Edit

Share via

agentIdentityBlueprintPrincipal resource type

Namespace: microsoft.graph

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Represents an agent identity blueprint principal in a tenant. An agent identity blueprint principal is instantiated from an agentIdentityBlueprintPrincipal object and is used to create agent identities within a Microsoft Entra ID tenant, and perform various identity management operations that affect all agent identities created.

Inherits from servicePrincipal.

This resource is an open type that allows additional properties beyond those documented here.

Methods

Method Return type Description
List agentIdentityBlueprintPrincipal collection Get a list of the agentIdentityBlueprintPrincipal objects and their properties.
Create agentIdentityBlueprintPrincipal Create a new agentIdentityBlueprintPrincipal object.
Get agentIdentityBlueprintPrincipal Read the properties and relationships of agentIdentityBlueprintPrincipal object.
Update agentIdentityBlueprintPrincipal Update the properties of an agentIdentityBlueprintPrincipal object.
Delete None Delete an agentIdentityBlueprintPrincipal object.
App role assignments
List appRoleAssignedTo appRoleAssignment collection Get the users, groups, and agent identities assigned app roles for this agent identity blueprint principal.
Add appRoleAssignedTo appRoleAssignment Assign an app role for this agent identity blueprint principal to a user, group, or service principal.
Remove appRoleAssignedTo None Remove an app role assignment for this agent identity blueprint principal from a user, group, or service principal.
List appRoleAssignments appRoleAssignment collection Get the app roles that this agent identity blueprint principal is assigned.
Add appRoleAssignment appRoleAssignment Assign an app role to this agent identity blueprint principal.
Remove appRoleAssignment None Remove an app role assignment from this agent identity blueprint principal.
Delegated permission grants
List oauth2PermissionGrants oAuth2PermissionGrant collection Get the delegated permission grants authorizing this agent identity blueprint principal to access an API on behalf of a signed-in user.
Deleted items
List directoryObject collection Retrieve a list of recently deleted agent identities.
Get directoryObject Retrieve the properties of a recently deleted agent identity.
Restore directoryObject Restore a recently deleted agent identity.
Permanently delete None Permanently delete an agent identity.
Directory objects
List ownedObjects directoryObject collection Get directory objects owned by this agent identity blueprint principal.
List createdObjects directoryObject collection Get directory objects created by this agent identity blueprint principal.
Memberships
List memberOf directoryObject collection Get the groups that this agent identity blueprint principal is a direct member of.
Owners
List owners directoryObject collection Get the owners of this agent identity blueprint principal.
Add owners None Assign an owner to this agent identity blueprint principal.
Remove owners None Remove an owner from this agent identity blueprint principal.
Sponsors
List sponsors directoryObject collection Get the sponsors for this agent identity blueprint principal.
Add sponsors directoryObject Add sponsors by posting to the sponsors collection.
Remove sponsors None Remove a directoryObject object.

Properties

Important

While this resource inherits from servicePrincipal, some properties are not applicable and return null or default values. These properties are excluded from the table below.

Property Type Description
accountEnabled Boolean true if the agent identity blueprint principal account is enabled; otherwise, false. If set to false, then no users are able to sign in to this app, even if they're assigned to it. Inherited from servicePrincipal.
appDescription String The description exposed by the associated agent identity blueprint. Inherited from servicePrincipal.
appDisplayName String The display name exposed by the associated agent identity blueprint. Maximum length is 256 characters. Inherited from servicePrincipal.
appId String The appId of the associated agent identity blueprint. Alternate key. Inherited from servicePrincipal.
appOwnerOrganizationId Guid Contains the tenant ID where the agent identity blueprint is registered. This is applicable only to agent identity blueprint principals backed by applications. Inherited from servicePrincipal.
appRoleAssignmentRequired Boolean Specifies whether users or other service principals need to be granted an app role assignment for this agent identity blueprint principal before users can sign in or apps can get tokens. The default value is false. Not nullable. Inherited from servicePrincipal.
appRoles appRole collection The roles exposed by the agent identity blueprint, which this agent identity blueprint principal represents. For more information, see the appRoles property definition on the application entity. Not nullable. Inherited from servicePrincipal.
createdByAppId String The appId (called Application (client) ID on the Microsoft Entra admin center) of the application that created this agent identity blueprint principal. Set internally by Microsoft Entra ID. Read-only. Inherited from servicePrincipal.
disabledByMicrosoftStatus String Specifies whether Microsoft has disabled the registered agent identity blueprint. The possible values are: null (default value), NotDisabled, and DisabledDueToViolationOfServicesAgreement (reasons may include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement). Inherited from servicePrincipal.
displayName String The display name for the agent identity blueprint principal. Inherited from servicePrincipal.
id String The unique identifier for the agent identity blueprint principal. Inherited from entity. Key. Not nullable. Read-only.
info informationalUrl Basic profile information of the acquired application such as app's marketing, support, terms of service and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience. Inherited from servicePrincipal.
publishedPermissionScopes permissionScope collection The delegated permissions exposed by the application. For more information, see the oauth2PermissionScopes property on the agent identity blueprint entity's api property. Not nullable. Inherited from servicePrincipal.
publisherName String The name of the Microsoft Entra tenant that published the application. Inherited from servicePrincipal.
servicePrincipalNames String collection Contains the list of identifiersUris, copied over from the associated agent identity blueprint. More values can be added to hybrid agent identity blueprint. These values can be used to identify the permissions exposed by this app within Microsoft Entra ID. Not nullable. Property blocked on Agent Identity Blueprint Principal. Inherited from servicePrincipal.
servicePrincipalType String Identifies if the agent identity blueprint principal represents an application. This is set by Microsoft Entra ID internally. For an agent identity blueprint principal that represents an application this is set as Application. Inherited from servicePrincipal.
signInAudience String Specifies the Microsoft accounts that are supported for the current agent identity blueprint. Read-only. Supported values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, and PersonalMicrosoftAccount. Inherited from servicePrincipal.
tags String collection Custom strings that can be used to categorize and identify the agent identity blueprint principal. Not nullable. The value is the union of strings set here and on the associated agent identity blueprint entity's tags property. Inherited from servicePrincipal.
verifiedPublisher verifiedPublisher Specifies the verified publisher of the application that's linked to this agent identity blueprint principal. Inherited from servicePrincipal.

