MC1506728 - Microsoft Entra: Changes to AgentIdentity.CreateAsManager permission for agent identities
Microsoft 365 Message Center announcement MC1506728.
MS Message Center's Summary
Microsoft Entra will remove the automatic granting of the AgentIdentity.CreateAsManager permission to agent blueprints starting in November 2026. Administrators must explicitly grant this permission or use alternative authorization models for agents that create identities using app only authentication. Review current audit logs to identify dependent agents and prepare to grant explicit consent before rollout completion.
- Administrator impact
- Administrators must audit existing agents and explicitly grant the required Microsoft Graph permission where automatic creation is needed.
- End user impact
- End users will experience no direct impact unless unmanaged autonomous agents fail to create identities after enforcement.
- Importance
- 6/10: This change modifies security permissions for autonomous agents and requires administrative intervention to prevent service disruption for dependent applications.
Grant tenant wide admin consent
Microsoft Summary
Starting November 4, Microsoft Entra will stop automatically granting the AgentIdentity.CreateAsManager permission to agent blueprints. Admin consent will be required for agents to create identities. This change, rolling out worldwide in November 2026, enhances control and auditability of agent identity creation.
- Message Center ID
- MC1506728
- Category
- plan For Change
- Severity
- normal
- Services
- Microsoft Entra
- Tags
- User impact, Admin impact, Retirement
- Published
- 2026-10-13
- Last updated
- 2026-10-13
- Expires
- 2026-12-30
[What and why] Microsoft Entra Agent ID is enforcing tighter restrictions for autonomous creation of an agent’s own identities. Currently, all agents are granted AgentIdentity.CreateAsManager upon creation without administrator approval. Starting November 4 , Microsoft Entra will no longer automatically grant AgentIdentity.CreateAsManager to agent blueprint principals, and creation of identities will need an admin to grant consent. Agents that use app-only authentication to create their own agent identities must be explicitly granted the AgentIdentity.CreateAsManager Microsoft Graph application permission or move to another supported authorization model before enforcement reaches their tenant. [Rollout schedule] General Availability (Worldwide): Beginning in early November 2026 and expected to complete by late November 2026 [Impact on your organization] Who is affected Organizations using Microsoft Entra No action is required if your organization doesn't have an agent that depends on the automatic AgentIdentity.CreateAsManager grant. Platforms and services Microsoft Entra What will happen Today, an agent blueprint principal is granted AgentIdentity.CreateAsManager automatically. This implicit grant allows the principal to create agent identities without a tenant-admin granting an app-role assignment. After enforcement, an administrator must grant the Microsoft Graph application permission AgentIdentity.CreateAsManager to agents that needs this authority. This change: Makes app-only agent identity creation authority visible, auditable, and revocable. Makes AgentIdentity.CreateAsManager revocable if consented Affects existing and future agents. Doesn't remove existing agent identities or agent blueprints. Doesn't remove the ability for agent identity blueprints to create agent identities, when AgentIdentity.CreateAsManager is explicitly granted by an administrator Doesn't affect an agent that uses a directory role to authorize creation of agent identities. [Action required and recommendations] No action is required if your organization doesn't have an agent that depends on the automatic AgentIdentity.CreateAsManager grant. Identify agents that create agent identities without a signed-in user. Sign in to the Microsoft Entra admin center . Go to Entra ID > Audit Logs . Set the Category to "ApplicationManagement" Set the Activity filter to "Add Service Principal" Find events where the Initiated By (actor) Type is Application and the Target is an agent identity. For each affected agent: Sign in to the Microsoft Entra admin center . Go to Entra ID>Agent blueprints >Search for your agent blueprint> Granted permissions Review if the Agent has any other granted permissions that may allow for creation of agent identities. If there are no other permissions allowing for creation, this agent relies on AgentIdentity.CreateAsManager. Starting October 16 , you may grant the explicit AgentIdentity.CreateAsManager Microsoft Graph application permission through tenant-wide admin consent or manual app-role creation . Granting it earlier will cause an error. A successful grant appears in the Granted Permissions table with “An administrator” in the Granted By column. Test app-only agent identity creation before enforcement begins. Update operational guidance for a failed request after enforcement. If an app-only request relies only on the automatic grant after enforcement reaches your tenant, the request will fail with a 403 authorization error. Learn more For more about how to grant your agents access to resources, visit Grant agents access to Microsoft 365 resources | Microsoft Learn . For the Microsoft Graph permission reference on AgentIdentity.CreateAsManager, visit Microsoft Graph permissions reference - Microsoft Graph | Microsoft Learn . [Compliance considerations] No specific compliance impacts have been identified for this configuration update.