MT.1203: Agent Identity Blueprint Principals should have an existing Blueprint (Preview).

Preview

This check is in preview and may change.

ID	MT.1203
Severity	Medium
Suite	Mito
Product	Entra ID
Feature	Agent identities
Security area	AI and agents
Resource type	Agent
User impact of fixing	Low
Effort to fix	Low
MITRE ATT&CK	T1078.004
Reads from	Microsoft Graph
Lifecycle	Preview

What this checks and how to fix it

Agent Identity Blueprint Principals should have an existing Blueprint.

An Agent Identity Blueprint defines how Agent Identities are created and managed. A Blueprint Principal is the service principal created from that Blueprint in the tenant. If the Blueprint is deleted but the Principal remains, the linked Agent Identities can fall outside the Blueprint’s management and lifecycle.

This check lists Blueprint Principals whose Blueprint no longer exists. Review each one before deleting or restoring anything. The remaining Principal or Agent Identities may still have permissions and access assignments.

Remediation action:

1. Open the Microsoft Entra admin center and go to Entra ID > Agents > Agent blueprints.
2. Search for the reported Blueprint App ID and confirm whether the Blueprint was deleted or whether the Blueprint Principal is no longer required.
3. Review the reported Blueprint Principal and linked Agent Identity object IDs, including their owners, sponsors, permissions, audit logs, and sign-in logs.
4. If the agent is still required, follow Microsoft’s restore guidance. If it is no longer required, disable the linked identities, review their access, and then remove the stale Agent ID objects in the order described by Microsoft.

Related links

• View and manage Agent Identity Blueprints
• How to delete and restore Agent Identity objects
• Agent Identity Blueprint resource

---

Mito check. Author: agnivesh. Open-source licences.