Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Namespace: microsoft.graph
Important
APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
An agent identity blueprint serves as a template for creating agent identities within the Microsoft Entra ID ecosystem.
Inherits from application.
This resource is an open type that allows additional properties beyond those documented here.
Methods
| Method | Return type | Description |
|---|---|---|
| List | agentIdentityBlueprint collection | Get a list of the agentIdentityBlueprint objects and their properties. |
| Create | agentIdentityBlueprint | Create (register) a new agentIdentityBlueprint. |
| Get | agentIdentityBlueprint | Read the properties and relationships of agentIdentityBlueprint object. |
| Update | agentIdentityBlueprint | Update the properties of an agentIdentityBlueprint object. |
| Upsert | agentIdentityBlueprint | Create a new agent identity blueprint if it doesn't exist, or update the properties of an existing blueprint. |
| Delete | None | Delete an agentIdentityBlueprint object. |
| Credentials | ||
| Add password | passwordCredential | Add a strong password or secret to an agent identity blueprint. |
| Remove password | passwordCredential | Remove a password or secret from an agent identity blueprint. |
| Add key | keyCredential | Add a key credential to an agent identity blueprint. |
| Remove key | None | Remove a key credential from an agent identity blueprint. |
| List federatedIdentityCredential | federatedIdentityCredential collection | Get a list of the federatedIdentityCredential objects and their properties. |
| Create federatedIdentityCredential | federatedIdentityCredential | Create a new federatedIdentityCredential object. |
| Get federatedIdentityCredential | federatedIdentityCredential | Read the properties and relationships of a federatedIdentityCredential object. |
| Update federatedIdentityCredential | None | Update the properties of a federatedIdentityCredential object. |
| Upsert federatedIdentityCredential | federatedIdentityCredential | Create a new federatedIdentityCredential if it doesn't exist, or update the properties of an existing federatedIdentityCredential object. |
| Delete federatedIdentityCredential | None | Delete a federatedIdentityCredential object. |
| Deleted items | ||
| List | directoryObject collection | Retrieve a list of recently deleted agent identities. |
| Get | directoryObject | Retrieve the properties of a recently deleted agent identity. |
| Restore | directoryObject | Restore a recently deleted agent identity. |
| Permanently delete | None | Permanently delete an agent identity. |
| Owners | ||
| List owners | directoryObject collection | Get the owners of this agent identity blueprint principal. |
| Add owners | directoryObject | Assign an owner to this agent identity blueprint principal. |
| Remove owners | None | Remove an owner from this agent identity blueprint principal. |
| Sponsors | ||
| List sponsors | directoryObject collection | Get the sponsors for this agent identity blueprint. Sponsors are users or service principals who can authorize and manage the lifecycle of agent identity instances. |
| Add sponsors | directoryObject | Add sponsors by posting to the sponsors collection. |
| Remove sponsors | None | Remove a directoryObject object. |
| Verified publisher | ||
| Set | None | Set the verified publisher of an application. |
| Unset | None | Unset the verified publisher of an application. |
Properties
Important
While this resource inherits from application, some properties are not applicable and return null or default values. These properties are excluded from the table below.
| Property | Type | Description |
|---|---|---|
| api | apiApplication | Specifies settings for an agent identity blueprint that implements a web API. Inherited from application. |
| appId | String | The unique identifier for the agent identity blueprint that is assigned by Microsoft Entra ID. Not nullable. Read-only. Inherited from application. |
| appRoles | appRole collection | The collection of roles defined for the agent identity blueprint. With app role assignments, these roles can be assigned to users, groups, or service principals associated with other applications. Not nullable. Inherited from application. |
| certification | certification | Specifies the certification status of the agent identity blueprint. Inherited from application. |
| createdByAppId | String | The unique identifier of the application that created this agent identity blueprint. Set internally by Microsoft Entra ID. Read-only. Inherited from application. |
| createdDateTime | DateTimeOffset | The date and time the agent identity blueprint was registered. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. Read-only. Inherited from application. |
| createdByAppId | String | The appId (called Application (client) ID on the Microsoft Entra admin center) of the application that created this agent identity blueprint. Set internally by Microsoft Entra ID. Read-only. Inherited from application. |
| description | String | Free text field to provide a description of the agent identity blueprint to end users. The maximum allowed size is 1,024 characters. Inherited from application. |
| disabledByMicrosoftStatus | String | Specifies whether Microsoft has disabled the registered agent identity blueprint. The possible values are: null (default value), NotDisabled, and DisabledDueToViolationOfServicesAgreement (reasons may include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement). Inherited from application. |
