Restrict creation of agent identity blueprints to administrators

Description

In Microsoft Entra Agent ID, an agent identity blueprint defines how AI agent identities are created: their credentials, the permissions they can request and the redirect URIs used during consent. The default user role permission Users can register agent identity blueprints lets every member user create one. It is separate from Users can register applications (CB-M365-APPS-001): turning that one off does not block blueprints.

Set the permission to No, so that only administrators and holders of the Agent ID Developer or Agent ID Administrator roles create blueprints.

The Graph property is defaultUserRolePermissions.allowedToCreateAgentIdentityBlueprints on the beta endpoint of /policies/authorizationPolicy; v1.0 does not return it yet. During the rollout, the toggle may not appear in every tenant.

Rationale

A blueprint created by an ordinary user can request broad permissions, carry long-lived secrets and spawn agent identities that nobody in identity administration knows about. Limiting creation to a small set of roles keeps AI agents inside the same review process as applications. Microsoft enables the permission for all users by default in November 2026.

Impact

Developers who build agents must request the Agent ID Developer role or go through an administrator. Existing blueprints are not removed by the change.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Users > User settings.
3. Under Default user role permissions, read Users can register agent identity blueprints.
4. Alternative (read-only): Invoke-MgGraphRequest -Method GET -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy' and read defaultUserRolePermissions.allowedToCreateAgentIdentityBlueprints.
5. Fail if the setting is Yes (or true).

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
2. Browse to Entra ID > Users > User settings.
3. Set Users can register agent identity blueprints to No and select Save.
4. Grant the Agent ID Developer role to the people who build agents.

Rollback

Set Users can register agent identity blueprints back to Yes.

References

• Agent identity blueprints in Microsoft Entra Agent ID Microsoft, vendor-doc, accessed 2026-10-24
• Microsoft Plans to Allow Users to Create Agent Blueprints Office 365 for IT Pros, other, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-APPS-001 Restrict application registration to administrators
• related CB-M365-TENANT-001 Restrict tenant creation to administrators

People and lifecycle