MT.1223 - Agent Identities should not have high-risk Microsoft Graph permissions (Preview)

Contributed by Agnivesh S.All contributors →

Overview

Agent Identities should not have high-risk Microsoft Graph permissions.

Agent Identities can be granted Microsoft Graph application permissions and delegated permission scopes. Some permissions provide a path to privileged control of the tenant if an Agent Identity is compromised.

This check reports Agent Identities assigned permissions that Maester classifies as high risk and that Microsoft does not currently list as blocked for Agent Identities. It evaluates application and delegated grants together and identifies the permission type in each finding.

A Direct attack path can provide privileged control using the reported permission itself. An Indirect attack path requires another permission, configuration, or identity to complete the escalation path. The check evaluates the following permissions:

Permission	Attack path
AdministrativeUnit.ReadWrite.All	Indirect
DeviceManagementConfiguration.ReadWrite.All	Indirect
DeviceManagementRBAC.ReadWrite.All	Indirect
Policy.ReadWrite.ConditionalAccess	Direct
PrivilegedAccess.ReadWrite.AzureADGroup	Direct
PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup	Direct
PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup	Indirect
RoleAssignmentSchedule.ReadWrite.Directory	Direct
RoleEligibilitySchedule.ReadWrite.Directory	Indirect
RoleManagementPolicy.ReadWrite.AzureADGroup	Indirect
RoleManagementPolicy.ReadWrite.Directory	Indirect

Remediation action:

1. Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent identities.
2. Locate the reported Agent Identity using its object ID or display name, then review its granted permissions.
3. Confirm the business requirement with the Agent Identity's owner and sponsor. Determine whether the permission was assigned directly or inherited from its Agent Identity Blueprint.
4. Remove an unnecessary direct application or delegated grant. For an inherited delegated scope, update the Blueprint's inheritable permissions to use only the enumerated scopes its agents need.
5. If the permission is required, replace it with a narrower Microsoft Graph permission where possible and document the approved exception.
6. If the grant was unexpected, review the Agent Identity's audit and sign-in logs and rotate any credentials that might have been exposed.

Related links

• Manage agent identities in your organization
• Microsoft Graph permissions blocked for agents
• Microsoft Graph permissions reference
• Maester high-risk permission research

Test Metadata

Field	Value
Test ID	MT.1223
Severity	High
Suite	Maester
Category	Entra
PowerShell test	Test-MtEntraAgentHighRiskGraphPermissions
Tags	Entra, Graph, LongRunning, Maester, MT.1223, Preview, Severity:High

Source

• Pester test: tests/Maester/Entra/Test-MtEntraAgentHighRiskGraphPermissions.Tests.ps1
• PowerShell source: powershell/public/maester/entra/Test-MtEntraAgentHighRiskGraphPermissions.ps1