entra-agent-user
Create Agent Users in Microsoft Entra ID from Agent Identities, enabling AI agents to act as digital workers with user identity capabilities in Microsoft 365 and Azure environments.
Security Assessment
About entra-agent-user
The 'entra-agent-user' skill facilitates the creation of agent users within Microsoft Entra ID, allowing AI agents to function as digital workers. This capability addresses the need for AI agents to access various Microsoft 365 and Azure services that require user identities, such as Exchange mailboxes and Teams. By enabling agent users, organizations can leverage AI to automate tasks while ensuring that security protocols are maintained through proper identity management.
Key features of this skill include the ability to create agent users that receive tokens with 'idtyp=user', distinguishing them from regular agent identities that receive 'idtyp=app'. This differentiation is crucial for accessing user-specific APIs and services. The skill also outlines the prerequisites for creating agent users, including the need for a Microsoft Entra tenant with Agent ID capabilities and specific permissions, ensuring that only authorized personnel can create these identities.
Target users for this skill include IT administrators and developers working within organizations that utilize Microsoft Entra ID and require AI agents to perform tasks that necessitate user identity capabilities. Use cases may involve automating user-related processes, enhancing collaboration through AI-driven tools, and improving operational efficiency in environments that leverage Microsoft 365 and Azure services.
FAQ
What permissions are required to create an agent user?
You need either 'AgentIdUser.ReadWrite.IdentityParentedBy', 'AgentIdUser.ReadWrite.All', or 'User.ReadWrite.All' permissions.
Can I use a regular application service principal to create an agent user?
No, only agent identities created from an agent identity blueprint can be used.
What is the role requirement for the caller when creating an agent user?
The caller must have at least the 'Agent ID Administrator' role in delegated scenarios.
What happens if I use an invalid identityParentId?
The request will fail if the identityParentId does not reference a valid agent identity.
Is there a specific format for the userPrincipalName?
Yes, the userPrincipalName must be unique in the tenant and follow the format 'alias@verified-domain'.
Install entra-agent-user
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
github/awesome-copilot