Entra Agent Identity Audit: What Breaks on November 4, 2026 · Enterprise Agentic AI Insights

Microsoft retires the automatic AgentIdentity.CreateAsManager grant on November 4, 2026. App-only agent identity creation then returns HTTP 403. The Entra audit filter that enumerates your exposure, the blueprint triage, the tenant default to close, and why the same query is your Article 26 evidence.

The thing on the CIO's desk this week

You have an agent inventory. You built it this year, probably under board pressure, and it is probably accurate for the agents your platform team deployed.

Now run one query against Entra audit logs. Filter Category to ApplicationManagement, Activity to Add Service Principal. Then look only at the events where the initiator is an Application and the target is an agent identity.

Those are agent identities that were created by software, on software's authority, with no administrator approving and no human in the record.

They are in your tenant today. On November 4, 2026, the path that created them closes.

The mechanic that is failing

Three facts stack, and the stack is the problem.

One. In Microsoft Entra, an agent blueprint is a template object that mints agent identities. Microsoft's own documentation is precise about what it needs to do that: an OAuth client ID, credentials, and a special Microsoft Graph permission called AgentIdentity.CreateAsManager.

Two. Until November 4, that permission is granted automatically to every agent blueprint principal. No admin consent step. No approval. The blueprint mints identities because it exists.

Three. The tenant setting that controls who can create a blueprint in the first place, defaultUserRolePermissions.allowedToCreateAgentIdentityBlueprints, ships enabled. A standard user holding no administrative role can create one.

Read those three together. Any employee could create a blueprint, and that blueprint could mint agent identities on its own authority, indefinitely, without anyone approving either step.

Here is the detail that undoes the most common objection. This setting is independent of "Users can register applications." If your organization locked down app registration years ago and considers this covered, it is not covered. Different switch.

What changes, exactly

Per Microsoft message center post MC1506728, published October 13, 2026:

Nothing is deleted. Existing agent identities and blueprints survive. Agents that create identities through a directory role are unaffected. What breaks is the silent path, and it breaks in production, in the middle of a rollout quarter.

There is a second-order problem worth naming. The official Microsoft Learn page for agent blueprints was last updated May 1, 2026, and carries no note about this change. A platform engineer who reads the documentation rather than the message center will not see November 4 coming. The breaking change and the documentation are not in the same place.

Why your CFO already feels this and cannot name it

Agent 365 does not charge per agent. Licenses attach to people: users who delegate access to an agent, and the owners or sponsors of agents that run under their own identity. One sponsor can cover many agents.

Consumption is separate and it is metered in Copilot Credits, weighted per event. A classic answer costs 1 credit. A generative answer, 2. An agent action, 5. Tenant Graph grounding, 10. Prepaid runs about $200 per 25,000 credits per month with no rollover, or a cent per credit pay as you go. And at 125 percent of prepaid capacity, custom agents are disabled once the current conversation ends, unless pay-as-you-go overflow is attached.

So the cost model asks a question: who sponsors this agent?

An agent identity minted by a blueprint, with an Application as the initiator, has no human in its creation record at all. It has no sponsor to attach to. That is why agent spend will not reconcile to an owner, and why nobody can forecast the credit meter: the unforecastable agents and the November 4 agents are the same population, approached from finance instead of identity.

The 125 percent cliff is what turns this from an accounting irritation into an outage. An unsponsored agent fleet consuming at 5 and 10 credits an action can walk a tenant into agents switching themselves off, and the first person to notice is a customer.

Licensing and credit figures are third-party analysis, not a Microsoft price page. Verify against current Microsoft Product Terms before committing a number to a board paper.

And here is why it is also a board-level liability

Everything above is an operations problem with a date. This is where it becomes the Chief Risk Officer's problem.

EU AI Act Article 26(2) requires human oversight by natural persons with the competence, training and authority to exercise it. Authority is a property of a named human being. It does not exist in the abstract.

An agent identity whose creation record shows an Application as the initiator, and no human anywhere in the chain, cannot be traced to a natural person who held the authority that agent now exercises. Not because the log is missing. Because the human was never there.

Article 26(6) requires logs under the deployer's control, retained at least six months, to the extent those logs are under its control and subject to the derogation in the text.

Put those together and something useful falls out:

> The Entra audit query Microsoft published so you could avoid a 403 is the same artifact that evidences your human-authority chain. One query. Two completely different reasons to run it.

The CIO runs it this week to keep agents from breaking. The CRO needs its output retained as evidence that every agent acting in the business traces to a person who was allowed to authorize it. The CIO's deadline is November 4. The CRO's deadline is whenever someone asks.

For context on the wider clock: Article 50 transparency obligations have been in force since August 2, 2026, and our ledger carries December 2, 2026 for providers of legacy generative AI systems under Article 50(2). That December date is carried from last week and was not re-verified against EUR-Lex in this cycle, so treat it as a planning marker rather than a citation. A "Digital Omnibus" package is also in circulation that may move AI Act dates; its legislative status is unconfirmed.

The move

Four steps. The first one takes about ten minutes and the window is seven days.

