Reference
Automation actions for Microsoft Agent 365
Actions automations can run against Microsoft Agent 365.
| Action | Description | Category |
|---|---|---|
| Block a Shadow AI agent on managed devices | Creates a Microsoft Intune device configuration policy that blocks the agent's executable from running on managed Windows devices, mirroring the Microsoft 365 admin center 'block' action. | Change property |
| Delete an Agent Blueprint | Deletes a Microsoft Entra agent identity blueprint via DELETE /applications/{id} (see https://learn.microsoft.com/en-us/graph/api/agentidentityblueprint-delete). Disable the blueprint principal first if there is any chance the blueprint is still in active use - deleting it cascades to its child agent identities. | Delete Content |
| Delete an Agent Identity | Deletes a Microsoft Entra agent identity. See https://learn.microsoft.com/en-us/graph/api/agentidentity-delete - removes the identity entirely; consider Disable first if there is any chance the agent is still needed. | Delete Content |
| Disable an Agent Blueprint Principal (kill switch) | Sets accountEnabled = false on the agent identity blueprint principal via PATCH /servicePrincipals/{id}. This is the tenant-side kill switch - it disables token issuance for every agent identity created from this blueprint. | Change property |
| Disable an Agent Identity | Disables a Microsoft Entra agent identity (sets accountEnabled = false on the underlying servicePrincipal) so it can no longer authenticate. | Change property |
| Mark a Shadow AI agent as approved | Marks a shadow AI agent as sanctioned by IT. Approved agents are excluded from the Shadow AI policies. | Change property |
| Rename an Agent Blueprint | Updates the displayName of a Microsoft Entra agent identity blueprint via PATCH /applications/{id}. | Change property |
| Rename an Agent Identity | Updates the displayName of a Microsoft Entra agent identity via PATCH /servicePrincipals/{id}. | Change property |