Control who can create agent blueprints in Microsoft Entra

Microsoft Entra will allow default users to create agent blueprints unless an administrator turns off the setting. Starting in November 2026, users without a built-in or custom Entra role will be able to create new agent blueprints in your organization.

An agent identity blueprint is an object in Microsoft Entra ID that serves as a template for creating agent identities. It establishes the foundation for how agents are created, authenticated, and managed within an organization. The agent identity blueprint is a key component of the Microsoft agent identity platform that enables secure development and administration of AI agents at scale.

Timeline

Default users can create agent blueprints from 4 November unless the setting is turned off. The rollout should be completed by the end of November 2026.

How does this affect your organization?

Before this change, only administrators and users with the Agent ID Developer role can create agent blueprints.
After the rollout, any default user can create new agent blueprints and their identities, unless an admin sets the toggle to No.

Admins with at least the Cloud Application Administrator role can configure the setting now, ahead of the rollout. Your choice does not change tenant behavior immediately and takes effect in November 2026 when the rollout begins in your tenant.

To update the setting, open Microsoft Entra ID > Users > User Settings.

The setting has two values:

• Yes: Default users can create new agent blueprints. This is the default setting and applies after the rollout if you make no change.
• No: Default users cannot create new agent blueprints. Supported administrators and users with the Agent ID Developer role can still create them.

This change does not affect existing agent blueprints, the ability to create agent identities from existing blueprints, or identity creation by apps and agents. It also does not change creation requirements in platforms such as Microsoft Foundry or Security Copilot.

Update via Microsoft Graph

You can also update the setting via the authorizationPolicy endpoint. Use the Beta endpoint, as the property allowedToCreateAgentIdentityBlueprints is not yet returned via v1.

Import-Module Microsoft.Graph.Authentication
Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"

# Get the current authorization policy 
$Url = "https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy"
$AuthorizationPolicy = Invoke-MgGraphRequest -Method GET -Uri $Url
($AuthorizationPolicy | select -expand defaultUserRolePermissions).GetEnumerator() | ?{$_.Name -eq "allowedToCreateAgentIdentityBlueprints" } | ft -AutoSize

Patch the property to update the setting.

# Set the new value for allowedToCreateAgentIdentityBlueprints 
$AuthorizationPolicyBody = @{
    defaultUserRolePermissions = @{
        allowedToCreateAgentIdentityBlueprints = $false
    }
} 

Invoke-MgGraphRequest -Method PATCH -Uri $Url -Body $AuthorizationPolicyBody -ContentType "application/json"