# Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints

Controls whether users can create agent identity blueprints and their associated principals through the default user role.

Source: https://maester.dev/docs/tests/EIDSCA.AP15

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/cloud-architekt" title="Thomas Naunheim · Original author"><img src="https://github.com/Cloud-Architekt.png" alt="Thomas Naunheim" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/cloud-architekt">Thomas Naunheim</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/eidsca">Entra ID SCA</a> · Entra ID · Agent identities · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId EIDSCA.AP15
```

## Overview

Controls whether users can create agent identity blueprints and their associated principals through the default user role. Blueprint creators become owners and can create agent identities for their blueprints. Allowing creation does not itself grant access to organizational data.

Restrict agent identity blueprint creation through the default user role. Use designated Agent ID roles to govern creation. Blueprint creation and permission grants are separate controls; restricting creation does not disable existing blueprints or agent identities.

#### Test script
```
https://graph.microsoft.com/beta/policies/authorizationPolicy
.defaultUserRolePermissions.allowedToCreateAgentIdentityBlueprints -eq 'false'
```

#### Remediation action

In Microsoft Entra user settings, set Users can create agent blueprints to No. Review the impact on approved agent development workflows. See [Microsoft Learn - Create an agent identity blueprint](https://learn.microsoft.com/entra/agent-id/create-blueprint).

#### Related links

- [Open in Graph Explorer](https://developer.microsoft.com/graph/graph-explorer?request=policies/authorizationPolicy&method=GET&version=beta&GraphUrl=https://graph.microsoft.com)
- [authorizationPolicy resource type - Microsoft Graph beta | Microsoft Learn](https://learn.microsoft.com/graph/api/resources/authorizationpolicy?view=graph-rest-beta)
- [View in Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserManagementMenuBlade/~/UserSettings)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | EIDSCA.AP15 |
| Severity | Medium |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | Agent identities |
| Area | AI and agents |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1136.003 Cloud Account |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | [Test-MtCheckEidscaAP15](https://github.com/maester365/maester/blob/main/tests/eidsca/Test.EIDSCA.AP15.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/eidsca/Test.EIDSCA.AP15.ps1`](https://github.com/maester365/maester/blob/main/tests/eidsca/Test.EIDSCA.AP15.ps1)
- Documentation: [`tests/eidsca/Test.EIDSCA.AP15.md`](https://github.com/maester365/maester/blob/main/tests/eidsca/Test.EIDSCA.AP15.md)