MC1506733 - Action may be required: Review who can create agents in Microsoft Entra
Microsoft 365 Message Center announcement MC1506733.
MS Message Center's Summary
Microsoft is updating Microsoft Entra in November 2026 to allow default users to create agent blueprints unless restricted by an administrator. This change broadens agent creation capabilities across the tenant. Administrators who wish to limit this feature to authorised roles must update the user settings in the Microsoft Entra admin centre before rollout concludes in late November.
- Administrator impact
- Review the new user setting in the Microsoft Entra admin centre and set the toggle to no if your organisation restricts agent creation.
- End user impact
- Default users gain the ability to create new agent blueprints unless administrators restrict the permission.
- Importance
- 6/10: This change alters default tenant permissions regarding agent creation, requiring administrative review to maintain governance.
Microsoft Summary
Starting November 4, 2026, default users in Microsoft Entra can create agent blueprints unless administrators disable this via the "Users can create agent blueprints" setting. Admins can restrict this by toggling the setting to No in the Entra admin center before rollout completes in late November.
- Message Center ID
- MC1506733
- Category
- plan For Change
- Severity
- normal
- Services
- Microsoft Entra
- Tags
- User impact, Admin impact
- Published
- 2026-10-13
- Last updated
- 2026-10-13
- Expires
- 2026-12-30
[What and why] Microsoft Entra is changing who can create agent blueprints by default. Starting November 4 , default users will be able to create new agent blueprints unless an administrator turns off Users can create agent blueprints . This means that users without built-in or custom Entra roles will be able to create new agent blueprints in their organization. From now until rollout begins, you can set your tenant preferences to prepare for this rollout. If you do not want users in your organization to create new agent blueprints and their identities, follow the instructions below. [Rollout schedule] Worldwide: Beginning in early November 2026 and expected to complete by late November 2026 [Impact on your organization] Who is affected Organizations using Microsoft Entra Default users who don't have a built-in or custom Microsoft Entra role Platforms and services Microsoft Entra What will happen Default users will be able to create agent blueprints unless an administrator turns off Users can create agent blueprints . If you set the toggle to No , default users will not be able to create new agents. Supported administrators and users assigned the Agent ID Developer role can continue to create them. If you change this toggle now, your tenant won't change right away. Your setting takes effect when the rollout begins in early November. [Action required and recommendations] If default users should be allowed to create agents in your organization, no action is required . Choosing to allow users to create agent blueprints will not begin until the functionality is available in your tenant. To restrict creation: Sign in to the Microsoft Entra admin center using this link. Go to Entra ID > Users > User settings . Under Default user role permissions , find Users can create agent blueprints . Set the toggle to No , then save the change. For more information and instructions on setting the toggle for your organization, see Manage who can create agent blueprints here . This change affects new agent blueprint creation by default users. It does not: Change or remove existing agent blueprints. Change who can create agent identities from existing blueprints. Block an app or an agent from creating identities Affect creation requirements within platforms such as Microsoft Foundry or Security Copilot, such as requiring licenses and Azure subscriptions. The new setting is independent of Users can register applications . Review both settings separately. Learn more Delegate application management administrator permissions - Microsoft Entra ID | Microsoft Learn [Compliance considerations] No compliance considerations identified. Review as appropriate for your organization.