MT.1212 - Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview)

Contributed by Agnivesh S.All contributors →

Overview

Agent Identity Blueprint Principals that expose application roles should require an explicit assignment before another identity can use them.

Application roles control which applications or agents can access capabilities provided by an Agent Identity Blueprint Principal. If assignment isn't required, an identity in the tenant may receive a token for an enabled role without an administrator explicitly granting it access. Requiring assignment ensures that only approved identities can use those roles.

This test reports Agent Identity Blueprint Principals that expose at least one enabled application role but don't require assignment. Disabled application roles aren't included in the assessment.

Remediation action:

1. Open the Microsoft Entra admin center and navigate to Entra ID > Enterprise applications.
2. Locate the reported Blueprint Principal using its Object ID or display name.
3. Under Properties, set Assignment required? to Yes.
4. Under Users and groups (or the equivalent app role assignment surface), explicitly assign the principals that should be able to obtain tokens for the exposed roles.

Related links

• View and manage agent blueprints
• Restrict your Microsoft Entra app to a set of users

Test Metadata

Field	Value
Test ID	MT.1212
Severity	Medium
Suite	Maester
Category	Entra
PowerShell test	Test-MtEntraAgentBlueprintOpenAccess
Tags	Entra, Graph, Maester, MT.1212, Preview, Severity:Medium

Source

• Pester test: tests/Maester/Entra/Test-MtEntraAgentSecurity.Tests.ps1
• PowerShell source: powershell/public/maester/entra/Test-MtEntraAgentBlueprintOpenAccess.ps1