Table of Contents
New Option in Entra Admin Center to Enable User Creation of Agent Blueprints
Earlier this month, I described how the Teams development group wanted to launch easier sharing of files in federated chat and as part of the effort, had decided to overwrite tenant settings to block the activity. It was another example of “Microsoft knows best,” a mindset that has surfaced many times in the past when Microsoft chooses product direction over tenant choice. Thankfully, in that case, Microsoft decided to retreat and retain existing tenant settings.
Now we hear in message center notification MC1506733 (13 October 2026) that Microsoft plans to introduce a new default user role permission in Entra ID called Users can create agent blueprints (Figure 1).
As the name implies, the control allows or blocks the ability of users to create agent blueprints. Introducing controls for tenants to control user behavior is always appreciated, but it’s absolutely not OK to enable the setting by default. If the toggle is left at the default on state, after Microsoft deploys the update in early November 2026, any user can create an agent blueprint. No administrative role is required.
If the toggle is set to off, administrators and users assigned the Agent ID Developer role will be able to create agent blueprints. Turning the option off doesn’t affect existing agent blueprints. Choosing to disable user creation mirrors how many organizations already govern application development and registration activities.
Agent Blueprints
An agent blueprint is part of the Entra Agent ID platform. A blueprint is an administrative and security template to enable organizations to manage AI agents at scale. Microsoft’s documentation notes that an agent blueprint has the following properties:
- Description: A brief summary of the agent’s purpose and functions.
- App roles: Define the roles that can be given to users and other principals when using the agent.
- Verified publisher: The organization that built the agent.
- Settings for authentication protocols: Configure which information is included in access tokens issued to the agent, such as OptionalClaims.
These properties are shared by agents created using the agent blueprint.
Take the Same Approach as Apps
The properties of an agent blueprint sound awfully similar to app registrations. Another user role permission controls whether users can create apps, and many Entra ID experts recommend that organizations should disable the control to block user-created apps.
The logic is that very few users who don’t hold administrative or development roles have a legitimate need to create registered apps. The average user probably isn’t aware of registered apps and wouldn’t know how to go about creating a new app, so why open up the possibility that an attacker who compromises an account and probably knows how app registration and permissions work can go ahead and create an app.
The same logic applies for agent blueprints. I cannot think of a scenario when average users will come into work and think about the next great agent blueprint that they plan to create. Organizations don’t want this to happen anyway. It’s much better all round when agent creation and management is handled carefully by people who know what they are doing, at least until the management tools are more developed and comprehensive than they are today.
Regretfully, Microsoft has a track record of allowing users to create objects that later end up in a mess. Teams is the best example. How many teams created for short-term purposes remain abandoned in Microsoft 365 tenants today? No one wants the same to happen with agents, which means that all aspects of the agent platform need to be controlled.
A Bewildering Decision
It’s understandable why the Entra team should want to have a control for agent blueprint creation. It’s bewildering that they should choose enabled as the default state. Doing so appears inconsistent with the security-first principles promoted through Microsoft’s Secure Future initiative.
One thing’s for sure; I will disable the new control as quickly as possible after it appears in the Entra admin center UX.
Microsoft 365 for IT Pros is a trusted source of technical insight that helps tenant administrators stay informed and productive. We update the content every month to reflect changes across Microsoft 365, and monthly update #136 is available now. Get your copy from Gumroad.com and stay up to date with the information that matters most for keeping your tenant secure, compliant, and running efficiently.