](#6-block-the-permissions-that-come-back) * [7\. Put a Sponsor on Every Agent and Make It Expire](#7-put-a-sponsor-on-every-agent-and-make-it-expire) * [8\. Centralize the Logs Before You Need Them](#8-centralize-the-logs-before-you-need-them) * [The Blueprint Is the Boundary](#the-blueprint-is-the-boundary) Count the enterprise applications in your tenant that nobody on your team can explain, then check how many of them can still request a token this afternoon. That second number should worry you, and in a tenant that has spent a year building agents it usually grew without a change ticket, an access review, or a single entry in the change calendar. This guide closes that gap for AI agents. You will map the four objects behind a Microsoft Entra Agent ID, walk four documented paths that end in tenant control, and work through eight controls in the order that removes the most risk first. Each control closes part of the privilege escalation path those first four sections map. Controls name the Graph endpoint or portal path where one exists, and every capability is labeled generally available (GA) or preview. ## Where an Entra Agent ID Keeps Its Credentials An agent identity is not a new kind of account. [Microsoft Entra Agent ID](https://learn.microsoft.com/en-us/entra/agent-id/what-is-microsoft-entra-agent-id) extends the directory you already run, and the objects it creates sit beside your applications and service principals. That continuity is useful. It is also why an agent can inherit a privilege problem you thought you had closed. ### The Four Objects Behind an Agent Identity Four objects carry the model, and only one holds a credential of its own. | Object | What it is | Credential | | --- | --- | --- | | Agent identity blueprint | The template application object that defines permissions, app roles, and optional claims | Holds every credential its agent identities authenticate with | | Blueprint principal | The tenant-local service principal for a blueprint that has been added to the tenant | None of its own; carries `AgentIdentity.CreateAsManager` | | Agent identity | The service principal an agent actually authenticates as | None; it receives tokens the blueprint acquires | | Agent user account | An optional one-to-one user object for mailboxes, Teams, and systems that need a user | No password or passkey, and no privileged admin roles | ### Why the Blueprint Holds the Risk The blueprint is a template and the credential store in one object. Microsoft Learn’s [blueprint documentation](https://learn.microsoft.com/en-us/entra/agent-id/agent-blueprint) states: “Credentials used to authenticate an agent identity are configured on the agent identity blueprint.” A child agent identity has no secret of its own, so one credential at the top of the tree works for every identity underneath it. The platform limits what a blueprint can do in the directory to [create and delete agent identities and little else](https://learn.microsoft.com/en-us/entra/agent-id/agent-blueprint). The blueprint principal receives `AgentIdentity.CreateAsManager` the moment it is created. [That permission cannot be revoked](https://learn.microsoft.com/en-us/entra/agent-id/agent-id-creation-channels), so disabling or removing the principal is the only remedy, and a principal is capped at 250 agent identity creations. Add a credential to a blueprint and you can authenticate as every agent identity built from it. Trigger creation and you can manufacture an identity nobody has seen. * * * _**Reality Check: A blueprint with two credentials gives an attacker two ways to impersonate every agent built from it, and the second credential is usually a leftover secret from a migration.**_ * * * ![Agent ID trust chain](https://adamtheautomator.com/wp-content/uploads/publisher/b61dd35655c9205fe0b805cf1a15b3a9b5a47b5d9804ce6eb9456de43fc84aaa.jpg) ## Check GA and Preview Status Before You Design Status claims are where most agent identity guides go wrong, and a wrong one gets your design rejected at the change advisory board. The platform is generally available, and Microsoft Learn’s [What’s new page](https://learn.microsoft.com/en-us/entra/agent-id/whats-new-agent-id) says it directly: “Microsoft Entra Agent ID is now generally available.” The controls layered on top are a mix. | Capability | Status | What it requires | | --- | --- | --- | | Agent ID platform, including blueprints, agent identities, and Agent ID roles | Generally available | Any Entra tenant | | New blueprint and new agent identity wizards | Preview