Questions about Microsoft Entra Agent Identities, Microsoft Graph APIs, and Service Principals

Hi Microsoft Team,

I'm evaluating the new Microsoft Entra Agent ID capability and have a few questions regarding Agent Identities and their relationship with Service Principals.

1. Programmatically retrieving Agent Identities

What is the recommended way to retrieve all Agent Identities in a tenant programmatically?

I understand that the Microsoft Graph APIs for Agent ID are currently in beta, and beta APIs are generally not recommended for production use. I also couldn't find any dedicated Microsoft Graph PowerShell cmdlets for Agent Identities.

• Is there a supported production approach for enumerating all Agent Identities?
• Are there plans for Microsoft Graph v1.0 APIs or PowerShell cmdlets for Agent ID?
• What is the recommended approach for audit and reporting scenarios?

2. Relationship between Agent Identities and Service Principals

The documentation indicates that Agent Identities are a new identity type, distinct from traditional Microsoft Entra Service Principals.

If I create an Agent Identity directly in Microsoft Entra, does Microsoft also create a corresponding Service Principal behind the scenes, or is the Agent Identity stored as a completely separate directory object?

3. Agent Identities created by Microsoft products (for example, Copilot Studio)

When an Agent Identity is automatically created by Microsoft products such as Copilot Studio, what objects are created in Microsoft Entra?

Specifically:

• Is the Agent Identity itself represented as a Service Principal?
• Or is it a separate directory object, while only the Blueprint Principal is a Service Principal?
• If so, what is the recommended way to correlate an Agent Identity with its associated Blueprint Principal and any related Service Principal objects for inventory and audit purposes?

I'm trying to build an inventory/reporting solution for Agent Identities and would appreciate guidance on the recommended architecture and supported APIs.

Thank you.Hi Microsoft Team,

I'm evaluating the new Microsoft Entra Agent ID capability and have a few questions regarding Agent Identities and their relationship with Service Principals.

1. Programmatically retrieving Agent Identities

What is the recommended way to retrieve all Agent Identities in a tenant programmatically?

I understand that the Microsoft Graph APIs for Agent ID are currently in beta, and beta APIs are generally not recommended for production use. I also couldn't find any dedicated Microsoft Graph PowerShell cmdlets for Agent Identities.

• Is there a supported production approach for enumerating all Agent Identities?
• Are there plans for Microsoft Graph v1.0 APIs or PowerShell cmdlets for Agent ID?
• What is the recommended approach for audit and reporting scenarios?

2. Relationship between Agent Identities and Service Principals

The documentation indicates that Agent Identities are a new identity type, distinct from traditional Microsoft Entra Service Principals.

If I create an Agent Identity directly in Microsoft Entra, does Microsoft also create a corresponding Service Principal behind the scenes, or is the Agent Identity stored as a completely separate directory object?

3. Agent Identities created by Microsoft products (for example, Copilot Studio)

When an Agent Identity is automatically created by Microsoft products such as Copilot Studio, what objects are created in Microsoft Entra?

Specifically:

• Is the Agent Identity itself represented as a Service Principal?
• Or is it a separate directory object, while only the Blueprint Principal is a Service Principal?
• If so, what is the recommended way to correlate an Agent Identity with its associated Blueprint Principal and any related Service Principal objects for inventory and audit purposes?

I'm trying to build an inventory/reporting solution for Agent Identities and would appreciate guidance on the recommended architecture and supported APIs.

Thank you.