MT.1212: Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview).

Preview

This check is in preview and may change.

ID	MT.1212
Severity	Medium
Suite	Mito
Product	Entra ID
Feature	Agent identities
Security area	AI and agents
Resource type	Agent
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:AC-3 Access Enforcement nist-800-53-r5:AC-6 Least Privilege
MITRE ATT&CK	T1078.004
Reads from	Microsoft Graph
Lifecycle	Preview

What this checks and how to fix it

Agent Identity Blueprint Principals that expose application roles should require an explicit assignment before another identity can use them.

Application roles control which applications or agents can access capabilities provided by an Agent Identity Blueprint Principal. If assignment isn’t required, an identity in the tenant may receive a token for an enabled role without an administrator explicitly granting it access. Requiring assignment ensures that only approved identities can use those roles.

This test reports Agent Identity Blueprint Principals that expose at least one enabled application role but don’t require assignment. Disabled application roles aren’t included in the assessment.

Remediation action:

1. Open the Microsoft Entra admin center and navigate to Entra ID > Enterprise applications.
2. Locate the reported Blueprint Principal using its Object ID or display name.
3. Under Properties, set Assignment required? to Yes.
4. Under Users and groups (or the equivalent app role assignment surface), explicitly assign the principals that should be able to obtain tokens for the exposed roles.

Related links

• View and manage agent blueprints
• Restrict your Microsoft Entra app to a set of users

---

Mito check. Author: agnivesh. Open-source licences.