label on the portal controls | Entra tenant | | Conditional Access for agents | Documented as shipping, no preview disclaimer | Microsoft 365 E7, which includes Agent 365, or Agent 365 with at least Entra P1 or Microsoft 365 E3 | | ID Protection for agents (risky agents) | Preview, per [Microsoft’s agent administration guidance](https://learn.microsoft.com/en-us/entra/agent-id/manage-agent-identities-admin) | Microsoft Entra ID P2 during preview | | Agent ID lifecycle policies | Preview, not recommended for production workloads | Microsoft 365 E7, or Agent 365 with at least Entra P1 or Microsoft 365 E3 | | Agent registry | Converging under [Microsoft Agent 365](https://learn.microsoft.com/en-us/microsoft-agent-365/overview) | Microsoft 365 admin center, AI Reader role | | [Shadow AI discovery](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-shadow-ai-discovery) | [Global Secure Access](https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access) capability | Global Secure Access deployed; Entra Internet Access license, included in Microsoft Entra Suite | Treat this as a snapshot and re-check it before your design review. The portal wizards carry a preview label even though the platform underneath is GA, so test them against your change policy first. [ID Protection for agents](https://learn.microsoft.com/en-us/entra/id-protection/concept-risky-agents) and [lifecycle policies](https://learn.microsoft.com/en-us/entra/id-governance/agent-lifecycle-policies) are preview, which leaves sponsor attestation and risky-agent response on a manual runbook. ## Four Paths From an Agent to Global Admin Each path below has a public write-up behind it and starts from a permission set you might hand to a help desk. ### Path 1: A Blueprint Credential Reaches Every Tenant That Trusts It [Datadog Security Labs](https://securitylabs.datadoghq.com/articles/agent-id-inside-agent-compromise/) chained the Agent ID Administrator role into Global Administrator in a tenant the attacker never had an account in. The operator adds a password credential to a third-party blueprint with a POST to `/applications//microsoft.graph.agentIdentityBlueprint/addPassword`, the [blueprint-scoped operation](https://learn.microsoft.com/en-us/graph/api/agentidentityblueprint-addpassword) (the write-up used the application-level call), then authenticates as that blueprint principal in a second tenant where the blueprint was added. The chain then creates a Temporary Access Pass for a Global Administrator and takes the tenant. The precondition is modest: a subordinate agent holding temporary access pass write and `User.Read.All`. The finding generalizes past one vendor, because a credential on a blueprint authenticates any identity associated with it, in any tenant that added it. ### Path 2: Ownership Plus a Credential Takes Over a Service Principal [Silverfort](https://www.silverfort.com/blog/agent-id-administrator-scope-overreach-service-principal-takeover-in-entra-id/) found a narrower precondition with a wider payoff. An account holding only Agent ID Administrator could make itself owner of any non-agent service principal, add a credential, and authenticate as it, which meant privilege escalation into whatever directory role the target held. Silverfort reported it on March 1, 2026, Microsoft confirmed on March 26, and the fix shipped on April 9, 2026. Ownership plus credential is the takeover primitive, and both halves are auditable events. ### Path 3: The Permission Allowlist Covers Part of the Graph Surface [Compass Security](https://blog.compass-security.com/2026/06/entra-agent-id-from-a-security-perspective/) tested 1,041 permissions across 79 resources against an agent identity: 97 blocked, 944 allowed. `Application.ReadWrite.All` is blocked. `Application.ReadUpdate.All` is not, and modifying an application object includes adding a credential to it. `RoleAssignmentSchedule.ReadWrite.Directory`, `RoleEligibilitySchedule.ReadWrite.Directory`, and `PrivilegedAccess.ReadWrite.AzureADGroup` are reachable as well. Microsoft does block Global Administrator, Privileged Role Administrator, and User Administrator for agent identities, along with role-assignable group membership and many high-privilege permissions. The allowed list still includes Exchange Administrator, Billing Administrator, Cloud App Security Administrator, and Windows 365 Administrator, and Compass notes that Windows 365 Administrator can manage security groups. ### Path 4: Azure RBAC Sits Outside the Agent Restrictions Compass also observed no Azure