Microsoft Entra built-in rolePublic reference
Agent ID Administrator
Manage all aspects of agents in a tenant including identity lifecycle operations for agent blueprints, agent identity blueprint principals, agent identities, and agentic users.
Documented resource actions
64 documented actionsThese are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.
| Action | Description |
|---|---|
| microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |
| microsoft.azure.supportTickets/allEntities/allTasks | Create and manage Azure support tickets |
| microsoft.directory/agentIdentities/appRoleAssignedTo/update | Update agent identity role assignments |
| microsoft.directory/agentIdentities/authentication/update | Update authentication on agent identities |
| microsoft.directory/agentIdentities/basic/update | Update basic properties on agent identities |
| microsoft.directory/agentIdentities/create | Create agent identities |
| microsoft.directory/agentIdentities/delete | Delete agent identities |
| microsoft.directory/agentIdentities/disable | Disable agent identities |
| microsoft.directory/agentIdentities/enable | Enable agent identities |
| microsoft.directory/agentIdentities/owners/update | Update owners on agent identities |
| microsoft.directory/agentIdentities/tag/update | Update tags of agent identities |
| microsoft.directory/agentIdentityBlueprintPrincipals/appRoleAssignedTo/update | Update agent identity blueprint principal role assignments |
| microsoft.directory/agentIdentityBlueprintPrincipals/authentication/update | Update authentication on agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/basic/update | Update basic properties on agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/create | Create agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/delete | Delete agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/disable | Disable agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/enable | Enable agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/owners/update | Update owners on agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprintPrincipals/tag/update | Update tags of agent identity blueprint principals |
| microsoft.directory/agentIdentityBlueprints/allProperties/read | Read all properties of agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/allProperties/update | Update all properties of agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/appRoles/update | Update appRoles on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/audience/update | Update audience on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/authentication/update | Update authentication on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/basic/update | Update basic properties on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/create | Create agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/credentials/update | Update credentials on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/delete | Delete agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/owners/update | Update owners on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/permissions/update | Update exposed permissions and required permissions on agent identity blueprints |
| microsoft.directory/agentIdentityBlueprints/tag/update | Update tags of agent identity blueprints |
| microsoft.directory/agentUsers/assignLicense | Assign product licenses for agent users |
| microsoft.directory/agentUsers/basic/update | Update basic properties on agent users, such display name, user type, and mail nickname |
| microsoft.directory/agentUsers/create | Create agent users |
| microsoft.directory/agentUsers/delete | Delete agent users |
| microsoft.directory/agentUsers/disable | Disable agent users |
| microsoft.directory/agentUsers/enable | Enable agent users |
| microsoft.directory/agentUsers/invalidateAllRefreshTokens | Force sign-out by invalidating agent user refresh tokens |
| microsoft.directory/agentUsers/lifeCycleInfo/read | Read lifecycle information of agent users, such as employeeLeaveDateTime |
| microsoft.directory/agentUsers/lifeCycleInfo/update | Update lifecycle information of agent users, such as employeeLeaveDateTime |
| microsoft.directory/agentUsers/manager/update | Update manager for agent users |
| microsoft.directory/agentUsers/photo/update | Update photo of agent users |
| microsoft.directory/agentUsers/reprocessLicenseAssignment | Reprocess license assignments for agent users |
| microsoft.directory/agentUsers/restore | Restore deleted agent users |
| microsoft.directory/agentUsers/revokeSignInSessions | Revoke sign-in sessions for agent users |
| microsoft.directory/agentUsers/sponsors/update | Update sponsors of agent users |
| microsoft.directory/agentUsers/usageLocation/update | Update usage location of agent users |
| microsoft.directory/agentUsers/userPrincipalName/update | Update the user principal name of agent users |
| microsoft.directory/auditLogs/allProperties/read | Read all properties on audit logs, excluding custom security attributes audit logs |
| microsoft.directory/deletedItems.agentIdentities/delete | Permanently delete agent identities, which can no longer be restored |
| microsoft.directory/deletedItems.agentIdentities/restore | Restore soft-deleted agent identities to original state |
| microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/delete | Permanently delete agent identity blueprint principals, which can no longer be restored |
| microsoft.directory/deletedItems.agentIdentityBlueprintPrincipals/restore | Restore soft-deleted agent identity blueprint principals to original state |
| microsoft.directory/deletedItems.agentIdentityBlueprints/delete | Permanently delete agent identity blueprints, which can no longer be restored |
| microsoft.directory/deletedItems.agentIdentityBlueprints/restore | Restore soft-deleted agent identity blueprints to original state |
| microsoft.directory/externalUserProfiles/standard/read | Read standard properties of external user profiles in the extended directory for Teams |
| microsoft.directory/groups.unified/createAsOwner | Create Microsoft 365 groups, excluding role-assignable groups. Creator is added as the first owner. |
| microsoft.directory/groups/hiddenMembers/read | Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups |
| microsoft.directory/organization/standard/read | Read basic properties on an organization |
| microsoft.directory/policies/standard/read | Read basic properties on policies |
| microsoft.directory/signInReports/allProperties/read | Read all properties on sign-in reports, including privileged properties |
| microsoft.office365.serviceHealth/allEntities/allTasks | Read and configure Service Health in the Microsoft 365 admin center |
| microsoft.office365.supportTickets/allEntities/allTasks | Create and manage Microsoft 365 service requests |