MT.1207 - Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview)
Overview
Foreign or multi-tenant Agent Blueprints and Agent Identities should not hold privileged directory roles without review.
Multi-tenant Agent Blueprints originate in an external Microsoft Entra tenant. If a foreign Blueprint Principal or its child Agent Identities are granted a privileged directory role (like Global Administrator), a compromise of the blueprint or credentials in the external home tenant could compromise your local resources.
Foreign Blueprint Principals and their child Agent Identities must not be assigned privileged Microsoft Entra directory roles. Application permissions assigned to foreign Blueprint Principals should also be reviewed to confirm that they are necessary and follow least privilege. These application permissions are shown for review but do not cause the test to fail on their own.
Remediation action:
- Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent blueprints.
- Locate the reported foreign Blueprint Principal using its Object ID or display name.
- Review its Assigned roles in Entra ID > Roles & administrators.
- If privileged roles or unnecessary application permissions were assigned:
- Remove directory role assignments and replace them with least-privilege delegated assignments.
- Restrict application role assignments to only the specific resources required by the agent.
- If the multi-tenant agent is untrusted or no longer required, remove the Blueprint Principal.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1207 |
| Severity | High |
| Suite | Maester |
| Category | Entra |
| PowerShell test | Test-MtEntraAgentForeignPrivileged |
| Tags | Entra, Graph, LongRunning, Maester, MT.1207, Preview, Severity:High |
Source
- Pester test:
tests/Maester/Entra/Test-MtEntraAgentSecurity.Tests.ps1 - PowerShell source:
powershell/public/maester/entra/Test-MtEntraAgentForeignPrivileged.ps1