MT.1213 - Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview)

Contributed by Agnivesh S.All contributors →

Overview

Agent Identity Blueprints should use specific, secure redirect URIs.

During interactive consent, Microsoft Entra sends the consent result and optional state value to a redirect URI registered on the Blueprint. A wildcard can route that response to an unintended or attacker-controlled matching address. A plain HTTP address sends the response without transport encryption, allowing someone who can observe or alter network traffic to intercept or tamper with the consent result or state. HTTP loopback addresses are permitted for local development because the response stays on the same device instead of travelling across the network; they should not be used for deployed endpoints.

This test reports Agent Identity Blueprints with a wildcard redirect URI or a non-loopback HTTP redirect URI. Redirect URIs should identify a specific destination and use HTTPS unless they are loopback addresses used for local development.

Remediation action:

1. Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent blueprints.
2. Locate the reported Blueprint using its Object ID or display name.
3. Under Authentication, remove the reported redirect URI.
4. Replace it with a specific, https-only URI (or an http://localhost/loopback URI for local development only).

Related links

• View and manage agent blueprints
• Redirect URI (reply URL) restrictions and limitations

Test Metadata

Field	Value
Test ID	MT.1213
Severity	High
Suite	Maester
Category	Entra
PowerShell test	Test-MtEntraAgentBlueprintRedirectUriHygiene
Tags	Entra, Graph, Maester, MT.1213, Preview, Severity:High

Source

• Pester test: tests/Maester/Entra/Test-MtEntraAgentSecurity.Tests.ps1
• PowerShell source: powershell/public/maester/entra/Test-MtEntraAgentBlueprintRedirectUriHygiene.ps1