Skip to content
MitoMito Docs

MT.1213: Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview).
ID MT.1213
Severity High
Suite Mito
Product Entra ID
Feature Agent identities
Security area AI and agents
Resource type Agent
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:SC-23 Session Authenticity
nist-800-53-r5:SC-8 Transmission Confidentiality and Integrity
MITRE ATT&CK T1557
Reads from Microsoft Graph
Lifecycle Preview

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Agent Identity Blueprints should use specific, secure redirect URIs.

During interactive consent, Microsoft Entra sends the consent result and optional state value to a redirect URI registered on the Blueprint. A wildcard can route that response to an unintended or attacker-controlled matching address. A plain HTTP address sends the response without transport encryption, allowing someone who can observe or alter network traffic to intercept or tamper with the consent result or state. HTTP loopback addresses are permitted for local development because the response stays on the same device instead of travelling across the network; they should not be used for deployed endpoints.

This test reports Agent Identity Blueprints with a wildcard redirect URI or a non-loopback HTTP redirect URI. Redirect URIs should identify a specific destination and use HTTPS unless they are loopback addresses used for local development.

Remediation action:

Section titled “Remediation action:”
  1. Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent blueprints.
  2. Locate the reported Blueprint using its Object ID or display name.
  3. Under Authentication, remove the reported redirect URI.
  4. Replace it with a specific, https-only URI (or an http://localhost/loopback URI for local development only).
Section titled “Related links”

Mito check. Author: agnivesh. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.