Autonomous agent is not showing inherited permissions

Question

Autonomous agent is not showing inherited permissions

Marius Rochon 61

My agent was created with an application permission, which was marked as inheritable. Yet, when I create an agent using that blueprint and request a token for that autonomous agent, the token does not list any role claims. Why?

Marius Rochon 61 Reputation points

2026-09-22T19:26:46.9166667+00:00
Here are my repro steps:

Created an agent blueprint with requiredResourceAccess including 'df021288-bdef-4463-88db-98f22de89214' Graph role.

Created inheritablePermissions on this blueprint:

"inheritableRoles": { "@odata.type": "#microsoft.graph.allAllowedRoles", "kind": "allAllowed" }

Used the following command add the following inheritable roles and completed the consent dialog it showed:

Add-EntraPermissionsToInheritToAgentIdentityBlueprintPrincipal -Scopes @("user.read","mail.read") -Roles @("https://graph.microsoft.com/mail.read","https://graph.microsoft.com/user.read.all")

Created an instance of the agent and requested a client credentials token for it.

Expected to see it include a roles claim with the above roles. The token did not include any roles claim. Why?

Your answer

Marius Rochon 61 Reputation points

2026-09-22T19:26:46.9166667+00:00

Here are my repro steps:

Created an agent blueprint with requiredResourceAccess including 'df021288-bdef-4463-88db-98f22de89214' Graph role.

Created inheritablePermissions on this blueprint:

"inheritableRoles": { "@odata.type": "#microsoft.graph.allAllowedRoles", "kind": "allAllowed" }

Used the following command add the following inheritable roles and completed the consent dialog it showed:

Add-EntraPermissionsToInheritToAgentIdentityBlueprintPrincipal -Scopes @("user.read","mail.read") -Roles @("https://graph.microsoft.com/mail.read","https://graph.microsoft.com/user.read.all")

Created an instance of the agent and requested a client credentials token for it.

Expected to see it include a roles claim with the above roles. The token did not include any roles claim. Why?