RBAC restriction; an agent identity could take Owner on an Azure scope. [Microsoft’s authorization documentation](https://learn.microsoft.com/en-us/entra/agent-id/authorization-agent-id) restricts directory roles and Graph permissions and says nothing about Azure RBAC, so treat this as third-party testing nobody has contradicted. The rings below show how far one credential reaches. ![Credential blast radius](https://adamtheautomator.com/wp-content/uploads/publisher/aa443d4339057a557fb2f48dc084d8f39931702ffa3b6c30e4521dd3a251a73a.jpg) ## Prerequisites If you want to follow along hands-on, you’ll need: * An Entra tenant where you can create applications, licensed for Microsoft Entra ID P1 or P2: [the sign-in log API](https://learn.microsoft.com/en-us/graph/api/resources/signin?view=graph-rest-beta) behind control 1 requires it to download sign-in logs. A licensed development tenant covers controls 1 through 4. * Agent ID Developer to create blueprints, or Agent ID Administrator where the blueprint carries a client secret or certificate credential, plus Privileged Role Administrator for the role checks. Global Administrator covers all three. * A [Microsoft Agent 365 license](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-agent-365/microsoft-agent-365) for control 5; the status table above carries the plan requirement. Skip it without one. * The [Microsoft Graph PowerShell SDK](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation) authenticated with `AuditLog.Read.All` for the control 1 sign-in query, installed as `Microsoft.Graph.Beta.Reports` because that filter exists only on beta. * Global Secure Access deployed for the shadow AI inventory in control 8, which you can skip. ## Map and Close the Credential Path: Controls 1 Through 4 Work these in order. Each one produces the list the next one acts on. ### 1\. Inventory the Agents You Already Have Audit logs have no agent object type. Blueprint activity lands as application events, agent identity activity as service principal events, and an agent’s user account as user events, [per the Agent ID logging guidance](https://learn.microsoft.com/en-us/entra/agent-id/sign-in-audit-logs-agents). The discriminator is `agentType` on `initiatedBy`, `performedBy`, and `targetResources`: `agenticApp`, `agenticAppInstance`, `agentIdentityBlueprintPrincipal`, and `agentIDuser`. ```text GET https://graph.microsoft.com/beta/auditLogs/signIns?$filter=signInEventTypes/any(t: t eq 'servicePrincipal') and agent/agentType eq 'agenticAppInstance' ``` The filter runs on beta only, so pin the version and the module: ```powershell Install-Module Microsoft.Graph.Beta.Reports -Scope CurrentUser Connect-MgGraph -Scopes "AuditLog.Read.All" $agentSignIns = Get-MgBetaAuditLogSignIn -All ` -Filter "signInEventTypes/any(t: t eq 'servicePrincipal') and agent/agentType eq 'agenticAppInstance'" $agentSignIns.Count ``` Microsoft’s [sign-in audit logs article](https://learn.microsoft.com/en-us/entra/agent-id/sign-in-audit-logs-agents) still prints the `AgentIdentity` literal, which is not a valid member of the `agentic.agentType` enum. The portal exposes the same data under **Entra ID** > **Monitoring & health** > **Sign-in logs** with **Agent type** and **Is Agent** filters. Count distinct `blueprintId` values to size the estate, then compare against the tenant-wide registry in the Microsoft 365 admin center under **Agents** > **All agents**, which also includes agents without an Entra agent identity. ### 2\. One Blueprint per Trust Boundary, One Identity per Agent A trust boundary is the shared risk surface where one compromise reaches everything inside it. Agents sharing a runtime, a file system, and a network namespace belong under one blueprint, per the [planning guidance](https://learn.microsoft.com/en-us/entra/agent-id/how-to-plan-agent-identity-architecture). Agents split across development, test, and production need separate blueprints so a leak in one cannot mint identities in another. Extra blueprints for scaling or audit separation buy nothing; more agent identities under one blueprint cover those needs. ### 3\. Remove Standing Credentials From Every Blueprint A managed identity registered as a [federated identity credential](https://adamtheautomator.com/entra-workload-identity-aks-no-more-secrets/) takes the secret out of the equation, and it is the documented production option. Create one with `POST /v1.0/applications//federatedIdentityCredentials`, the [federatedIdentityCredential create operation](https://learn.microsoft.com/en-us/graph/api/federatedidentitycredential-post?view=graph-rest-1.0), using issuer `https://login.microsoftonline.com//v2.0` and audience `api://AzureADTokenExchange`. Client secrets are [not recommended for production](https://learn.microsoft.com/en-us/entra/agent-id/create-blueprint) and are returned once at creation, so a secret that leaks later cannot be recovered or spotted on the application object. * * * _**Warning: Adding a credential to a blueprint is the exact move in Path 1. Alert on credential additions to every blueprint in the tenant, including the third-party blueprints you added from a publisher.