Microsoft Entra Agent ID coverage
Agent identity directory objects, blueprints, and lifecycle sponsors in this connected tenant. Permafrost is the first CIEM platform to ingest them.
4 agent identities · 3 blueprints · 0 sponsors
agent_blueprint_inheritable_permissions_high_risk
agent_blueprint_no_sponsor
agent_blueprint_with_recent_credential_added · last 30d
agent_identity_with_arm_owner
servicePrincipalType='ServiceIdentity'). Each agent inherits its declarative scope contract from its parent blueprint.Agent | Blueprint | Status | Blast radius |
|---|---|---|---|
Decommissioned Scheduler Agent demo-agent-3 | Legacy Scheduler | Disabled | 0— |
Field Ops Copilot Agent demo-agent-0 | Field Ops Copilot | Enabled | 0— |
Incident Summarizer Agent demo-agent-2 | Back-Office Automation | Enabled | 0— |
Invoice Triage Agent demo-agent-1 | Back-Office Automation | Enabled | 0— |
inheritablePermissions contract that auto-grants its scopes to every agent created from it, without further admin consent. Sponsor count tracks the directory objects authorised to manage the blueprint's agent lifecycle in this connected tenant.Blueprint | Agents | Sponsors | High-risk inheritable scopes | Credentials |
|---|---|---|---|---|
Back-Office Automation demo-blueprint-app-0002 | 2 | No sponsors | none | 0 pw · 1 key |
Field Ops Copilot demo-blueprint-app-0001 | 1 | No sponsors | none | 0 pw · 1 key |
Legacy Scheduler demo-blueprint-app-0003 | 1 | No sponsors | none | 2 pw · 1 key |
Sovereign clouds and the Agent Registry beta surface are deferred
Microsoft has not yet published a national-cloud availability matrix for Microsoft Entra Agent ID as of May 2026. Customer tenants in US Government L4 (GCC), US Government L5 (DOD), or China (21Vianet) sovereign clouds may not yet have Agent ID enabled — Permafrost will revisit when Microsoft publishes the matrix.
The Microsoft Entra Agent Registry beta APIs (agent runtime instances, agent registrations, agent cards, agent card manifests, agent collections) are deferred per Microsoft's announcement that these APIs will be replaced by the Microsoft Agent 365 APIs starting May 2026. The corresponding agent_runtime_instance_inactive finding is deferral-dependent and will ship when the new API stabilises. The CopilotPolicySettings.Read scope is not present in the Microsoft Graph permissions reference as of 2026-05-06; the copilot_grounding_data_unrestricted finding is rejection-dependent and not shipped.
Agent identities ingested via /v1.0/servicePrincipals/microsoft.graph.agentIdentity (AgentIdentity.Read.All). Blueprints via /v1.0/applications/microsoft.graph.agentIdentityBlueprint and per-blueprint /sponsors (AgentIdentityBlueprint.Read.All). Blueprint principals via /v1.0/servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal (AgentIdentityBlueprintPrincipal.Read.All). All read-only.