Reference
Agent User
Microsoft Entra agent user - a specialized user (inherits from user) for AI agents that need a user account (mailbox, Teams presence). One-to-one with a parent agent identity via identityParentId. Has manager + multi-sponsor relationships to real users.
Part of the Microsoft Agent 365 inventory.
Scan settings
| Default scanning interval | Allowed scanning intervals | Data removal during incremental scan |
|---|---|---|
| Daily | Daily, Weekly, Bi-Weekly, Monthly, Never, Initial | Yes |
Properties
| Property | Type | Description | Automation placeholder |
|---|---|---|---|
| Account enabled | Boolean | True when the account is enabled for sign-in. | {{AgentUser.AccountEnabled}} |
| Assigned license count | Int32 | Number of entries in assignedLicenses. Computed during inventory. | {{AgentUser.AssignedLicenseCount}} |
| Blueprint | Agent Blueprint | Transitive relation to the agent identity blueprint, resolved via Identity → Blueprint. Computed during inventory. | {{AgentUser.Blueprint}} |
| Blueprint name | String | Display name of the agent identity blueprint (via Identity → Blueprint). Computed during inventory. | {{AgentUser.BlueprintName}} |
| Blueprint principal | Agent Blueprint Principal | Transitive relation to the agent identity blueprint principal, resolved via Identity → BlueprintPrincipal. Computed during inventory. | {{AgentUser.BlueprintPrincipal}} |
| Blueprint principal name | String | Display name of the blueprint principal (via Identity → BlueprintPrincipal). Computed during inventory. | {{AgentUser.BlueprintPrincipalName}} |
| Company name | String | Company name for the agent user. | {{AgentUser.CompanyName}} |
| Created on | DateTime | Time the agent user was created. | {{AgentUser.CreatedDateTime}} |
| Initially Scanned | DateTime | Shows when this object was initially found in a scan. | {{AgentUser.CreatedTime}} |
| Department | String | Department for the agent user. | {{AgentUser.Department}} |
| Deactivated sponsor count | Int32 | Number of registered sponsors whose Microsoft Entra user account is disabled (AccountEnabled == false). Sponsors are the accountable humans for the agent user's lifecycle; a disabled sponsor account breaks the oversight and access-review safety net. Resolved against the sponsors' user accounts during the cross-entity rollup pass; not a direct Graph property. | {{AgentUser.DisabledSponsorCount}} |
| Display Name | String | {{AgentUser.DisplayName}} | |
| Employee type | String | Enterprise worker type (Employee, Contractor, Consultant, Vendor). | {{AgentUser.EmployeeType}} |
| Has deactivated manager | Boolean | True when the agent user's manager has a disabled Microsoft Entra user account. Sponsorship auto-transfers to the manager when a sponsor leaves, so a disabled manager removes the fallback target for that transfer. Resolved against the manager's user account during the cross-entity rollup pass; not a direct Graph property. | {{AgentUser.HasDisabledManager}} |
| Has manager | Boolean | True when the agent user has a manager assigned. Computed during inventory; the manager link itself is stored as an Agent User Manager relation row. | {{AgentUser.HasManager}} |
| Id | String | Object id of the agent user. | {{AgentUser.Id}} |
| Identity | Agent Identity | Resolved relation to the parent Agent Identity (matched by IdentityParentId). Computed during inventory. | {{AgentUser.Identity}} |
| Identity name | String | Display name of the parent agent identity. Computed during inventory. | {{AgentUser.IdentityName}} |
| Identity parent id | String | Object id of the associated agent identity. Required at create time; cannot be cleared. | {{AgentUser.IdentityParentId}} |
| Job title | String | Job title for the agent user. | {{AgentUser.JobTitle}} |
| Last scan update | DateTime | Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change. | {{AgentUser.LastModifiedTime}} |
| String | Primary SMTP mail address for the agent user. | {{AgentUser.Mail}} | |
| Mail nickname | String | Mail alias. | {{AgentUser.MailNickname}} |
| Risk Score | Int32 | Stores risk score | {{AgentUser.RiskScore}} |
| Risk Score Update | DateTime | Stores risk score update | {{AgentUser.RiskScoreLastUpdate}} |
| Risk Score Value | String | Stores risk score value like Low_Low | {{AgentUser.RiskScoreValue}} |
| Sponsor count | Int32 | Number of sponsors registered on the agent user. Computed during inventory. | {{AgentUser.SponsorCount}} |
| Usage location | String | Two-letter country code (ISO 3166); required for license assignment. | {{AgentUser.UsageLocation}} |
| User principal name | String | User principal name (UPN) of the agent user account. | {{AgentUser.UserPrincipalName}} |
| User type | String | Member or Guest. Inherited from user. Allowed values: Guest, Member. | {{AgentUser.UserType}} |
Relations
| Relation | Service | Description |
|---|---|---|
| Agent Blueprint | Microsoft Agent 365 | Microsoft Entra agent identity blueprint - a template (inherits from application) that defines the configuration agent identities created from it inherit. Holds credentials (keyCredentials, passwordCredentials, federatedIdentityCredentials), inheritable permissions, owners, and sponsors. |
| Agent Blueprint Principal | Microsoft Agent 365 | Service principal record of an agent identity blueprint's addition to the tenant. Inherits from servicePrincipal; used for token issuance and audit. Linked to an agentIdentityBlueprint via appId. |
| Agent Identity | Microsoft Agent 365 | Microsoft Entra agent identity - the identity object (inherits from servicePrincipal) used by an AI agent to authenticate. Bound to one agentIdentityBlueprint via agentIdentityBlueprintId; has its own owners and sponsors. |
| Agent Identity | Microsoft Agent 365 | Agent identity the delegated permission is granted to (the servicePrincipal that will use it). |
| User | Microsoft 365 | Microsoft 365 user that is the manager of the agent user. |
| User | Microsoft 365 | Microsoft 365 user that sponsors the agent user. |
Segments
This object does currently not have any segments.
Actions
This object does currently not have any actions.
Policies that check this object
| Policy | Severity | Description |
|---|---|---|
| Agent user is enabled (likelihood) | Medium | Risk-probability factor: enabled agent user accounts can sign in and act across workloads, so latent issues are likelier to manifest. |
| Agent user is a Guest (likelihood) | High | Risk-probability factor: Guest-type agent users introduce external-identity provenance into agent automation, raising the likelihood of cross-tenant exposure. |
| Agent user has no manager (likelihood) | Medium | Risk-probability factor: an agent user without a manager has no auto-cascade target for sponsorship, raising the likelihood of orphaned permissions. |
| Agent User Has a Deactivated Sponsor or Manager | Medium | Flags agent users whose sponsor or manager has a disabled Microsoft Entra user account, breaking the sponsorship-continuity chain. |
| Agent User Has No Sponsors | High | Flags agent user accounts that have no sponsors registered. |
| Agent User Is a Guest | High | Flags agent user accounts whose UserType is Guest, introducing external-identity provenance into agent automation. |