Entra Agent User

This walks you through creating agent users in Microsoft Entra ID, which lets AI agents act like actual employees with mailboxes, Teams presence, and org chart visibility. It covers the specific API calls to convert agent identities into user objects that get `idtyp=user` tokens instead of `idtyp=app`. The guide handles the tricky verification steps to ensure you're using a proper agent identity (not a regular service principal), sets up licensing for Exchange/Teams, and explains why provisioning can take 24-48 hours. Useful when your AI agent needs to send emails, join meetings, or appear in employee directories rather than just calling backend APIs.

skills.sh installs: 8.6K
GitHub stars: 41K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add github/awesome-copilot --skill entra-agent-user --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Creating Agent Users in Microsoft Entra Agent ID

Overview

An agent user is a specialized user identity in Microsoft Entra ID that enables AI agents to act as digital workers. It allows agents to access APIs and services that strictly require user identities (e.g., Exchange mailboxes, Teams, org charts), while maintaining appropriate security boundaries.

Agent users receive tokens with idtyp=user, unlike regular agent identities which receive idtyp=app.

Prerequisites

A Microsoft Entra tenant with Agent ID capabilities
An agent identity (service principal of type ServiceIdentity) created from an agent identity blueprint
One of the following permissions:
- AgentIdUser.ReadWrite.IdentityParentedBy (least privileged)
- AgentIdUser.ReadWrite.All
- User.ReadWrite.All
The caller must have at minimum the Agent ID Administrator role (in delegated scenarios)