Microsoft Entra Agent ID gives AI agents their own identities in a Microsoft 365 tenant. Each agent identity is created from an agent identity blueprint. The blueprint sets how those agents authenticate, which permissions they inherit and who is accountable for them. Whoever can create a blueprint has a say in how agents get into your systems.
We checked Microsoft's agent identity documentation on November 9, 2026. The point that matters for a small business is one organization-wide setting: Users can create agent blueprints.
What the setting does
- Yes: any user in the tenant can create an agent identity blueprint and its blueprint principal. The person who creates one becomes its owner.
- No: only people with the Agent ID Developer or Agent ID Administrator role can create them.
Owners can also create agent identities from a blueprint they own, without an Agent ID role. So a setting of No limits who starts a blueprint, but not who keeps running one.
We'll check the tenant setting, list each agent blueprint with its owner and sponsor, and narrow the roles that can change them.
Check the setting this week
- 1Find the organization-wide setting named Users can create agent blueprints in your Microsoft 365 or Microsoft Entra admin center.
- 2Write down its current value and the date you checked.
- 3If your staff do not build agents, set it to No. Then check the value again after the change, because the setting is the control for new blueprints.
The setting controls who can create blueprints. Review the ones that already exist as a separate step.
Review the blueprints you already have
- Owners and sponsors. Every blueprint needs a sponsor, the user or supported group accountable for the agent. Sponsors can be users, dynamic groups or Microsoft 365 groups. Security groups and role-assignable groups are not supported as sponsors. If a sponsor has left the business, name a replacement.
- Credentials. The credentials that let an agent sign in are set on the blueprint. OAuth permissions granted to a blueprint apply to every agent identity created from it. A blueprint with a broad grant affects all its agents at once.
- Unused blueprints. Disabling a blueprint stops every agent identity made from it from signing in. Disable the ones nobody owns or uses, and record which ones you turned off.
Keep the roles small
Agent ID Developer can configure federated identity credentials on a blueprint. Agent ID Administrator can do that too, and it is the role required to add a secret or certificate credential. Give both roles to a short list of people who maintain agents. Review that list when someone changes role or leaves.
Where this fits
A blueprint is an access decision made once and reused by many agents. The same questions apply as for any agent: what it can reach, who approves its actions, and how you stop it. Our AI agent permissions and human approval guide covers those approval steps, and the AI agent governance checklist covers who owns each agent.
If your Microsoft 365 tenant already has agents you cannot account for, we can inventory the blueprints, their owners and their permissions as part of an AI agent build. Start with the free automation audit if you want us to look at the whole setup first.
