Microsoft Entra Agent ID

Disable Agent Identities

23 October 2026Doc update+8 / −1 lines

In brief

The documentation now explains that globally disabling a blueprint can cause related agents in other tenants to fail or lose functionality. It also adds steps for disabling a blueprint in the Microsoft Entra admin center.

What Entra admins need to know

Assess cross-tenant impact before globally disabling an agent identity blueprint.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Disabling agent identity considerations

Disabling an agent identity or agent identity blueprint in your tenant might have broader consequences than simply stopping new AI agents from being created or used. Before you proceed, evaluate the following considerations:

Existing agents running in your organization might begin to fail.
Microsoft product experiences that assume agent identity availability (for example, Copilot Studio agents, Security Copilot scenario agents, Microsoft Entra Conditional Access Optimization Agent) might fail or fall back to standard service principals that lack agent-specific tracking and controls.
If you globally disable an agent identity blueprint in your tenant which has had principals and child identities created in other tenants, then related agents in those tenants may fail or lose functionality.

Monitor for agent identity creation and activity

Browse to Entra ID > Agents > Agent blueprints.
Select the agent identity blueprint you want to disable then select Disable.

To globally disable an agent identity blueprint:

Sign in to the Microsoft Entra admin center as at least an Agent ID Administrator.
Browse to Entra ID > Agents > Agent blueprints.
Select the agent identity blueprint you want to globally disable then select Disable globally.

Create Conditional Access policies to disable agent activities

There are three policy templates you can use to block token issuance or prevent users from signing into agents. These policies can be created in the Microsoft Entra admin center or through the Microsoft Graph API. We recommend applying these policies in report-only mode first to understand their impact before enforcing them.

@@ -25,10 +25,11 @@ Your Microsoft Entra tenant might contain AI agents with or without a Microsoft  ## Disabling agent identity considerations -Disabling an agent identity in your tenant might have broader consequences than simply stopping new AI agents from being created or used. Before you proceed, evaluate the following considerations:+Disabling an agent identity or agent identity blueprint in your tenant might have broader consequences than simply stopping new AI agents from being created or used. Before you proceed, evaluate the following considerations:  - Existing agents running in your organization might begin to fail. - Microsoft product experiences that assume agent identity availability (for example, Copilot Studio agents, Security Copilot scenario agents, Microsoft Entra Conditional Access Optimization Agent) might fail or fall back to standard service principals that lack agent-specific tracking and controls.+- If you globally disable an agent identity blueprint in your tenant which has had principals and child identities created in other tenants, then related agents in those tenants may fail or lose functionality.  ## Monitor for agent identity creation and activity @@ -76,6 +77,12 @@ To disable an agent identity blueprint: 1. Browse to **Entra ID** > **Agents** > **Agent blueprints**. 1. Select the agent identity blueprint you want to disable then select **Disable**. +To globally disable an agent identity blueprint: ++1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Agent ID Administrator](../identity/role-based-access-control/permissions-reference.md#agent-id-administrator).+1. Browse to **Entra ID** > **Agents** > **Agent blueprints**.+1. Select the agent identity blueprint you want to globally disable then select **Disable globally**.+ ## Create Conditional Access policies to disable agent activities  There are three policy templates you can use to block token issuance or prevent users from signing into agents. These policies can be created in the Microsoft Entra admin center or through the Microsoft Graph API. We recommend applying these policies in report-only mode first to understand their impact before enforcing them.