EIDSCA.AP15 - Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints.
Overview
Controls whether users can create agent identity blueprints and their associated principals through the default user role. Blueprint creators become owners and can create agent identities for their blueprints. Allowing creation does not itself grant access to organizational data.
Restrict agent identity blueprint creation through the default user role. Use designated Agent ID roles to govern creation. Blueprint creation and permission grants are separate controls; restricting creation does not disable existing blueprints or agent identities.
Test script
https://graph.microsoft.com/beta/policies/authorizationPolicy
.defaultUserRolePermissions.allowedToCreateAgentIdentityBlueprints -eq 'false'
Remediation action
In Microsoft Entra user settings, set Users can create agent blueprints to No. Review the impact on approved agent development workflows. See Microsoft Learn - Create an agent identity blueprint.
Related links
- Open in Graph Explorer
- authorizationPolicy resource type - Microsoft Graph beta | Microsoft Learn
- View in Microsoft Entra admin center
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.AP15 |
| Severity | Medium |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | Agent identities |
| Area | AI and agents |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1136.003 Cloud Account |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtCheckEidscaAP15 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.AP15.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.AP15.md