Agent Blueprint

Microsoft Entra agent identity blueprint - a template (inherits from application) that defines the configuration agent identities created from it inherit. Holds credentials (keyCredentials, passwordCredentials, federatedIdentityCredentials), inheritable permissions, owners, and sponsors.

Part of the Microsoft Agent 365 inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Daily	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	Yes

Properties

Property	Type	Description	Automation placeholder
App id	String	appId of the blueprint. Same value links the matching agentIdentityBlueprintPrincipal in the tenant.	{{AgentBlueprint.AppId}}
Created by app id	String	appId of the application that created the blueprint (set by Microsoft Entra ID).	{{AgentBlueprint.CreatedByAppId}}
Created on	DateTime	Time the blueprint was registered (ISO 8601, UTC).	{{AgentBlueprint.CreatedDateTime}}
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	{{AgentBlueprint.CreatedTime}}
Description	String	Free-text description of the blueprint (max 1,024 characters).	{{AgentBlueprint.Description}}
Disabled by Microsoft	String	Microsoft-initiated disable status. Values: null (default), NotDisabled, DisabledDueToViolationOfServicesAgreement.	{{AgentBlueprint.DisabledByMicrosoftStatus}}
Deactivated owner count	Int32	Number of registered owners whose Microsoft Entra user account is disabled (AccountEnabled == false). An owner is the human responsible for the blueprint's technical operations; a disabled owner account means that accountability is no longer functional. Resolved against the owners' user accounts during the cross-entity rollup pass (same pass that populates LinkedIdentityCount); not a direct Graph property.	{{AgentBlueprint.DisabledOwnerCount}}
Deactivated sponsor count	Int32	Number of registered sponsors whose Microsoft Entra user account is disabled (AccountEnabled == false). Every agent identity blueprint must have an accountable human sponsor; a disabled sponsor account breaks the human-oversight safety net. Resolved against the sponsors' user accounts during the cross-entity rollup pass; not a direct Graph property.	{{AgentBlueprint.DisabledSponsorCount}}
Display Name	String		{{AgentBlueprint.DisplayName}}
Federated credential count	Int32	Number of federatedIdentityCredentials registered on the blueprint. Computed during inventory.	{{AgentBlueprint.FederatedCredentialCount}}
Id	String	Object id of the agent identity blueprint (application object id).	{{AgentBlueprint.Id}}
Identifier URIs	String	Comma-separated list of App ID URIs declared by the blueprint.	{{AgentBlueprint.IdentifierUris}}
Inheritable permission count	Int32	Number of entries in the inheritablePermissions relationship - scopes preauthorized to be granted to child agent identities. Computed during inventory.	{{AgentBlueprint.InheritablePermissionCount}}
Key credential count	Int32	Number of keyCredentials (certificates) registered on the blueprint. Computed during inventory.	{{AgentBlueprint.KeyCredentialCount}}
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	{{AgentBlueprint.LastModifiedTime}}
Linked identity count	Int32	Number of agent identities created from this blueprint (matched by agentIdentityBlueprintId == this blueprint's appId). Computed during inventory; not a Graph property.	{{AgentBlueprint.LinkedIdentityCount}}
Oldest credential expires	DateTime	Earliest endDateTime across passwordCredentials and keyCredentials on the blueprint. Computed during inventory.	{{AgentBlueprint.OldestCredentialExpiresAt}}
Owner count	Int32	Number of owners registered on the blueprint. Computed during inventory; not a Graph property.	{{AgentBlueprint.OwnerCount}}
Password credential count	Int32	Number of passwordCredentials registered on the blueprint. Computed during inventory.	{{AgentBlueprint.PasswordCredentialCount}}
Publisher domain	String	Verified publisher domain for the blueprint.	{{AgentBlueprint.PublisherDomain}}
Risk Score	Int32	Stores risk score	{{AgentBlueprint.RiskScore}}
Risk Score Update	DateTime	Stores risk score update	{{AgentBlueprint.RiskScoreLastUpdate}}
Risk Score Value	String	Stores risk score value like Low_Low	{{AgentBlueprint.RiskScoreValue}}
Service management reference	String	Service or asset management database reference.	{{AgentBlueprint.ServiceManagementReference}}
Sign-in audience	String	Supported sign-in audience (AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount).	{{AgentBlueprint.SignInAudience}}
Sponsor count	Int32	Number of sponsors registered on the blueprint. Computed during inventory; not a Graph property.	{{AgentBlueprint.SponsorCount}}
Tags	String	Comma-separated custom tags declared on the blueprint.	{{AgentBlueprint.Tags}}
Unique name	String	Optional alternate key set on the blueprint.	{{AgentBlueprint.UniqueName}}
Uses password credential	Boolean	True when the blueprint has at least one passwordCredential. Federated or key credentials are preferred for production agents. Computed during inventory.	{{AgentBlueprint.UsesPasswordCredential}}
Verified publisher	String	Display name of the verified publisher of the blueprint, when present.	{{AgentBlueprint.VerifiedPublisherDisplayName}}

