Skip to main content
Version: 2.2.1-preview

MT.1211 - Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview)

Agnivesh S.
Contributed by Agnivesh S.All contributors →

Overview​

Agent Identity Blueprints should pass only explicitly selected delegated scopes and application roles to their child Agent Identities.

The allAllowed inheritance pattern gives every child Agent Identity all permissions granted to the Blueprint for a resource, without requiring separate consent. It also applies permissions granted to the Blueprint in the future. This can give existing and future Agent Identities broader access than intended and increases the impact of an unnecessary or high-risk permission assignment.

This test reports Agent Identity Blueprints that allow all delegated scopes or all application roles to be inherited. Each Blueprint should instead define only the permissions its child Agent Identities require.

Remediation action:​

  1. Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent blueprints.
  2. Locate the reported Blueprint using its Object ID or display name.
  3. Review its inheritable permissions configuration for the reported resource.
  4. Replace the allAllowed pattern with an enumerated list: use enumerated scopes for delegated scope findings and enumerated application roles for application role findings. Include only the permissions agents require.
  5. Re-consent affected Agent Identities if narrowing the inheritance pattern removes permissions they were using.

Test Metadata​

FieldValue
Test IDMT.1211
SeverityHigh
SuiteMaester
CategoryEntra
PowerShell testTest-MtEntraAgentBlueprintAllAllowedInheritance
TagsEntra, Graph, LongRunning, Maester, MT.1211, Preview, Severity:High

Source​

  • Pester test: tests/Maester/Entra/Test-MtEntraAgentSecurity.Tests.ps1
  • PowerShell source: powershell/public/maester/entra/Test-MtEntraAgentBlueprintAllAllowedInheritance.ps1