MC1506728 – Clarification on AgentIdentity.CreateAsManager for Copilot Studio agent identity blueprint

Question

MC1506728 – Clarification on AgentIdentity.CreateAsManager for Copilot Studio agent identity blueprint

Ines Pissarra 0

Regarding Microsoft Message Center notification MC1506728 and the change planned for November 2026, will the Microsoft Copilot Studio agent identity blueprint require an explicit AgentIdentity.CreateAsManager permission grant to continue automatically creating Agent IDs for new Copilot Studio agents?

Erin Greenlee 26 Reputation points Microsoft Employee

2026-11-03T22:23:20.1266667+00:00

Hiya! Microsoft-managed platforms like Copilot and Foundry will continue to work as needed without explicit consent. Agents that are created in your organization, other organizations, or from third-party platforms will need explicit consent.

1 answer

Your answer

Erin Greenlee 26 Reputation points Microsoft Employee

2026-11-03T22:23:20.1266667+00:00

Hiya! Microsoft-managed platforms like Copilot and Foundry will continue to work as needed without explicit consent. Agents that are created in your organization, other organizations, or from third-party platforms will need explicit consent.

Answer 1

No. The Microsoft Copilot Studio agent identity blueprint does not require a separate explicit AgentIdentity.CreateAsManager grant to keep creating Agent IDs for new Copilot Studio agents.

Supported facts:

Copilot Studio automatically creates a Microsoft Entra Agent ID for each new agent.
When the first agent identity is created in an environment, Copilot Studio adds the Microsoft Copilot Studio agent identity blueprint to the tenant.
The Copilot Studio agent identities are created as children of that blueprint principal.
For agent identity blueprint principals, AgentIdentity.CreateAsManager is automatically granted to any agent identity blueprint principal in the tenant, and can’t be revoked.

So for the Copilot Studio blueprint, continued automatic Agent ID creation is based on the blueprint principal being present and enabled in the tenant, not on an admin manually granting AgentIdentity.CreateAsManager.

References: