Agent Permission

A Microsoft Graph (or other resource) permission scope. Inheritable permissions on blueprints and grants on identities both link back to this entity so a single permission can be opened to see every agent that declares or holds it.

Part of the Microsoft Agent 365 inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Daily	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	Yes

Properties

Property	Type	Description	Automation placeholder
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	{{AgentPermission.CreatedTime}}
Display Name	String		{{AgentPermission.DisplayName}}
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	{{AgentPermission.LastModifiedTime}}
Permission type	String	Application (consented for the app to act on its own, no signed-in user) or Delegated (the app acts on behalf of a signed-in user). Allowed values: Application, Delegated.	{{AgentPermission.PermissionType}}
Resource app id	String	App id of the resource the scope is defined on (e.g. 00000003-0000-0000-c000-000000000000 for Microsoft Graph).	{{AgentPermission.ResourceAppId}}
Resource	String	Display name of the resource the scope is defined on.	{{AgentPermission.ResourceDisplayName}}
Risk Score	Int32	Stores risk score	{{AgentPermission.RiskScore}}
Risk Score Update	DateTime	Stores risk score update	{{AgentPermission.RiskScoreLastUpdate}}
Risk Score Value	String	Stores risk score value like Low_Low	{{AgentPermission.RiskScoreValue}}
Scope	String	Permission scope name (e.g. Mail.ReadWrite.All, Sites.Read.All, User.Read).	{{AgentPermission.Scope}}

Relations

Relation	Service	Description
Agent Blueprint	Microsoft Agent 365	Agent blueprint the permission is declared on.
Agent Identity	Microsoft Agent 365	Agent identity the application permission is granted to.
Agent Identity	Microsoft Agent 365	Agent identity the delegated permission is granted to (the servicePrincipal that will use it).

Segments

This object does currently not have any segments.

Actions

This object does currently not have any actions.

Policies that check this object

Policy	Severity	Description
High-privilege permission scope (likelihood)	High	Risk-probability factor: high-privilege scopes (.ReadWrite.All, .FullControl.All, .Write.All, Mail.Send, Directory.ReadWrite*, RoleManagement.ReadWrite*) carry elevated likelihood of broad impact when any agent holds them.