Microsoft Entra: Changes to AgentIdentity.CreateAsManager permission for agent identities

Starting November 4, Microsoft Entra will stop automatically granting the AgentIdentity.CreateAsManager permission to agent blueprints. Admin consent will be required for agents to create identities. This change, rolling out worldwide in November 2026, enhances control and auditability of agent identity creation. Microsoft Entra Agent ID is enforcing tighter restrictions for autonomous creation of an agent’s own identities. Currently, all agents are granted AgentIdentity.CreateAsManager upon creation without administrator approval. Starting November 4, Microsoft Entra will no longer automatically grant AgentIdentity.CreateAsManager to agent blueprint principals, and creation of identities will need an admin to grant consent. Agents that use app-only authentication to create their own agent identities must be explicitly granted the AgentIdentity.CreateAsManager Microsoft Graph application permission or move to another supported authorization model before enforcement reaches their tenant. Rollout schedule General Availability (Worldwide): Beginning in early November 2026 and expected to complete by late November 2026 Impact on your organization Who is affected Organizations using Microsoft Entra  No action is required if your organization doesn’t have an agent that depends on the automatic AgentIdentity.CreateAsManager grant. Platforms and services Microsoft Entra What will happen Today, an agent blueprint principal is granted AgentIdentity.CreateAsManager automatically. This implicit grant allows the principal to create agent identities without a tenant-admin granting an app-role assignment. After enforcement, an administrator must grant the Microsoft Graph application permission AgentIdentity.CreateAsManager to agents that needs this authority. This change: Makes app-only agent identity creation authority visible, auditable, and revocable. Makes AgentIdentity.CreateAsManager revocable if consented Affects existing and future agents. Doesn’t remove existing agent identities or agent blueprints. Doesn’t remove the ability for agent identity blueprints to create agent identities, when AgentIdentity.CreateAsManager is explicitly granted by an administrator Doesn’t affect an agent that uses a directory role to authorize creation of agent identities. Action required and recommendations No action is required if your organization doesn’t have an agent that depends on the automatic AgentIdentity.CreateAsManager grant. Identify agents that create agent identities without a signed-in user. Sign in to the Microsoft Entra admin center. Go to Entra ID>Audit Logs. Set the Category to “ApplicationManagement” Set the Activity filter to “Add Service Principal” Find […]

The post Microsoft Entra: Changes to AgentIdentity.CreateAsManager permission for agent identities appeared first on M365 Admin.