Action may be required: Review who can create agents in Microsoft Entra

🚨 The Signal: Microsoft Entra will allow all users to create new agent blueprints by default starting November 2026. This expands the attack surface by enabling any user to provision autonomous agent identities, requiring immediate administrative review to restrict this capability.

The Impact

All default users can create agent identities, increasing the risk of unmanaged autonomous agents and potential misuse.

  • Default Users: Can create new agent blueprints, potentially leading to unapproved agent deployments.
  • Security Teams: Must review and potentially restrict agent creation to prevent identity sprawl.
  • Identity Admins: Need to configure Entra ID settings to control who can provision agent identities.
  • Compliance Officers: Face increased audit risk due to expanded default user privileges for identity creation.

The Action

  1. Navigate to the Microsoft Entra admin center.
  2. Go to Identity > Users > User settings.
  3. Locate the setting 'Users can create agent blueprints'.
  4. Set the toggle to 'No' to restrict default users from creating agent blueprints.
  5. Ensure 'Agent ID Developer' role is assigned only to authorized personnel.

Domain: Agentic-AI · Impact: high · Workload: Entra ID · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898