| displayName | String | The display name for the agent identity blueprint. Maximum length is 256 characters. Inherited from application. |
| groupMembershipClaims | String | Configures the groups claim issued in a user or OAuth 2.0 access token that the agent identity blueprint expects. To set this attribute, use one of the following string values: None, SecurityGroup (for security groups and Microsoft Entra roles), All (this gets all security groups, distribution groups, and Microsoft Entra directory roles that the signed-in user is a member of). Inherited from application. |
| id | String | Unique identifier for the agent identity blueprint object. This property is referred to as Object ID in the Microsoft Entra admin center. Key. Not nullable. Read-only. Inherited from directoryObject. |
| identifierUris | String collection | Also known as App ID URI, this value is set when an agent identity blueprint is used as a resource app. The identifierUris acts as the prefix for the scopes you reference in your API's code, and it must be globally unique across Microsoft Entra ID. Not nullable. Inherited from application. |
| info | informationalUrl | Basic profile information of the agent identity blueprint, such as it's marketing, support, terms of service, and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience. Inherited from application. |
| keyCredentials | keyCredential collection | The collection of key credentials associated with the agent identity blueprint. Not nullable. Inherited from application. |
| optionalClaims | optionalClaims | Application developers can configure optional claims in their Microsoft Entra agent identity blueprints to specify the claims that are sent to their application by the Microsoft security token service. Inherited from application. |
| passwordCredentials | passwordCredential collection | The collection of password credentials associated with the agent identity blueprint. Not nullable. Inherited from application. You can also add passwords after creating the agent identity blueprint by calling the Add password API. |
| publisherDomain | String | The verified publisher domain for the agent identity blueprint. Read-only. Inherited from application. |
| serviceManagementReference | String | References application or service contact information from a Service or Asset Management database. Nullable. Inherited from application. |
| signInAudience | String | Specifies the Microsoft accounts that are supported for the current agent identity blueprint. The possible values are: AzureADMyOrg (default), AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, and PersonalMicrosoftAccount. Inherited from application. |
| tags | String collection | Custom strings that can be used to categorize and identify the agent identity blueprint. Not nullable. Inherited from application. |
| tokenEncryptionKeyId | Guid | Specifies the keyId of a public key from the keyCredentials collection. When configured, Microsoft Entra ID encrypts all the tokens it emits by using the key this property points to. Inherited from application. |
| uniqueName | String | The unique identifier that can be assigned to an agent identity blueprint and used as an alternate key. Immutable. Read-only. Inherited from application. |
| verifiedPublisher | verifiedPublisher | Specifies the verified publisher of the agent identity blueprint. Inherited from application. |
| web | webApplication | Specifies settings for a web application. Inherited from application. |
Relationships
| Relationship | Type | Description |
|---|---|---|
| appManagementPolicies | appManagementPolicy collection | The appManagementPolicy applied to this agent identity blueprint. Inherited from microsoft.graph.application |
| federatedIdentityCredentials | federatedIdentityCredential collection | Federated identities for agent identity blueprints. Inherited from microsoft.graph.application |
| owners | directoryObject collection | Directory objects that are owners of this agent identity blueprint. The owners are a set of nonadmin users or service principals allowed to modify this object. Read-only. Nullable. Inherited from microsoft.graph.application |
| sponsors | directoryObject collection | The sponsors for this agent identity blueprint. Sponsors are users or groups who can authorize and manage the lifecycle of agent identity instances. |
JSON representation
The following JSON representation shows the resource type. Only a subset of all properties are returned by default. All other properties can only be retrieved using $select.
{
"@odata.type": "#microsoft.graph.agentIdentityBlueprint",
"id": "String (identifier)",
"appId": "String",
"identifierUris": ["String"],
"createdByAppId": "String",
"createdDateTime": "String (timestamp)",
"description": "String",
"disabledByMicrosoftStatus": "String",
"displayName": "String",
"groupMembershipClaims": "String",
"publisherDomain": "String",
"signInAudience": "String",
"tags": ["String"],
"tokenEncryptionKeyId": "Guid",
"uniqueName": "String",
"serviceManagementReference": "String",
"certification": {
"@odata.type": "microsoft.graph.certification"
},
"optionalClaims": {
"@odata.type": "microsoft.graph.optionalClaims"
},
"api": {
"@odata.type": "microsoft.graph.apiApplication"
},
"appRoles": [
{
"@odata.type": "microsoft.graph.appRole"
}
],
"info": {
"@odata.type": "microsoft.graph.informationalUrl"
},
"keyCredentials": [
{
"@odata.type": "microsoft.graph.keyCredential"
}
],
"passwordCredentials": [
{
"@odata.type": "microsoft.graph.passwordCredential"
}
],
"verifiedPublisher": {
"@odata.type": "microsoft.graph.verifiedPublisher"
},
"web": {
"@odata.type": "microsoft.graph.webApplication"
}
}