Skip to content
MitoMito Docs

MT.1211: Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview).
ID MT.1211
Severity High
Suite Mito
Product Entra ID
Feature Agent identities
Security area AI and agents
Resource type Agent
User impact of fixing Low
Effort to fix Medium
Framework controls nist-800-53-r5:AC-6 Least Privilege
MITRE ATT&CK T1078.004
Reads from Microsoft Graph
Lifecycle Preview

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Agent Identity Blueprints should pass only explicitly selected delegated scopes and application roles to their child Agent Identities.

The allAllowed inheritance pattern gives every child Agent Identity all permissions granted to the Blueprint for a resource, without requiring separate consent. It also applies permissions granted to the Blueprint in the future. This can give existing and future Agent Identities broader access than intended and increases the impact of an unnecessary or high-risk permission assignment.

This test reports Agent Identity Blueprints that allow all delegated scopes or all application roles to be inherited. Each Blueprint should instead define only the permissions its child Agent Identities require.

Remediation action:

Section titled “Remediation action:”
  1. Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent blueprints.
  2. Locate the reported Blueprint using its Object ID or display name.
  3. Review its inheritable permissions configuration for the reported resource.
  4. Replace the allAllowed pattern with an enumerated list: use enumerated scopes for delegated scope findings and enumerated application roles for application role findings. Include only the permissions agents require.
  5. Re-consent affected Agent Identities if narrowing the inheritance pattern removes permissions they were using.
Section titled “Related links”

Mito check. Author: agnivesh. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.