Relationships

Relationship Type Description
appManagementPolicies appManagementPolicy collection The appManagementPolicy applied to this agent identity blueprint principal. Inherited from microsoft.graph.servicePrincipal
appRoleAssignedTo appRoleAssignment collection App role assignments for this agent identity blueprint principal, granted to users, groups, and other service principals. Supports $expand. Inherited from microsoft.graph.servicePrincipal
appRoleAssignments appRoleAssignment collection App role assignment for another app or service, granted to this agent identity blueprint principal. Supports $expand. Inherited from microsoft.graph.servicePrincipal
createdObjects directoryObject collection Directory objects created by this agent identity blueprint principal. Read-only. Nullable. Inherited from microsoft.graph.servicePrincipal
memberOf directoryObject collection Roles that this agent identity blueprint principal is a member of. HTTP Methods: GET Read-only. Nullable. Supports $expand. Inherited from microsoft.graph.servicePrincipal
oauth2PermissionGrants oAuth2PermissionGrant collection Delegated permission grants authorizing this agent identity blueprint principal to access an API on behalf of a signed-in user. Read-only. Nullable. Inherited from microsoft.graph.servicePrincipal
ownedObjects directoryObject collection Directory objects that are owned by this agent identity blueprint principal. Read-only. Nullable. Supports $expand and $filter (/$count eq 0, /$count ne 0, /$count eq 1, /$count ne 1). Inherited from microsoft.graph.servicePrincipal
owners directoryObject collection Directory objects that are owners of this agent identity blueprint principal. The owners are a set of nonadmin users or servicePrincipals who are allowed to modify this object. Supports $expand and $filter (/$count eq 0, /$count ne 0, /$count eq 1, /$count ne 1). Inherited from microsoft.graph.servicePrincipal
sponsors directoryObject collection The sponsors for this agent identity blueprint principal. Sponsors are users or service principals who can authorize and manage the lifecycle of agent identity instances.

JSON representation

The following JSON representation shows the resource type. Only a subset of all properties are returned by default. All other properties can only be retrieved using $select.

{
  "@odata.type": "#microsoft.graph.agentIdentityBlueprintPrincipal",
  "id": "String (identifier)",
  "accountEnabled": "Boolean",
  "createdByAppId": "String",
  "appDescription": "String",
  "appDisplayName": "String",
  "appId": "String",
  "appOwnerOrganizationId": "Guid",
  "appRoleAssignmentRequired": "Boolean",
  "disabledByMicrosoftStatus": "String",
  "displayName": "String",
  "publisherName": "String",
  "servicePrincipalNames": [
    "String"
  ],
  "servicePrincipalType": "String",
  "signInAudience": "String",
  "tags": [
    "String"
  ],
  "appRoles": [
    {
      "@odata.type": "microsoft.graph.appRole"
    }
  ],
  "info": {
    "@odata.type": "microsoft.graph.informationalUrl"
  },
  "publishedPermissionScopes": [
    {
      "@odata.type": "microsoft.graph.permissionScope"
    }
  ],
  "verifiedPublisher": {
    "@odata.type": "microsoft.graph.verifiedPublisher"
  }
}
  • Last updated on