Reference
Automations for Microsoft Agent 365
See the Microsoft Agent 365 inventory reference for the objects these templates work on.
| Automation | Description | Category | Applies to |
|---|---|---|---|
| Block shadow AI agent | Creates an Intune device configuration policy to block an unsanctioned AI agent on managed devices. | Security | — |
| Delete agent blueprint | Permanently deletes a Microsoft Entra agent identity blueprint via DELETE /applications/{id}. Cascades to its child agent identities. | Security | — |
| Delete agent identity | Permanently deletes a Microsoft Entra agent identity via DELETE /servicePrincipals/{id}. | Security | — |
| Disable agent blueprint principal (kill switch) | Sets accountEnabled = false on the agent identity blueprint principal via PATCH /servicePrincipals/{id} - the tenant-wide kill switch for every agent identity created from this blueprint. | Security | — |
| Disable agent identity | Disables a Microsoft Entra agent identity so it can no longer authenticate. | Security | — |
| Mark shadow AI agent as approved | Marks a shadow AI agent as sanctioned so it is excluded from the Shadow AI policies. | Operation | — |
| Notify about shadow AI agent | Sends an email notifying the responsible user or owner that an unsanctioned AI tool was detected. | Operation | — |
| Notify about orphaned agent identity | Sends an email to an administrator that an agent identity has no registered sponsor and needs one assigned. | Operation | — |
| Rename agent blueprint | Updates the displayName of a Microsoft Entra agent identity blueprint via PATCH /applications/{id}. | Operation | — |
| Rename agent identity | Updates the displayName of a Microsoft Entra agent identity via PATCH /servicePrincipals/{id}. | Operation | — |
| Remind about agent credential rotation | Sends an email reminder that an agent identity's or blueprint's credential is expiring soon. | Operation | — |