Relations

Relation	Service	Description
Agent Blueprint Principal	Microsoft Agent 365	Service principal record of an agent identity blueprint's addition to the tenant. Inherits from servicePrincipal; used for token issuance and audit. Linked to an agentIdentityBlueprint via appId.
Agent Identity	Microsoft Agent 365	Microsoft Entra agent identity - the identity object (inherits from servicePrincipal) used by an AI agent to authenticate. Bound to one agentIdentityBlueprint via agentIdentityBlueprintId; has its own owners and sponsors.
Agent User	Microsoft Agent 365	Microsoft Entra agent user - a specialized user (inherits from user) for AI agents that need a user account (mailbox, Teams presence). One-to-one with a parent agent identity via identityParentId. Has manager + multi-sponsor relationships to real users.
Agent Permission	Microsoft Agent 365	The permission scope this row represents. Linking via this relation lets a single permission be opened to see every blueprint that declares it as inheritable.
User	Microsoft 365	Microsoft 365 user that owns the blueprint.
User	Microsoft 365	Microsoft 365 user that sponsors the blueprint.

Segments

Segment	Description
Blueprints Using Password Credentials	Lists agent blueprints that have at least one passwordCredential (client secret). Federated identity credentials are preferred for production agents.
Blueprints with Credential Expiring Within 30 Days	Lists agent blueprints with at least one passwordCredential or keyCredential expiring in the next 30 days.
Blueprints without Owners	Lists agent blueprints that have no registered owners.
Blueprints without Sponsors	Lists agent blueprints that have no registered sponsors.
Microsoft-Disabled Blueprints with Active Identities	Lists agent blueprints that Microsoft has disabled but that still have linked agent identities.
Unused Blueprints	Lists agent blueprints that have no linked agent identities.

Actions

This object does currently not have any actions.

Policies that check this object

Policy	Severity	Description
Blueprint credential expiring within 30 days (likelihood)	Medium	Risk-probability factor: a credential approaching expiry raises the likelihood of an outage or unsafe hot-rotation.
Blueprint has no owners (likelihood)	High	Risk-probability factor: blueprints without an owner have no accountability surface, raising the likelihood of unnoticed drift.
Blueprint uses password credential (likelihood)	High	Risk-probability factor: blueprints with at least one passwordCredential are materially more likely to suffer a credential leak than federated-only blueprints.
Blueprint Credential Expiring Within 30 Days	Medium	Flags agent identity blueprints with at least one passwordCredential or keyCredential expiring in the next 30 days.
Blueprint Has a Deactivated Owner or Sponsor	Medium	Flags agent identity blueprints whose owner or sponsor has a disabled Microsoft Entra user account.
Blueprint Has No Owners	High	Flags agent identity blueprints that have no owners registered in the owners collection.
Blueprint Has No Sponsors	Medium	Flags agent identity blueprints that have no sponsors registered in the sponsors collection.
Multitenant Blueprint Without a Verified Publisher	Medium	Flags multitenant-capable agent identity blueprints that have no verified publisher recorded.
Blueprint Uses Password Credential	Medium	Flags agent identity blueprints that have at least one passwordCredential. Federated identity credentials are preferred for production agents.
Microsoft-Disabled Blueprint Has Active Identities	High	Flags blueprints disabled by Microsoft that still have linked agent identities.
Unused Blueprint	Low	Flags agent identity blueprints that have no linked agent identities.