How to create an agentUser?

Question

My client app is obtaining a token which includes the AgentIdUser.ReadWrite.IdentityParentedBy role. Yet,

POST https://graph.microsoft.com/v1.0/users/microsoft.graph.agentUser

returns 'Insufficient privileges to complete the operation'. Why?

Complete response:

{ "error": { "code": "Authorization_RequestDenied", "message": "Insufficient privileges to complete the operation.", "innerError": { "date": "2026-09-20T20:24:15", "request-id": "04d87b67-67db-4710-bfb0-69fbe4c5f46b", "client-request-id": "04d87b67-67db-4710-bfb0-69fbe4c5f46b" } } }

Answer 1

AgentIdUser.ReadWrite.IdentityParentedBy by itself is not always sufficient.

For delegated access with a work or school account, the signed-in admin must also be assigned a supported Microsoft Entra role. The least-privileged supported role for creating an agentUser is Agent ID Administrator. If the token has the Graph permission but the signed-in admin lacks that role, Microsoft Graph can return Authorization_RequestDenied with Insufficient privileges to complete the operation.

Also verify these requirements:

1. The request is sent to:

      POST /users/microsoft.graph.agentUser
   

2. The token is for Microsoft Graph and includes the required permission.
3. The request body includes all required properties:
   • accountEnabled
   • displayName
   • mailNickname
   • userPrincipalName
   • identityParentId
4. If using userPrincipalName, its domain must be one of the tenant’s verified domains.
5. Each identityParentId can be linked to only one agentUser. If it is already linked, the documented error is 400 Bad Request, not a privilege error.

A valid example request is:

POST https://graph.microsoft.com/v1.0/users/microsoft.graph.agentUser
Content-type: application/json

{
  "accountEnabled": true,
  "displayName": "Sales Agent",
  "mailNickname": "SalesAgent",
  "userPrincipalName": "******@contoso.com",
  "identityParentId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

If the client is creating agents’ user accounts by using the agent identity blueprint, that blueprint must be granted the application permission AgentIdUser.ReadWrite.IdentityParentedBy in the tenant. If a different client is used, that client needs AgentIdUser.ReadWrite.All delegated or application permission instead.

---

• Create agentUser
• Create agentUser
• Create agentUser
• Create agentUser
• Authenticate and acquire tokens for autonomous agents

Answer 2

Thanks. Seems that the comment at the end of your answer - about blueprint vs other type of client - is lacking from the documentation.