Microsoft Entra to change default AI agent blueprint permissions

Microsoft is set to update Microsoft Entra, changing the default permissions for creating agent identity blueprints. Starting November 4, 2026, all users will be able to create these blueprints by default, with the global rollout expected to conclude by late November 2026.

Agent identity blueprints serve as templates for managing AI agent identities within an organization. To maintain governance and ensure only authorized personnel can create these identities, IT administrators must manually adjust the ‘Users can register agent identity blueprints’ setting to ‘No’ within the Microsoft Entra admin center.

Even when the setting is disabled for general users, those assigned specific roles, such as Agent ID Developer or Agent ID Administrator, will retain the ability to create blueprints. Organizations are encouraged to review their tenant settings before the rollout to prevent unauthorized agent creation in their environments.