Microsoft Entra Agent ID
GeneralDisable Agent Identities
In brief
The documented procedure now uses **Disable** > **Disable in all tenants** and specifies that the impact applies to multi-tenant blueprints.
What Entra admins need to know
Disabling such a blueprint can cause related agents in other tenants to fail or lose functionality.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Existing agents running in your organization might begin to fail.
- Microsoft product experiences that assume agent identity availability (for example, Copilot Studio agents, Security Copilot scenario agents, Microsoft Entra Conditional Access Optimization Agent) might fail or fall back to standard service principals that lack agent-specific tracking and controls.
- If you
globallydisableana multi-tenant agent identity blueprint inyour tenant which hasall tenants, and the blueprint had principals and child identities created in other tenants, then related agents in those tenants may fail or lose functionality.
Monitor for agent identity creation and activity
- Browse to Entra ID > Agents > Agent blueprints.
- Select the agent identity blueprint you want to disable then select Disable.
To globally disable an agent identity blueprint:blueprint in all tenants:
- Sign in to the Microsoft Entra admin center as at least an Agent ID Administrator.
- Browse to Entra ID > Agents > Agent blueprints.
- Select the agent identity blueprint you want to globally
disabledisable, select the Disable menu and thenselectchoose Disablegloballyin all tenants.
Create Conditional Access policies to disable agent activities
@@ -29,7 +29,7 @@ Disabling an agent identity or agent identity blueprint in your tenant might hav - Existing agents running in your organization might begin to fail. - Microsoft product experiences that assume agent identity availability (for example, Copilot Studio agents, Security Copilot scenario agents, Microsoft Entra Conditional Access Optimization Agent) might fail or fall back to standard service principals that lack agent-specific tracking and controls.-- If you globally disable an agent identity blueprint in your tenant which has had principals and child identities created in other tenants, then related agents in those tenants may fail or lose functionality.+- If you disable a multi-tenant agent identity blueprint in all tenants, and the blueprint had principals and child identities created in other tenants, then related agents in those tenants may fail or lose functionality. ## Monitor for agent identity creation and activity @@ -77,11 +77,11 @@ To disable an agent identity blueprint: 1. Browse to **Entra ID** > **Agents** > **Agent blueprints**. 1. Select the agent identity blueprint you want to disable then select **Disable**. -To globally disable an agent identity blueprint: +To disable an agent identity blueprint in all tenants: 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Agent ID Administrator](../identity/role-based-access-control/permissions-reference.md#agent-id-administrator). 1. Browse to **Entra ID** > **Agents** > **Agent blueprints**.-1. Select the agent identity blueprint you want to globally disable then select **Disable globally**.+1. Select the agent identity blueprint you want to globally disable, select the **Disable** menu and then choose **Disable in all tenants**. ## Create Conditional Access policies to disable agent activities @@ -360,4 +360,4 @@ For more information, see [Teams admin center documentation](/microsoftteams/man - [Agent identity deletion](concept-agent-identity-deletion.md) - [Create and delete agent identities](create-delete-agent-identities.md) - [Agent sign-in and audit logs](sign-in-audit-logs-agents.md)-- [Agent identity creation channels](agent-id-creation-channels.md)\ No newline at end of file+- [Agent identity creation channels](agent-id-creation-channels.md)