Microsoft Entra ID provides agent identity blueprints to help organizations create and manage AI agent identities. The setting Users can create agent identity blueprints is enabled by default, so it’s recommended to review and restrict this setting if users should not be able to create agent identity blueprints. In this article, you will learn how to restrict users from creating agent identity blueprints in Microsoft Entra.
Why restrict agent identity blueprints in Microsoft Entra ID?
Agent identity blueprint is an object that serves as a template for creating agent identities in Microsoft Entra ID.
Allowing users to create blueprints without proper oversight can make it harder to maintain control over agent identities in your tenant.
Creating a blueprint does not automatically grant access to company data. Instead, the permissions (Delegated or Application) granted to an agent and your user consent settings determine which resources it can access.
Restricting the ability to create agent identity blueprints provides an additional layer of governance and ensures that only authorized users can create them.
Note: Starting November 4, 2026, all users will be able to create agent identity blueprints by default. To prevent this, administrators must manually set Users can register agent identity blueprints to No in Microsoft Entra ID. Users assigned the Agent ID Developer or Agent ID Administrator role can still create agent identity blueprints when the setting is set to No.
Restrict users from creating agent identity blueprints
Follow the steps below to restrict users from creating agent identity blueprints:
- Sign in to the Microsoft Entra admin center.
- Click on Entra ID > Users > User settings.
- Go to the setting Users can register agent identity blueprints and set it to No.
- Click Save.
That’s it!
Read more: How to Restrict Access to Storage Accounts in Outlook on the web »
Conclusion
You learned how to restrict users from creating agent identity blueprints in Microsoft Entra. Restricting this setting helps organizations maintain control over which users can create agent identities in the tenant.
Remember that this setting is enabled by default in the tenant. I recommend setting this to No and only grant the required permissions to users who have a legitimate need to create and manage agent identity blueprints.
Did you enjoy this article? You may also like How to Restrict access to Microsoft Entra admin center. Don’t forget to follow us and share this article.