In this blogpost we're going to talk about the upcoming change regarding the Agent Identity Blueprint. From November 4, 2026, all users are (by default) enabled to create Agent Identity Blueprints. 

1. What are Agent Blueprints?

With an Agent Blueprints you are able to create a template for your Agent Identities. With these Blueprints you are able to create a base regarding how agents are created, authenticated, and managed within your organization.

In an Agent Blueprint, you will find the following information:

• Description: A brief summary of the agent's purpose and functions;
• App roles: Define the roles that can be given to users and other principals when using the agent;
• Verified publisher: The organization that built the agent;
• Settings for authentication protocols: Configure which information is included in access tokens issued to the agent, such as OptionalClaims.

2. Why Do I Need To Change This?

Starting from November 4, 2026, all users are (by default) enabled to create Agent Identity Blueprints. So a user without an active Entra admin role is able to create an Agent Identity Blueprint. 

There are some key take aways to keep in mind:

• This doesn't affect the setting "Users can register applications". This setting is a different one and only applies to creating applications and agent identities in your organization;
• Existing Blueprints are not affected and stay available;
• To keep creating an Agent Identity Blueprints you will need to be an Agent ID Developer or Agent ID Administrator.

2.1 How To Turn Off?

Follow these steps to turn this setting off:

• Go to the Entra admin center (entra.microsoft.com);

• From the Entra admin center, select Users -> User settings;
  

From here we see a couple of settings that we can adjust (all should be No). Ensure you have the right Entra role in order to change these settings (GA) or a custom created role.

And while we are in Entra, please take a look at your "User consent settings for applications":

• From the Entra admin center, select Enterprise Apps -> Consent and permissions;

Make sure your "User consent settings" are set to "Do not allow user consent"

3. Wrap Up

Small blog, but a huge change if you don't turn this off in your environment. Creating Agent Blueprints should always be created by an admin where normal users shouldn't be able to create these blueprints.