Agent Blueprint Principal

Service principal record of an agent identity blueprint's addition to the tenant. Inherits from servicePrincipal; used for token issuance and audit. Linked to an agentIdentityBlueprint via appId.

Part of the Microsoft Agent 365 inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Daily	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	Yes

Properties

Property	Type	Description	Automation placeholder
Account enabled	Boolean	True when the principal is enabled. Disabling the principal blocks tokens for every agent identity created from this blueprint instance.	{{AgentBlueprintPrincipal.AccountEnabled}}
App description	String	Description exposed by the associated agent identity blueprint.	{{AgentBlueprintPrincipal.AppDescription}}
App display name	String	displayName exposed by the associated agent identity blueprint.	{{AgentBlueprintPrincipal.AppDisplayName}}
App id	String	appId of the associated agent identity blueprint. Use to join to the Agent Blueprint entity.	{{AgentBlueprintPrincipal.AppId}}
App owner organization id	String	Tenant id where the agent identity blueprint is registered.	{{AgentBlueprintPrincipal.AppOwnerOrganizationId}}
App role assignment required	Boolean	True when users / service principals must be granted an app role assignment before they can sign in or get tokens for this principal.	{{AgentBlueprintPrincipal.AppRoleAssignmentRequired}}
Blueprint	Agent Blueprint	Resolved relation to the agent identity blueprint this principal is instantiated from. Computed by matching principal.AppId == blueprint.AppId.	{{AgentBlueprintPrincipal.Blueprint}}
Blueprint name	String	Display name of the agent identity blueprint this principal is instantiated from. Computed during inventory.	{{AgentBlueprintPrincipal.BlueprintName}}
Created by app id	String	appId of the application that created this principal (set by Microsoft Entra ID).	{{AgentBlueprintPrincipal.CreatedByAppId}}
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	{{AgentBlueprintPrincipal.CreatedTime}}
Disabled by Microsoft	String	Microsoft-initiated disable status. Values: null (default), NotDisabled, DisabledDueToViolationOfServicesAgreement.	{{AgentBlueprintPrincipal.DisabledByMicrosoftStatus}}
Display Name	String		{{AgentBlueprintPrincipal.DisplayName}}
Id	String	Object id of the agent identity blueprint principal (servicePrincipal id).	{{AgentBlueprintPrincipal.Id}}
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	{{AgentBlueprintPrincipal.LastModifiedTime}}
Owner count	Int32	Number of owners registered on the principal. Computed during inventory; not a Graph property.	{{AgentBlueprintPrincipal.OwnerCount}}
Publisher name	String	Name of the Microsoft Entra tenant that published the application.	{{AgentBlueprintPrincipal.PublisherName}}
Risk Score	Int32	Stores risk score	{{AgentBlueprintPrincipal.RiskScore}}
Risk Score Update	DateTime	Stores risk score update	{{AgentBlueprintPrincipal.RiskScoreLastUpdate}}
Risk Score Value	String	Stores risk score value like Low_Low	{{AgentBlueprintPrincipal.RiskScoreValue}}
Service principal names	String	Identifier URIs copied from the associated blueprint.	{{AgentBlueprintPrincipal.ServicePrincipalNames}}
Service principal type	String	Set to 'Application' for blueprint principals backed by an application.	{{AgentBlueprintPrincipal.ServicePrincipalType}}
Sign-in audience	String	Supported sign-in audience (AzureADMyOrg, AzureADMultipleOrgs, etc.).	{{AgentBlueprintPrincipal.SignInAudience}}
Sponsor count	Int32	Number of sponsors registered on the principal. Computed during inventory; not a Graph property.	{{AgentBlueprintPrincipal.SponsorCount}}
Tags	String	Custom tags on the principal (union of principal-side and blueprint-side tags).	{{AgentBlueprintPrincipal.Tags}}
Verified publisher	String	Display name of the verified publisher of the associated agent identity blueprint, when present.	{{AgentBlueprintPrincipal.VerifiedPublisherDisplayName}}

Relations

Relation	Service	Description
Agent Blueprint	Microsoft Agent 365	Microsoft Entra agent identity blueprint - a template (inherits from application) that defines the configuration agent identities created from it inherit. Holds credentials (keyCredentials, passwordCredentials, federatedIdentityCredentials), inheritable permissions, owners, and sponsors.
Agent Identity	Microsoft Agent 365	Microsoft Entra agent identity - the identity object (inherits from servicePrincipal) used by an AI agent to authenticate. Bound to one agentIdentityBlueprint via agentIdentityBlueprintId; has its own owners and sponsors.
Agent User	Microsoft Agent 365	Microsoft Entra agent user - a specialized user (inherits from user) for AI agents that need a user account (mailbox, Teams presence). One-to-one with a parent agent identity via identityParentId. Has manager + multi-sponsor relationships to real users.
User	Microsoft 365	Microsoft 365 user that owns the blueprint principal.
User	Microsoft 365	Microsoft 365 user that sponsors the blueprint principal.

Segments

This object does currently not have any segments.

Actions

This object does currently not have any actions.