Add-EntraRequiredResourceAccessToAgentIdentityBlueprint

Module:

Microsoft.Entra.Applications Module v1.3

Adds required resource access (API permissions) to an Agent Identity Blueprint application.

Add-EntraRequiredResourceAccessToAgentIdentityBlueprint

 [-AgentBlueprintId <String>]
 [-ResourceAppId <Guid>]
 [-ResourceAccess <Hashtable[]>]
 [-Silent]
 [<CommonParameters>]

The Add-EntraRequiredResourceAccessToAgentIdentityBlueprint cmdlet adds required resource access entries (API permissions) to an Agent Identity Blueprint. This configures which API permissions (delegated scopes or application roles) the blueprint application requires. The cmdlet retrieves existing required resource access entries, merges new permissions without duplicating existing ones, and PATCHes the updated list back to the application.

In interactive mode, the cmdlet prompts for the resource application ID, permission type (scope or role), and permission GUID. It supports searching available permissions by name when the resource service principal is discoverable. In silent mode, all required parameters must be provided via command-line arguments.

Connect-Entra -Scopes 'AgentIdentityBlueprint.ReadWrite.All'
New-EntraAgentIdentityBlueprint -DisplayName "My Blueprint" -SponsorUserIds @("user1@contoso.com")
Add-EntraRequiredResourceAccessToAgentIdentityBlueprint

This example adds required resource access interactively. The cmdlet prompts for the resource application, permission type, and permission GUID.

Connect-Entra -Scopes 'AgentIdentityBlueprint.ReadWrite.All'
$permissions = @(
 @{ id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"; type = "Scope" },
 @{ id = "df021288-bdef-4463-88db-98f22de89214"; type = "Role" }
)
Add-EntraRequiredResourceAccessToAgentIdentityBlueprint -ResourceAccess $permissions -Silent

This example adds Microsoft Graph delegated and application permissions to the current Agent Identity Blueprint without interactive prompts.

Connect-Entra -Scopes 'AgentIdentityBlueprint.ReadWrite.All'
$permissions = @(
 @{ id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"; type = "Scope" }
)
Add-EntraRequiredResourceAccessToAgentIdentityBlueprint -AgentBlueprintId "12345678-1234-1234-1234-123456789012" -ResourceAppId "00000003-0000-0000-c000-000000000000" -ResourceAccess $permissions -Silent

This example adds a specific Microsoft Graph delegated permission to a specified Agent Identity Blueprint.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Returns an array of PSCustomObject entries, one per resource application configured. Each entry contains: AgentBlueprintId, ResourceAppId, ResourceAppName, Permissions (array of Id/Type/DisplayName), ConfiguredAt, and ApiResponse.

This cmdlet uses the Microsoft Graph v1.0 API endpoint (/v1.0/applications/{id}).

This cmdlet requires the following Microsoft Graph permission: AgentIdentityBlueprint.ReadWrite.All

The cmdlet merges new permissions with existing required resource access entries rather than overwriting them. Duplicate permissions (same id and type) are skipped. The cmdlet includes retry logic (up to 10 attempts with 10-second intervals) to handle propagation delays.