MT.1204 - Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview)
Overview
Agent Identities, Blueprint Principals, and Blueprints should have at least one active, enabled owner.
Owners are the technical custodians responsible for an AI agent's configuration, credentials, and lifecycle. When an agent or blueprint has no assigned owners—or when all assigned owners are deleted or disabled user accounts—the agent becomes unmanaged, making it harder to review security access, investigate anomalies, or safely decommission stale resources.
This check audits all Agent Identities, Blueprint Principals, and Blueprints in the tenant to confirm they have at least one active and enabled owner.
Remediation action:
- Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent identities (or Agent blueprints).
- Search for the reported object by its Object ID or display name.
- Under Access, select Owners and sponsors.
- For a Blueprint, select the Agent blueprint or Agent blueprint principal tab for the reported object.
- Select Add > Add owner, choose at least one active, responsible administrator or service manager, and select Add.
- Review any existing owners and remove any disabled or former employee accounts.
Related links
- View and filter agent identities
- View and manage agent blueprints
- Manage owners and sponsors for Entra Agent ID
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1204 |
| Severity | Medium |
| Suite | Maester |
| Category | Entra |
| PowerShell test | Test-MtEntraAgentOwner |
| Tags | Entra, Graph, LongRunning, Maester, MT.1204, Preview, Severity:Medium |
Source
- Pester test:
tests/Maester/Entra/Test-MtEntraAgentSecurity.Tests.ps1 - PowerShell source:
powershell/public/maester/entra/Test-MtEntraAgentOwner.ps1