entra-agent-user

Create Agent Users in Microsoft Entra ID to enable AI agents to act as digital workers with user identity access. An agent user is a specialized user identity in Microsoft Entra ID that enables AI agents to act as digital workers. It allows agents to access APIs and services that strictly require user identities (e.g., Exchange mailboxes, Teams, org charts), while maintaining appropriate security boundaries. Agent users receive tokens with idtyp=user , unlike regular agent identities which receive idtyp=app . Important: The identityParentId must reference a true agent identity (created via an agent identity blueprint), NOT a regular application service principal. You can verify by checking that the service principal has @odata.type: #microsoft.graph.agentIdentity and servicePrincipalType: ServiceIdentity . Before creating an agent user, confirm the agent identity is a proper agentIdentity type: Verify the response contains: Common mistake: Using an app registration's appId or a regular application service principal's id will fail. Only agent identities created from blueprints work.