Every Entra default user permission, what it does, and how to check yours in one command

This week's change to agent blueprints sent a lot of people to Entra ID > Users > User settings for the first time in a while. While you're there, it's worth checking the rest of the page. Each toggle decides what every ordinary user in your tenant can do without an admin role.

The settings

Most of these map to properties on the defaultUserRolePermissions object in Microsoft Graph, so you can read them all at once.

• Users can register applications (allowedToCreateApps). Lets any user create app registrations. If you turn it off, give the Application Developer role to people who need it.
• Users can create agent blueprints. The new one, rolling out from November. Controls whether default users can create the templates AI agents are built from. Separate from the app registration setting.
• Restrict non-admin users from creating tenants (allowedToCreateTenants). Note the inversion: Yes in the portal means the Graph value is false. Users with the Tenant Creator role can still create tenants either way.
• Users can create security groups (allowedToCreateSecurityGroups). Also controlled from the Groups settings page.
• User consent to apps (permissionGrantPoliciesAssigned). Which app consent policy applies when users grant apps access to their data. An empty list means user consent is turned off. This one lives under Enterprise apps > Consent and permissions.
• Read own BitLocker keys (allowedToReadBitlockerKeysForOwnedDevice). Whether device owners can see their own recovery keys.
• Read other users (allowedToReadOtherUsers). Microsoft's documentation is blunt: do not set this to false. It breaks normal directory lookups.

Check your tenant in one go

1
2Connect-MgGraph -Scopes Policy.Read.All
(Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions | Format-List

Look for AllowedToCreateApps, AllowedToCreateTenants, AllowedToCreateSecurityGroups and an empty or populated PermissionGrantPoliciesAssigned. That's the whole picture in a few lines, and it's easy to drop into a scheduled check.

To change one, you need the Policy.ReadWrite.Authorization permission and at least the Privileged Role Administrator role. For example, to stop users registering apps:

1
2Connect-MgGraph -Scopes Policy.ReadWrite.Authorization
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{ AllowedToCreateApps = $false }

Microsoft hasn't yet documented a Graph property for the agent blueprints setting, so set that one in the admin centre for now.

A sensible starting point

For consent, the usual middle ground is to allow users to consent only to low-risk permissions from verified publishers and send everything else through the admin consent workflow. There's a full walkthrough in admin consent workflow and user consent.