From November, every user can create agent blueprints in Entra unless you turn it off

Microsoft is changing who can create agents in Entra. From early November 2026, ordinary users with no admin role will be able to create agent identity blueprints unless you turn off a new setting. The rollout is expected to finish by late November.

The setting is already in the admin centre, so you can make the decision now. It takes effect when the rollout reaches your tenant.

Why blueprints matter

Every agent identity in Entra is created from a blueprint. Microsoft describes it as the template that "establishes the foundation for how agents are created, authenticated, and managed". That makes it more than a label:

• Credentials live on the blueprint. The secrets, certificates or federated credentials used to authenticate its agent identities are configured there.
• Permissions flow down. OAuth permissions granted to a blueprint are granted to every agent identity created from it.
• Policies apply to the whole family. Conditional Access can target a blueprint and every agent created from it, and disabling a blueprint stops all its agents signing in.
• The creator becomes the owner. Whoever creates a blueprint is automatically made owner of the blueprint and its principal, and owners can create agent identities from it without an Agent ID role.

Creating a blueprint doesn't grant access to company data on its own. Permissions still need consent. But it does put a reusable, credential-carrying template for agents into the hands of whoever made it. Most organisations will want that decided by whoever owns AI governance, not left as self-service.

Who's affected

• Affected: default users, meaning anyone without a built-in or custom Entra role.
• Not affected: admins and users with the Agent ID Developer role can still create blueprints whatever the setting says.
• Not affected: existing blueprints, the agent identities already created from them, and the requirements in platforms such as Microsoft Foundry and Security Copilot.

How to turn it off

1. Sign in to the Microsoft Entra admin centre.
2. Go to Entra ID > Users > User settings.
3. Under Default user role permissions, find the agent blueprints setting. Microsoft's notice calls it Users can create agent blueprints; some tenants currently show it as Users can register agent identity blueprints.
4. Set it to No and select Save.

Then give the Agent ID Developer role to the people who should build agents, ideally through PIM so it's time-bound and reviewed.

This is separate from Users can register applications, which sits just above it. Turning one off doesn't change the other, so check both.

Should you leave it on?

If you've already decided that anyone can build agents and you govern them after the fact, Microsoft says no action is needed. For everyone else, switch it off now and open it up deliberately later. It's much easier than finding out in December how many blueprints your users have made.

For the wider picture, see governing AI agent identities in Entra.