**_ * * * ### 4\. Narrow Who Can Touch a Blueprint Agent ID Developer, Agent ID Administrator, and [AI Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#ai-administrator) are tier-0 roles in practice, because each reaches a credential path that ends in tenant control. The [admin role matrix](https://learn.microsoft.com/en-us/entra/agent-id/manage-agent-identities-admin) lists the tasks each agent role can perform. Only a named team holds them, and every credential addition or owner change on a blueprint pages someone. The consent channel needs the same attention: an employee clicking through a third-party agent’s consent page lands a blueprint principal in your tenant with `AgentIdentity.CreateAsManager` attached, and removing the principal is the only withdrawal. ## Contain and Watch the Blast Radius: Controls 5 Through 8 The first four controls remove standing credentials and narrow who can reach a blueprint. These four limit what an agent can do once it holds a token, and make what it did visible. ### 5\. Scope Conditional Access at the Blueprint [Conditional Access for agents](https://learn.microsoft.com/en-us/entra/identity/conditional-access/agent-id) evaluates token issuance and refresh for three subjects, and a policy has to target the subject that appears on the token. | Agent access pattern | Token subject | Policy target | | --- | --- | --- | | On behalf of a signed-in user | The user | Users and groups | | Autonomous, client credentials | The agent identity | Agent identity or blueprint | | Agent’s own user account | The agent’s user account | Agent Users | Blueprint scope is the lever worth pulling: one policy covers every identity created from that blueprint, including next quarter’s. A policy on an agent identity does not reach that agent’s user account, and the reverse holds. Policies scoped through **Users** do not cover agent user accounts. Conditional Access is not evaluated when a blueprint acquires a Graph token to create an identity, and not at the `AAD Token Exchange Endpoint: Public` endpoint, resource `fb60f99c-7a34-4190-8149-302f77469936`. An agent calling an API with its own key skips the pipeline, and security defaults mean no evaluation at all. * * * _**Warning: A Conditional Access policy aimed at an agent identity leaves that agent’s user account uncovered. If the agent reads mail or joins Teams, write a second policy that targets Agent Users.**_ * * * Audit the policy set first with the [Conditional Access policies list API](https://learn.microsoft.com/en-us/graph/api/conditionalaccessroot-list-policies?view=graph-rest-1.0): ```text GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies ``` Custom security attributes close the scale gap: tag identities with `Environment` and `DataSensitivity`, then target those attributes so a matching agent is covered on creation. ### 6\. Block the Permissions That Come Back A deny-list is not least privilege: it removes the four permissions Compass proved reachable and leaves every other allowed scope standing. Microsoft’s [least-privilege pattern for AI agents](https://learn.microsoft.com/en-us/security/zero-trust/sfi/least-privilege-for-ai-agents) scopes authorization to the task instead. Task-scoped roles cover the resources one workflow touches. Elevation arrives through JIT activation in [PIM](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure) rather than as a standing assignment, and the tools the agent may call sit on an allowlist. Set that scope at the blueprint in control 2, and build the deny-list below as the least-privilege backstop for agents already running: * `Application.ReadUpdate.All` * `RoleAssignmentSchedule.ReadWrite.Directory` * `RoleEligibilitySchedule.ReadWrite.Directory` * `PrivilegedAccess.ReadWrite.AzureADGroup` Check Azure RBAC separately, because directory restrictions do not follow an agent identity into a subscription. The list will shrink as Microsoft tightens the