MT.1200 - Agent Identities should have an active Agent Identity Blueprint Principal (Preview)
Overview
Agent Identities should have an existing Agent Identity Blueprint Principal.
An Agent Identity is the account an AI agent uses to access resources in your tenant. It is created from an Agent Identity Blueprint. The Blueprint Principal is the tenant's copy of that blueprint and provides the parent relationship used to manage the agent's ownership, permissions, and lifecycle.
This check looks for Agent Identities whose parent Blueprint Principal is missing. Without that parent, the identity may no longer be able to authenticate or be managed through its blueprint. It can also leave stale directory data and access assignments in the tenant. Treat a finding as something to investigate. Confirm why the identity exists and whether it is still needed before deleting it.
Remediation action:
- Open the Microsoft Entra admin center and go to Entra ID > Agents > Agent identities. Search for the reported identity by its Object ID or name.
- Review its status, owners and sponsors, permissions, audit logs, and sign-in logs. If the report includes a Blueprint App ID, use it to find the parent blueprint.
- Go to Entra ID > Agents > Agent blueprints and search by Blueprint App ID. If the blueprint is present, review its status and linked agent identities. If it is missing, find out whether it was deleted or removed from the tenant.
- If the agent is still needed, follow Microsoft's restore guidance. The admin center cannot restore a blueprint or Blueprint Principal.
- If the agent is no longer needed, disable it first, review its access, and then follow Microsoft's delete guidance. Deleting a blueprint or Blueprint Principal can also clean up its child identities and Agent Users.
Related links
- View and filter agent identities
- View and manage agent identity blueprints
- Disable agent identities
- How to delete and restore agent identity objects
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1200 |
| Severity | Medium |
| Suite | Maester |
| Category | Entra |
| PowerShell test | Test-MtEntraAgentIdentityOrphaned |
| Tags | Entra, Graph, Maester, MT.1200, Preview, Severity:Medium |
Source
- Pester test:
tests/Maester/Entra/Test-MtEntraAgentIdOrphaned.Tests.ps1 - PowerShell source:
powershell/public/maester/entra/Test-MtEntraAgentIdentityOrphaned.ps1