Find expiring agent identity blueprint credentials

Short answer: Credentials live on the agent identity blueprint, not on its agent identities. Graph exposes expiry dates for client secrets and certificates. Federated identity credentials have no expiry date property.

• Open the blueprint's Credentials page to review its certificates, client secrets and federated credentials.
• Use the Graph blueprint list endpoint to collect blueprint credential metadata.
• Because agent identities rely on blueprint credentials for tokens, an expired blueprint secret or certificate will likely break token requests for agents that use it (our inference; Microsoft doesn't describe the failure).

Microsoft behaviour on this page was checked against Microsoft Learn on 2026-10-19.

What an agent identity blueprint is

An agent identity blueprint creates agent identities and requests tokens using them. Agent identities have no credentials of their own. The blueprint holds the federated identity credentials, certificates or cryptographic keys, and client secrets it uses to acquire tokens on their behalf.

In Microsoft Graph, agentIdentityBlueprint inherits from application. It has passwordCredentials and keyCredentials properties and a federatedIdentityCredentials relationship. The same reference lists AgentIdentityBlueprint.AddRemoveCreds.All as the least privileged permission to update passwordCredentials and keyCredentials.

Why this matters (rollout reported for early November 2026)

By default, users in your organization can create agent identity blueprints. To restrict creation to administrators and users with the Agent ID Developer role, sign in as at least a Cloud Application Administrator. Under Entra ID > Users > User settings, set Users can create agent blueprints to No.

Office 365 IT Pros reports that Microsoft announced this setting in Message Center post MC1506733 on 13 October 2026. This secondary source reports deployment in early November 2026 and says turning the setting off does not affect existing blueprints.

When the setting is Yes, any user can create a blueprint and its blueprint principal. Creators automatically become owners of both.

Microsoft's creation guide also states that Agent ID Developer can configure federated identity credentials, and that Agent ID Administrator can configure them and is required to add a secret or certificate credential.

Microsoft's default user permissions say member users can manage properties, assignments and credentials for blueprints they own. That page and the creation guide don't agree on who can add a secret or certificate. See the FAQ below.

Which credentials a blueprint can carry

The blueprint can hold client secrets, certificates or cryptographic keys, and federated identity credentials.

| Credential type | Expiry date in Graph | Microsoft's guidance | | --- | --- | --- | | Client secret, passwordCredentials | endDateTime, the expiry date in UTC. See passwordCredential. | Supported but not recommended for production. Suits local development, testing or cases where managed identities will not work. See blueprint credential guidance. | | Certificate, keyCredentials | endDateTime, the expiry date in UTC. See keyCredential. | The management guide prefers certificates or federated credentials over client secrets. The creation guide supports keyCredentials but does not recommend them for production. | | Federated identity credential, federatedIdentityCredentials | None. The resource has no expiry date property. | Microsoft recommends a managed identity as a federated identity credential for production. |

A managed identity requires the code to run on an Azure service. For a federated credential, review the trusted issuer and subject instead of looking for endDateTime. Its documented properties include issuer, subject, audiences, name and description.

Find blueprints and their credentials in the admin center

Follow Microsoft's blueprint management path:

1. Open Entra ID > Agents > Agent blueprints.
2. Select the blueprint.
3. Under Developer settings, select Credentials.
4. Review the Certificates, Client secrets and Federated credentials tabs.

If you create a client secret, copy its value immediately. The admin center does not display it again.

Find expiring blueprint credentials with Microsoft Graph

The blueprint list API lists AgentIdentityBlueprint.Read.All as its least privileged permission for both delegated and application calls. For delegated calls by nonowners, Agent ID Administrator is the least privileged built-in role. This endpoint returns only agentIdentityBlueprint objects.

Select the credential collections in the request:

Untested example. Review and test it in your environment before you rely on it.

GET https://graph.microsoft.com/v1.0/applications/microsoft.graph.agentIdentityBlueprint?$select=id,appId,displayName,passwordCredentials,keyCredentials

The default and maximum page size is 100. Graph returns keyCredentials thumbprints only when you include keyCredentials in $select. Requests selecting that property on blueprints are throttled at 150 requests per minute per organization.

Follow @odata.nextLink until it is absent to read every page. The example checks both credential collections against a warning cutoff and includes credentials that have already expired.

Untested example. Review and test it in your environment before you rely on it.

