Add-EntraPermissionsToInheritToAgentIdentityBlueprintPrincipal

Module:

Microsoft.Entra.Applications Module v1.3

Opens admin consent page in browser for Agent Identity Blueprint Principal to inherit permissions.

Add-EntraPermissionsToInheritToAgentIdentityBlueprintPrincipal

 [-AgentBlueprintId <String>]
 [-Scopes <String[]>]
 [-Roles <String[]>]
 [-RedirectUri <String>]
 [-State <String>]
 [<CommonParameters>]

The Add-EntraPermissionsToInheritToAgentIdentityBlueprintPrincipal cmdlet launches the system browser with the admin consent URL for the Agent Identity Blueprint Principal. This allows the administrator to grant delegated permissions (scopes) and/or application roles that the blueprint can inherit and pass to agent identities. The consent URL is built using the v2.0 admin consent endpoint. Uses the stored AgentBlueprintId from the last New-EntraAgentIdentityBlueprint call if no explicit ID is provided. If no stored ID is available, the cmdlet prompts interactively for the Agent Identity Blueprint ID. If neither -Scopes nor -Roles are provided, the cmdlet prompts interactively for scopes.

Connect-Entra -Scopes 'AgentIdentityBlueprint.UpdateAuthProperties.All'
New-EntraAgentIdentityBlueprint -DisplayName "My Blueprint" -SponsorUserIds @("user1@contoso.com")
Add-EntraPermissionsToInheritToAgentIdentityBlueprintPrincipal

This example opens the admin consent page in the browser for the Agent Identity Blueprint that was just created. The cmdlet will prompt for permission scopes if not provided.

Connect-Entra -Scopes 'AgentIdentityBlueprint.UpdateAuthProperties.All'
Add-EntraPermissionsToInheritToAgentIdentityBlueprintPrincipal -Scopes @("user.read", "mail.read", "calendars.read")

This example opens the admin consent page with specific permission scopes (user.read, mail.read, calendars.read).

Connect-Entra -Scopes 'AgentIdentityBlueprint.UpdateAuthProperties.All'
Add-EntraPermissionsToInheritToAgentIdentityBlueprintPrincipal -AgentBlueprintId "7c0c1226-1e81-41a5-ad6c-532c95504443" -Scopes @("user.read")

This example opens the admin consent page for a specific Agent Identity Blueprint by providing the blueprint ID and requested scopes.

Connect-Entra -Scopes 'AgentIdentityBlueprint.UpdateAuthProperties.All'
Add-EntraPermissionsToInheritToAgentIdentityBlueprintPrincipal -Roles @("Mail.Read", "User.Read.All")

This example opens the admin consent page requesting application role (app-only) permissions instead of delegated scopes.

Connect-Entra -Scopes 'AgentIdentityBlueprint.UpdateAuthProperties.All'
Add-EntraPermissionsToInheritToAgentIdentityBlueprintPrincipal -Scopes @("user.read") -Roles @("Mail.Read")

This example opens the admin consent page requesting both delegated scopes and application roles in a single consent flow.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Returns a PSCustomObject with the following properties:

• AgentBlueprintId - The Application ID of the Agent Identity Blueprint.
• TenantId - The tenant ID where consent is being granted.
• RequestedScopes - Array of delegated permission scopes requested.
• RequestedRoles - Array of application roles requested.
• RedirectUri - The redirect URI used in the consent flow.
• State - The state parameter used in the consent request.
• ConsentUrl - The full admin consent URL that was opened in the browser.
• Action - The action taken (e.g., "Browser Launched").
• Timestamp - When the consent flow was initiated.

This cmdlet opens the default system browser to the admin consent page. An administrator must complete the consent process in the browser.

This cmdlet requires the following Microsoft Graph permission:

• AgentIdentityBlueprint.UpdateAuthProperties.All

The cmdlet does not make any Microsoft Graph API calls directly. It constructs a consent URL using the v2.0 admin consent endpoint (https://login.microsoftonline.com/{tenantId}/v2.0/adminconsent) and launches it in the system browser via Start-Process.

If no Agent Identity Blueprint ID is stored and none is provided as a parameter, the cmdlet prompts interactively for the ID.

If neither -Scopes nor -Roles is provided, the cmdlet prompts interactively with a default suggestion of user.read.