Action may be required: Review who can create agents in Microsoft Entra

[What and why]

Microsoft Entra is changing who can create agent blueprints by default. Starting November 4, default users will be able to create new agent blueprints unless an administrator turns off Users can create agent blueprints. This means that users without built-in or custom Entra roles will be able to create new agent blueprints in their organization. From now until rollout begins, you can set your tenant preferences to prepare for this rollout. If you do not want users in your organization to create new agent blueprints and their identities, follow the instructions below. 

[Rollout schedule]

• Worldwide: Beginning in early November 2026 and expected to complete by late November 2026

[Impact on your organization]

Who is affected

• Organizations using Microsoft Entra
• Default users who don't have a built-in or custom Microsoft Entra role

Platforms and services

• Microsoft Entra

What will happen

• Default users will be able to create agent blueprints unless an administrator turns off Users can create agent blueprints. If you set the toggle to No, default users will not be able to create new agents. Supported administrators and users assigned the Agent ID Developer role can continue to create them. 
• If you change this toggle now, your tenant won't change right away. Your setting takes effect when the rollout begins in early November.

[Action required and recommendations]

If default users should be allowed to create agents in your organization, no action is required. Choosing to allow users to create agent blueprints will not begin until the functionality is available in your tenant.

To restrict creation:

1. Sign in to the Microsoft Entra admin center using this link.
2. Go to Entra ID > Users > User settings.
3. Under Default user role permissions, find Users can create agent blueprints.
4. Set the toggle to No, then save the change.

For more information and instructions on setting the toggle for your organization, see Manage who can create agent blueprints here.

This change affects new agent blueprint creation by default users. It does not:

• Change or remove existing agent blueprints.
• Change who can create agent identities from existing blueprints.
• Block an app or an agent from creating identities
• Affect creation requirements within platforms such as Microsoft Foundry or Security Copilot, such as requiring licenses and Azure subscriptions.

The new setting is independent of Users can register applications. Review both settings separately.

Learn more

• Delegate application management administrator permissions - Microsoft Entra ID | Microsoft Learn

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.