platform, so review it quarterly. ### 7\. Put a Sponsor on Every Agent and Make It Expire Every agent identity needs a sponsor, and the field is pickier than it looks: users, dynamic-membership groups (security or Microsoft 365), and assigned-membership Microsoft 365 groups work, while role-assignable groups and assigned-membership security groups do not, and groups cannot be owners. Set the sponsor in **Entra ID** > **Agents** > **Agent identities**, then build the policy in **Entra ID** > **ID Governance** > **Lifecycle Workflows** > **Lifecycle Policies** > **Agent ID (Preview)**. [The preview lifecycle engine](https://learn.microsoft.com/en-us/entra/id-governance/agent-lifecycle-policies) enforces the rest on a schedule and evaluates three rules: reconfirmation every 30 to 730 days, a minimum number of active sponsors, and inactivity measured as no tokens issued. Noncompliance opens a grace period, then the policy disables or soft deletes the identity. Microsoft states that lifecycle policies are not recommended for production workloads, so run them with a long grace period and keep a scheduled access review as the real control. ### 8\. Centralize the Logs Before You Need Them Entra audit and sign-in logs are the only record of who added a credential to which blueprint. Route them to a Log Analytics workspace through **Entra ID** > **Monitoring & health** > **Diagnostic settings**, then connect that workspace to [Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory) so the `agentType` filters from control 1 survive past the tenant’s native retention window. Once the logs land, a hunt for credential additions, [owner changes on service principals](https://adamtheautomator.com/stop-service-principal-sprawl-entra-id-powershell/), and fresh `agenticApp` objects becomes a query you rerun. ## The Blueprint Is the Boundary Every control in this article converges on one object. A blueprint you can enumerate, scope, and disable is the boundary between an agent that does a job and an agent that holds a credential nobody watches. Move it and those privilege escalation paths lose their entry point. Start with the inventory in control 1 this week, then disable any blueprint whose owner cannot say what it creates. Two gaps stay open. Third-party blueprints authenticate into your tenant from wherever the publisher runs them, and the documented controls are deleting the blueprint principal, scoping Conditional Access to it, and app consent policies that block employee consent. Agents built as ordinary app registrations before Agent ID appear in Entra **Agents** > [**Agent identities**](https://learn.microsoft.com/en-us/entra/agent-id/agent-lists) with **Uses agent identity** = No, while the tenant-wide registry sits in the Microsoft 365 admin center under **Agents** > **All agents**. Neither is covered above; both need a named owner and a review date. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fentra-agent-id-privilege-escalation%2F&text=Entra%20Agent%20IDs%3A%20How%20to%20Stop%20AI%20Privilege%20Escalation)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fentra-agent-id-privilege-escalation%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fentra-agent-id-privilege-escalation%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/publisher/4065d9c85b2b81c2b28df93eee431250/47ab8e33fb2d780dfd7da807ba1617d86ba92a550b57fa1b3c98e4981b0da276.webp) ### [Microsoft Graph API MCP Server: Automate User Provisioning](/microsoft-graph-api-mcp-server-provisioning/) Build a local Microsoft Graph API MCP server in Python to create disabled test users, assign an approved license, and verify each provisioning step. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3ec5d9c85b2b81178e9ac5b3109d7e40/a17dc7e937f939221a5e25aadd5f5749c67f0e262d984e9b032a40d083fe81f4.png) ### [Find Expiring App Registration Secrets Before an Outage](/find-expiring-app-registration-secrets/) Report expiring app registration secrets and certificates with PowerShell and Microsoft Graph, route each one to its owner, and rotate it safely. ![](https://adamtheautomator.com/wp-content/uploads/publisher/2e05d9c85b2b81c080b8d45ec1cdfbb3/71dd588b2369d52e1695c95c1493383c6c0ed2adb4aac7eba04c1ab324f3a6a6.webp) ### [Stop Service Principal Sprawl in Entra ID with PowerShell](/stop-service-principal-sprawl-entra-id-powershell/) Inventory every app registration and service principal, then automate ownership, rotation, and safe disablement with PowerShell and Microsoft Graph. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)