# Add -TenantId with your directory ID if your account can sign in to more than one
Connect-MgGraph -Scopes AgentIdentityBlueprint.Read.All

$DaysAhead = 30  # pick your own warning window
$Now = [datetimeoffset]::UtcNow
$Cutoff = $Now.AddDays($DaysAhead)
$Uri = 'https://graph.microsoft.com/v1.0/applications/microsoft.graph.agentIdentityBlueprint?$select=id,appId,displayName,passwordCredentials,keyCredentials'

do {
    $Page = Invoke-MgGraphRequest -Method GET -Uri $Uri -OutputType PSObject
    foreach ($Blueprint in $Page.value) {
        foreach ($Type in 'passwordCredentials', 'keyCredentials') {
            foreach ($Credential in $Blueprint.$Type) {
                if (-not $Credential.endDateTime) { continue }
                $End = [datetimeoffset]$Credential.endDateTime
                if ($End -le $Cutoff) {
                    [pscustomobject]@{
                        Blueprint      = $Blueprint.displayName
                        AppId          = $Blueprint.appId
                        CredentialType = $Type
                        KeyId          = $Credential.keyId
                        EndDateTime    = $End
                        Expired        = $End -le $Now
                    }
                }
            }
        }
    }
    $Uri = $Page.'@odata.nextLink'
} while ($Uri)

The beta list documentation gives the path for a blueprint's federated credentials. Least privileged permission: AgentIdentityBlueprint.Read.All. Beta APIs are subject to change and are not supported for production use. The v1.0 version of that page doesn't document this path for blueprints.

Untested example. Review and test it in your environment before you rely on it.

GET https://graph.microsoft.com/beta/applications/{id}/microsoft.graph.agentIdentityBlueprint/federatedIdentityCredentials

Here {id} is the blueprint's object ID, not its appId. The example below lists the federated credentials of each blueprint and shows only their name, issuer and subject.

Untested example. Review and test it in your environment before you rely on it.

Connect-MgGraph -Scopes AgentIdentityBlueprint.Read.All

$Uri = 'https://graph.microsoft.com/v1.0/applications/microsoft.graph.agentIdentityBlueprint?$select=id,displayName'

do {
    $Page = Invoke-MgGraphRequest -Method GET -Uri $Uri -OutputType PSObject
    foreach ($Blueprint in $Page.value) {
        $FicUri = "https://graph.microsoft.com/beta/applications/$($Blueprint.id)/microsoft.graph.agentIdentityBlueprint/federatedIdentityCredentials"
        do {
            $FicPage = Invoke-MgGraphRequest -Method GET -Uri $FicUri -OutputType PSObject
            foreach ($Fic in $FicPage.value) {
                [pscustomobject]@{
                    Blueprint = $Blueprint.displayName
                    Name      = $Fic.name
                    Issuer    = $Fic.issuer
                    Subject   = $Fic.subject
                }
            }
            $FicUri = $FicPage.'@odata.nextLink'
        } while ($FicUri)
    }
    $Uri = $Page.'@odata.nextLink'
} while ($Uri)

There is no endDateTime on a federated identity credential. Review the issuer and subject it trusts instead.

What to do before a blueprint credential expires

Use the general safe rotation order to plan the change:

1. Decide whether the agent can move to a managed identity federated credential or a certificate instead of a client secret. Check the production guidance above before choosing.
2. Add the new credential first. Microsoft's blueprint creation guide says Agent ID Administrator is required to add a secret or certificate, and that Agent ID Developer can configure federated identity credentials. Another Learn page describes this differently, so read who can add a secret or certificate before you plan who does this step. If you create a secret, copy its value immediately.
3. Update the agent code or configuration to use the replacement.
4. Confirm fresh sign-ins on the blueprint's management page under Agent blueprint principal activity > Sign-in logs. The blueprint principal also has audit logs there.
5. Remove the old credential only after every agent that uses it has moved.

Microsoft's Agent ID best practices recommend setting up your own proactive alerts for certificates or secrets approaching their end date.

FAQ

Do agent identities have their own secrets?

No. The blueprint holds the credentials and uses them to acquire tokens on behalf of its agent identities.

Do federated identity credentials expire?

The federatedIdentityCredential resource has no expiry date property. Review which issuer and subject it trusts instead of checking endDateTime.

Who can add a secret or certificate to a blueprint?

Microsoft Learn isn't consistent here. The blueprint creation guide says Agent ID Administrator is required to add a secret or certificate credential, and that Agent ID Developer can configure federated identity credentials. The default user permissions page says member users can manage credentials for blueprints they own. Test which path applies in your organization before you depend on owners rotating their own blueprint credentials.

Can I stop users from creating blueprints?

You can restrict creation to administrators and Agent ID Developers. Sign in as at least a Cloud Application Administrator. Go to Entra ID > Users > User settings and set Users can create agent blueprints to No.

How do I list only blueprints in Microsoft Graph?

Blueprints are application objects, so a plain GET /applications or Get-MgApplication also returns them. The List applications reference says they're identified by @odata.type #microsoft.graph.agentIdentityBlueprint. To get only blueprints, use the blueprint list endpoint shown above. It returns no other application objects.

Related guides

• Identify which credential a workload uses
• Build Entra app credential expiry monitoring
• Understand built-in expiration notifications

Compare Microsoft's built-in warnings, a DIY monitor and AppAlert side by side.

Updated 2026-10-19.