Microsoft Entra: Changes to AgentIdentity.CreateAsManager permission for agent identities

[What and why]

Microsoft Entra Agent ID is enforcing tighter restrictions for autonomous creation of an agent’s own identities. Currently, all agents are granted AgentIdentity.CreateAsManager upon creation without administrator approval. Starting November 4, Microsoft Entra will no longer automatically grant AgentIdentity.CreateAsManager to agent blueprint principals, and creation of identities will need an admin to grant consent.

Agents that use app-only authentication to create their own agent identities must be explicitly granted the AgentIdentity.CreateAsManager Microsoft Graph application permission or move to another supported authorization model before enforcement reaches their tenant.

[Rollout schedule]

• General Availability (Worldwide): Beginning in early November 2026 and expected to complete by late November 2026

[Impact on your organization]

Who is affected

• Organizations using Microsoft Entra 
• No action is required if your organization doesn't have an agent that depends on the automatic AgentIdentity.CreateAsManager grant.

Platforms and services

• Microsoft Entra

What will happen

Today, an agent blueprint principal is granted AgentIdentity.CreateAsManager automatically. This implicit grant allows the principal to create agent identities without a tenant-admin granting an app-role assignment.

After enforcement, an administrator must grant the Microsoft Graph application permission AgentIdentity.CreateAsManager to agents that needs this authority.

This change:

• Makes app-only agent identity creation authority visible, auditable, and revocable.
• Makes AgentIdentity.CreateAsManager revocable if consented
• Affects existing and future agents.
• Doesn't remove existing agent identities or agent blueprints.
• Doesn't remove the ability for agent identity blueprints to create agent identities, when AgentIdentity.CreateAsManager is explicitly granted by an administrator
• Doesn't affect an agent that uses a directory role to authorize creation of agent identities.

[Action required and recommendations]

No action is required if your organization doesn't have an agent that depends on the automatic AgentIdentity.CreateAsManager grant.

Identify agents that create agent identities without a signed-in user.

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID>Audit Logs.
3. Set the Category to "ApplicationManagement"
4. Set the Activity filter to "Add Service Principal"

Find events where the Initiated By (actor) Type is Application and the Target is an agent identity.

For each affected agent:

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID>Agent blueprints>Search for your agent blueprint>Granted permissions
3. Review if the Agent has any other granted permissions that may allow for creation of agent identities. If there are no other permissions allowing for creation, this agent relies on AgentIdentity.CreateAsManager.
4. Starting October 16, you may grant the explicit AgentIdentity.CreateAsManager Microsoft Graph application permission through tenant-wide admin consent or manual app-role creation. Granting it earlier will cause an error. A successful grant appears in the Granted Permissions table with “An administrator” in the Granted By column.
5. Test app-only agent identity creation before enforcement begins.
6. Update operational guidance for a failed request after enforcement.

If an app-only request relies only on the automatic grant after enforcement reaches your tenant, the request will fail with a 403 authorization error.

Learn more

• For more about how to grant your agents access to resources, visit Grant agents access to Microsoft 365 resources | Microsoft Learn. 
• For the Microsoft Graph permission reference on AgentIdentity.CreateAsManager, visit Microsoft Graph permissions reference - Microsoft Graph | Microsoft Learn.

[Compliance considerations]

No specific compliance impacts have been identified for this configuration update.