Skip to content
MitoMito Docs

MT.1204: Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview).
ID MT.1204
Severity Medium
Suite Mito
Product Entra ID
Feature Agent identities
Security area AI and agents
Resource type Agent
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:AC-2 Account Management
Reads from Microsoft Graph
Lifecycle Preview

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Agent Identities, Blueprint Principals, and Blueprints should have at least one active, enabled owner.

Owners are the technical custodians responsible for an AI agent’s configuration, credentials, and lifecycle. When an agent or blueprint has no assigned owners—or when all assigned owners are deleted or disabled user accounts—the agent becomes unmanaged, making it harder to review security access, investigate anomalies, or safely decommission stale resources.

This check audits all Agent Identities, Blueprint Principals, and Blueprints in the tenant to confirm they have at least one active and enabled owner.

Remediation action:

Section titled “Remediation action:”
  1. Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent identities (or Agent blueprints).
  2. Search for the reported object by its Object ID or display name.
  3. Under Access, select Owners and sponsors.
  4. For a Blueprint, select the Agent blueprint or Agent blueprint principal tab for the reported object.
  5. Select Add > Add owner, choose at least one active, responsible administrator or service manager, and select Add.
  6. Review any existing owners and remove any disabled or former employee accounts.
Section titled “Related links”

Mito check. Author: agnivesh. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.