Skip to content
MitoMito Docs

MT.1201: Agent Users should have an existing parent Agent Identity (Preview).
ID MT.1201
Severity Medium
Suite Mito
Product Entra ID
Feature Agent identities
Security area AI and agents
Resource type Agent
User impact of fixing Low
Effort to fix Low
MITRE ATT&CK T1078.004
Reads from Microsoft Graph
Lifecycle Preview

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Agent Users should have an existing Agent Identity.

An Agent User is the Entra user account paired with an Agent Identity. Some agents need this second account to access systems that require a user account. The two accounts should share the same lifecycle.

This check looks for Agent Users whose parent Agent Identity is missing. The account can be left behind after the agent is deleted and may still have group memberships, licenses, or other access. That makes it harder to tell why the account exists and whether it should still have access.

Remediation action:

Section titled “Remediation action:”
  1. Open the Microsoft Entra admin center and go to Entra ID > Users. Search for the Agent User by its Object ID or user principal name. The report’s parent value is an object ID; identityParentId is not a portal field.
  2. Go to Entra ID > Agents > Agent identities and search for the parent Agent Identity object ID. Review its status, owners and sponsors, permissions, audit logs, and sign-in logs if it still exists.
  3. If the Agent Identity is still needed, follow Microsoft’s restore guidance. If its blueprint or Blueprint Principal was deleted, restore that parent first when possible.
  4. If the Agent User is no longer needed, review its group memberships, licenses, and access. Then delete it from Entra ID > Users or follow Microsoft’s Agent ID deletion guidance. Deletion is soft by default, so the user can normally be restored for 30 days.
Section titled “Related links”

Mito check. Author: agnivesh. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.