1. Enumerate, before November 4. Entra admin center, Audit Logs. Category ApplicationManagement, Activity Add Service Principal. Filter to events where the initiator is an Application and the target is an agent identity. That list is your exposure. If it is empty, you are genuinely fine and you now know it rather than hoping it.

2. Triage each blueprint. For every blueprint in that list, open Granted permissions. If no other permission allows identity creation, it is standing on the automatic grant and it breaks on November 4. From October 16 onward you can grant AgentIdentity.CreateAsManager explicitly, by tenant-wide admin consent or manual app-role assignment. Grant it deliberately, to the blueprints that should have it, and let the rest fail closed. A 403 on an agent nobody can name is a good outcome.

Use the Microsoft spelling. Third-party write-ups of this change have already published it as AgentIdentity.CreateManager, missing the As. Microsoft Learn and MC1506728 both say `AgentIdentity.CreateAsManager`. A grant script built on the wrong string fails against your intent while looking like it ran.

3. Close the front door. Decide whether standard users should be able to create agent blueprints at all. If not, set the tenant default to false:

`` Invoke-MgGraphRequest -Method PATCH https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy -Body '{"defaultUserRolePermissions":{"allowedToCreateAgentIdentityBlueprints":false}}' ``

Requires Policy.ReadWrite.Authorization. Confirm with a GET. And confirm the current default in your tenant rather than taking anyone's word for it, including ours.

4. Keep the output as evidence, not as a ticket. The enumeration from step 1 is your agent-authority baseline. Retain it, date it, and record for each agent identity the human who sponsors it going forward. That record is what makes the sponsor-based license model reconcilable and what answers Article 26(2) in the same breath. Then stop treating "we have an agent inventory" as the finished state. Inventory counts agents. This counts who was allowed to create them, which is the question that survives an audit.

A clean way to hold the distinction: inventory is a noun, authority is a verb. You finished the noun this year.

---

Test your exposure. The Agent Identity Exposure Check below walks the enumeration, estimates blast radius from your own tenant numbers, and gives you the audit filter and the remediation script to take straight into Entra.

---

<div data-ariana-embed="agent-identity-exposure-check"><p><a href="/assets/tools/agent-identity-exposure-check.html" target="_blank" rel="noopener">Open the Agent Identity Exposure Check →</a></p></div>

Sources

  1. MC1506728, Microsoft Entra, "Changes to AgentIdentity.CreateAsManager permission for agent identities," published October 13, 2026. https://mc.merill.net/message/MC1506728
  2. Microsoft Learn, "Agent identity blueprints in Microsoft Entra Agent ID," last updated May 1, 2026. https://learn.microsoft.com/en-us/entra/agent-id/agent-blueprint
  3. Microsoft Graph v1.0, "Create agentIdentity." https://learn.microsoft.com/en-us/graph/api/agentidentity-post?view=graph-rest-1.0
  4. Microsoft Graph v1.0, "Microsoft Entra Agent ID APIs in Microsoft Graph." https://learn.microsoft.com/en-us/graph/api/resources/agentid-platform-overview?view=graph-rest-1.0
  5. AdminDroid Blog, "Microsoft Entra Allows All Users to Create Agent Blueprints by Default," October 14, 2026. https://blog.admindroid.com/microsoft-entra-allows-default-users-to-create-agent-identity-blueprints/
  6. Microsoft Copilot Blog, "Microsoft Agent 365: The control plane for AI agents," November 18, 2025. https://www.microsoft.com/en-us/copilot/blog/2025/11/18/microsoft-agent-365-the-control-plane-for-ai-agents/
  7. Redress Compliance, "Agent 365 licensing guide," updated September 23, 2026. Third-party licensing analysis, not a Microsoft price page. https://redresscompliance.com/agent-365-licensing-guide
  8. Semperis, "Entra Agent Identities: Design Deep Dive." https://www.semperis.com/blog/entra-agent-identities-design-deep-dive/
  9. Baker Botts, "EU AI Act Article 50 Transparency Obligations Go Live," September 2026. https://www.bakerbotts.com/thought-leadership/publications/2026/september/eu-ai-act-article-50-transparency-obligations-go-live
  10. Cooley, "EU AI Act: Transparency Obligations Take Effect 2 August 2026," August 3, 2026. https://www.cooley.com/news/insight/2026/2026-08-03-eu-ai-act-transparency-obligations-take-effect-2-august-2026
  11. Technology.org, "EU AI Act Deadlines After the Digital Omnibus," October 13, 2026. Omnibus status not independently confirmed. https://www.technology.org/2026/10/13/eu-ai-act-deadlines-after-the-digital-omnibus-what-applies-from-december-2026-to-august-2028/

AEGIS, the Agentic Enterprise Governance and Intelligence Standard, is Ariana Digital's governance operating standard. Ariana Digital LLC is an Anthropic Claude Partner.

This article is analysis for planning purposes. It is not legal advice and not a compliance determination. Verify all licensing figures against current Microsoft Product Terms and all regulatory dates against the Official Journal before relying on them.

(c) Ariana Digital LLC. All rights reserved.

Open the formatted article on Ariana.Digital →