AgentIdentityBlueprintPrincipal.Create

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the AgentIdentityBlueprintPrincipal.Create permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	-	-
DisplayText	-	-
Description	-	-
AdminConsentRequired	Yes	No

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	POST /servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

agentIdentityBlueprint
agentIdentityBlueprintPrincipal

Graph reference: agentIdentityBlueprint

Property	Type	Description
api	apiApplication	Specifies settings for an agent identity blueprint that implements a web API. Inherited from application.
appId	String	The unique identifier for the agent identity blueprint that is assigned by Microsoft Entra ID. Not nullable. Read-only. Inherited from application.
appRoles	appRole collection	The collection of roles defined for the agent identity blueprint. With app role assignments, these roles can be assigned to users, groups, or service principals associated with other applications. Not nullable. Inherited from application.
certification	certification	Specifies the certification status of the agent identity blueprint. Inherited from application.
createdByAppId	String	The unique identifier of the application that created this agent identity blueprint. Set internally by Microsoft Entra ID. Read-only. Inherited from application.
createdDateTime	DateTimeOffset	The date and time the agent identity blueprint was registered. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. Read-only. Inherited from application.
createdByAppId	String	The appId (called Application (client) ID on the Microsoft Entra admin center) of the application that created this agent identity blueprint. Set internally by Microsoft Entra ID. Read-only. Inherited from application.
description	String	Free text field to provide a description of the agent identity blueprint to end users. The maximum allowed size is 1,024 characters. Inherited from application.
disabledByMicrosoftStatus	String	Specifies whether Microsoft has disabled the registered agent identity blueprint. Possible values are: `null` (default value), `NotDisabled`, and `DisabledDueToViolationOfServicesAgreement` (reasons may include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement). Inherited from application.
displayName	String	The display name for the agent identity blueprint. Maximum length is 256 characters. Inherited from application.
groupMembershipClaims	String	Configures the `groups` claim issued in a user or OAuth 2.0 access token that the agent identity blueprint expects. To set this attribute, use one of the following string values: `None`, `SecurityGroup` (for security groups and Microsoft Entra roles), `All` (this gets all security groups, distribution groups, and Microsoft Entra directory roles that the signed-in user is a member of). Inherited from application.
id	String	Unique identifier for the agent identity blueprint object. This property is referred to as Object ID in the Microsoft Entra admin center. Key. Not nullable. Read-only. Inherited from directoryObject.
identifierUris	String collection	Also known as App ID URI, this value is set when an agent identity blueprint is used as a resource app. The identifierUris acts as the prefix for the scopes you reference in your API's code, and it must be globally unique across Microsoft Entra ID. Not nullable. Inherited from application.
info	informationalUrl	Basic profile information of the agent identity blueprint, such as it's marketing, support, terms of service, and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience. Inherited from application.
keyCredentials	keyCredential collection	The collection of key credentials associated with the agent identity blueprint. Not nullable. Inherited from application.
optionalClaims	optionalClaims	Application developers can configure optional claims in their Microsoft Entra agent identity blueprints to specify the claims that are sent to their application by the Microsoft security token service. Inherited from application.
passwordCredentials	passwordCredential collection	The collection of password credentials associated with the agent identity blueprint. Not nullable. Inherited from application. You can also add passwords after creating the agent identity blueprint by calling the Add password API.
publisherDomain	String	The verified publisher domain for the agent identity blueprint. Read-only. Inherited from application.
serviceManagementReference	String	References application or service contact information from a Service or Asset Management database. Nullable. Inherited from application.
signInAudience	String	Specifies the Microsoft accounts that are supported for the current agent identity blueprint. The possible values are: `AzureADMyOrg` (default), `AzureADMultipleOrgs`, `AzureADandPersonalMicrosoftAccount`, and `PersonalMicrosoftAccount`. Inherited from application.
tags	String collection	Custom strings that can be used to categorize and identify the agent identity blueprint. Not nullable. Inherited from application.
tokenEncryptionKeyId	Guid	Specifies the keyId of a public key from the keyCredentials collection. When configured, Microsoft Entra ID encrypts all the tokens it emits by using the key this property points to. Inherited from application.
uniqueName	String	The unique identifier that can be assigned to an agent identity blueprint and used as an alternate key. Immutable. Read-only. Inherited from application.
verifiedPublisher	verifiedPublisher	Specifies the verified publisher of the agent identity blueprint. Inherited from application.
web	webApplication	Specifies settings for a web application. Inherited from application.

Graph reference: agentIdentityBlueprintPrincipal

Property	Type	Description
accountEnabled	Boolean	`true` if the agent identity blueprint principal account is enabled; otherwise, `false`. If set to `false`, then no users are able to sign in to this app, even if they're assigned to it. Inherited from servicePrincipal.
appDescription	String	The description exposed by the associated agent identity blueprint. Inherited from servicePrincipal.
appDisplayName	String	The display name exposed by the associated agent identity blueprint. Maximum length is 256 characters. Inherited from servicePrincipal.
appId	String	The appId of the associated agent identity blueprint. Alternate key. Inherited from servicePrincipal.
appOwnerOrganizationId	Guid	Contains the tenant ID where the agent identity blueprint is registered. This is applicable only to agent identity blueprint principals backed by applications. Inherited from servicePrincipal.
appRoleAssignmentRequired	Boolean	Specifies whether users or other service principals need to be granted an app role assignment for this agent identity blueprint principal before users can sign in or apps can get tokens. The default value is `false`. Not nullable. Inherited from servicePrincipal.
appRoles	appRole collection	The roles exposed by the agent identity blueprint, which this agent identity blueprint principal represents. For more information, see the appRoles property definition on the application entity. Not nullable. Inherited from servicePrincipal.
createdByAppId	String	The appId (called Application (client) ID on the Microsoft Entra admin center) of the application that created this agent identity blueprint principal. Set internally by Microsoft Entra ID. Read-only. Inherited from servicePrincipal.
disabledByMicrosoftStatus	String	Specifies whether Microsoft has disabled the registered agent identity blueprint. Possible values are: `null` (default value), `NotDisabled`, and `DisabledDueToViolationOfServicesAgreement` (reasons may include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement). Inherited from servicePrincipal.
displayName	String	The display name for the agent identity blueprint principal. Inherited from servicePrincipal.
id	String	The unique identifier for the agent identity blueprint principal. Inherited from entity. Key. Not nullable. Read-only.
info	informationalUrl	Basic profile information of the acquired application such as app's marketing, support, terms of service and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience. Inherited from servicePrincipal.
publishedPermissionScopes	permissionScope collection	The delegated permissions exposed by the application. For more information, see the oauth2PermissionScopes property on the agent identity blueprint entity's api property. Not nullable. Inherited from servicePrincipal.
publisherName	String	The name of the Microsoft Entra tenant that published the application. Inherited from servicePrincipal.
servicePrincipalNames	String collection	Contains the list of identifiersUris, copied over from the associated agent identity blueprint. More values can be added to hybrid agent identity blueprint. These values can be used to identify the permissions exposed by this app within Microsoft Entra ID. Not nullable. Property blocked on Agent Identity Blueprint Principal. Inherited from servicePrincipal.
servicePrincipalType	String	Identifies if the agent identity blueprint principal represents an application. This is set by Microsoft Entra ID internally. For an agent identity blueprint principal that represents an application this is set as Application. Inherited from servicePrincipal.
signInAudience	String	Specifies the Microsoft accounts that are supported for the current agent identity blueprint. Read-only. Supported values are: `AzureADMyOrg`, `AzureADMultipleOrgs`, `AzureADandPersonalMicrosoftAccount`, and `PersonalMicrosoftAccount`. Inherited from servicePrincipal.
tags	String collection	Custom strings that can be used to categorize and identify the agent identity blueprint principal. Not nullable. The value is the union of strings set here and on the associated agent identity blueprint entity's tags property. Inherited from servicePrincipal.
verifiedPublisher	verifiedPublisher	Specifies the verified publisher of the application that's linked to this agent identity blueprint principal. Inherited from servicePrincipal.

Table of Contents

AgentIdentityBlueprintPrincipal.Create

Graph Methods

Resources