MT.1201 - Agent Users should have an existing parent Agent Identity (Preview)
Overview
Agent Users should have an existing Agent Identity.
An Agent User is the Entra user account paired with an Agent Identity. Some agents need this second account to access systems that require a user account. The two accounts should share the same lifecycle.
This check looks for Agent Users whose parent Agent Identity is missing. The account can be left behind after the agent is deleted and may still have group memberships, licenses, or other access. That makes it harder to tell why the account exists and whether it should still have access.
Remediation action:
- Open the Microsoft Entra admin center and go to Entra ID >
Users. Search for the Agent User by its Object ID or user principal name. The
report's parent value is an object ID;
identityParentIdis not a portal field. - Go to Entra ID > Agents > Agent identities and search for the parent Agent Identity object ID. Review its status, owners and sponsors, permissions, audit logs, and sign-in logs if it still exists.
- If the Agent Identity is still needed, follow Microsoft's restore guidance. If its blueprint or Blueprint Principal was deleted, restore that parent first when possible.
- If the Agent User is no longer needed, review its group memberships, licenses, and access. Then delete it from Entra ID > Users or follow Microsoft's Agent ID deletion guidance. Deletion is soft by default, so the user can normally be restored for 30 days.
Related links
- Agent User resource
- View and filter agent identities
- How to delete and restore agent identity objects
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1201 |
| Severity | Medium |
| Suite | Maester |
| Category | Entra |
| PowerShell test | Test-MtEntraAgentUserOrphaned |
| Tags | Entra, Graph, Maester, MT.1201, Preview, Severity:Medium |
Source
- Pester test:
tests/Maester/Entra/Test-MtEntraAgentIdOrphaned.Tests.ps1 - PowerShell source:
powershell/public/maester/entra/Test-MtEntraAgentUserOrphaned.ps1