Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints

Contributed by Thomas NaunheimAll contributors →

Part of Entra ID SCA · Entra ID · Agent identities · All checks

Run this check

Invoke-Maester -TestId EIDSCA.AP15

Overview

Controls whether users can create agent identity blueprints and their associated principals through the default user role. Blueprint creators become owners and can create agent identities for their blueprints. Allowing creation does not itself grant access to organizational data.

Restrict agent identity blueprint creation through the default user role. Use designated Agent ID roles to govern creation. Blueprint creation and permission grants are separate controls; restricting creation does not disable existing blueprints or agent identities.

Test script

https://graph.microsoft.com/beta/policies/authorizationPolicy
.defaultUserRolePermissions.allowedToCreateAgentIdentityBlueprints -eq 'false'

Remediation action

In Microsoft Entra user settings, set Users can create agent blueprints to No. Review the impact on approved agent development workflows. See Microsoft Learn - Create an agent identity blueprint.

Related links

• Open in Graph Explorer
• authorizationPolicy resource type - Microsoft Graph beta | Microsoft Learn
• View in Microsoft Entra admin center

Details

Every attribute of this check

Field	Value
Test ID	EIDSCA.AP15
Severity	Medium
Suite	Entra ID SCA
Product	Entra ID
Feature	Agent identities
Area	AI and agents
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1136.003 Cloud Account
Supports controls	nist-800-53-r5:AC-6
PowerShell test	Test-MtCheckEidscaAP15
Services	Graph

Source

• Test: tests/eidsca/Test.EIDSCA.AP15.ps1
• Documentation: tests/eidsca/Test.EIDSCA.AP15.md