MT.1203 - Agent Identity Blueprint Principals should have an existing Blueprint (Preview)
Overview
Agent Identity Blueprint Principals should have an existing Blueprint.
An Agent Identity Blueprint defines how Agent Identities are created and managed. A Blueprint Principal is the service principal created from that Blueprint in the tenant. If the Blueprint is deleted but the Principal remains, the linked Agent Identities can fall outside the Blueprint's management and lifecycle.
This check lists Blueprint Principals whose Blueprint no longer exists. Review each one before deleting or restoring anything. The remaining Principal or Agent Identities may still have permissions and access assignments.
Remediation action:
- Open the Microsoft Entra admin center and go to Entra ID > Agents > Agent blueprints.
- Search for the reported Blueprint App ID and confirm whether the Blueprint was deleted or whether the Blueprint Principal is no longer required.
- Review the reported Blueprint Principal and linked Agent Identity object IDs, including their owners, sponsors, permissions, audit logs, and sign-in logs.
- If the agent is still required, follow Microsoft's restore guidance. If it is no longer required, disable the linked identities, review their access, and then remove the stale Agent ID objects in the order described by Microsoft.
Related links
- View and manage Agent Identity Blueprints
- How to delete and restore Agent Identity objects
- Agent Identity Blueprint resource
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1203 |
| Severity | Medium |
| Suite | Maester |
| Category | Entra |
| PowerShell test | Test-MtEntraAgentBlueprintOrphaned |
| Tags | Entra, Graph, Maester, MT.1203, Preview, Severity:Medium |
Source
- Pester test:
tests/Maester/Entra/Test-MtEntraAgentBlueprintOrphaned.Tests.ps1 - PowerShell source:
powershell/public/maester/entra/Test-MtEntraAgentBlueprintOrphaned.ps1