Topic starter
12/07/2026 12:16 pm
TL;DR: Microsoft Entra agent identities can combine direct app-only permissions with inheritable delegated scopes, including enumerated or allAllowed inheritance, creating a runtime access model that can expand beyond the original assignment if governance is weak, according to Semperis. The governance issue is not the API call itself, but the assumption that access boundaries stay stable once a blueprint is created.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Practice Checkpoint 2: Setting Agent Identity Permissions”.
Key questions
Q: How should teams govern inherited permissions on Entra agent identities?
A: Treat inheritance as part of the authorisation model, not as an implementation detail.
Q: Why do inherited scopes increase risk for agent identities?
A: Because the permissions an agent can use at runtime may be broader than the permissions originally assigned to the object.
Q: What breaks when access reviews ignore inherited permissions on file shares?
A: Access reviews become inaccurate because they certify the top-level folder state instead of the permission path that actually grants reach.
Practitioner guidance
- Audit inherited permission settings Inventory every agent identity blueprint that can pass permissions into runtime flows, then separate direct app-only grants from inheritable delegated scopes so you can see the full effective access path.
- Restrict open-ended inheritance Replace allAllowed inheritance with enumerated scopes wherever possible, and review any blueprint that can inherit both scopes and appRoleIds because that combination broadens the authorisation boundary.
- Validate effective privilege in tokens Test the tokens produced by delegated and app-only flows to confirm that the runtime permission set matches the intended blueprint boundary, not just the original assignment record.
Bottom line: Entra agent identities can inherit permissions beyond their initial assignment, so the real access boundary is defined by runtime inheritance as much as by the object itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:30 pm
Inherited permission blueprints create a runtime access boundary, not a static grant: Semperis shows that Entra agent identities can inherit delegated scopes and app-only rights from the blueprint as execution unfolds. That means the original assignment is only the starting condition, not the final effective privilege. For identity governance, the problem is the widening of runtime authority after the object has already been approved.
A question worth separating out:
Q: Should organisations allow allAllowed inheritance for agent identities?
A: Only when the risk of broad runtime access has been explicitly accepted and monitored. allAllowed removes the constraint that enumerated scopes preserve, so the agent can inherit whatever is available rather than a tightly bounded set. For most IAM programmes, that makes the authorisation boundary harder to predict and harder to govern.
👉 Read our full editorial: Inherited permissions in Entra agent identities widen runtime access