AgentIdAudit

0.1.0-preview

Data/BlockedPermissions.psd1

                                # Microsoft Graph permissions that Microsoft blocks for agent identities.

# GENERATED from Microsoft's documentation table - do not edit by hand; regenerate when the source changes.

# Source: https://learn.microsoft.com/en-us/graph/api/resources/agentid-platform-overview?view=graph-rest-beta

#         (section "Microsoft Graph permissions blocked for agents", doc ms.date 05/05/2026)

# Applies to the Microsoft Graph resource (appId 00000003-0000-0000-c000-000000000000) only.

@{

    SourceUrl   = 'https://learn.microsoft.com/en-us/graph/api/resources/agentid-platform-overview?view=graph-rest-beta'

    SourceDate  = '2026-05-05'

    Application = @(

        'AgentIdentity.Create'

        'AgentIdentity.Create.All'

        'AgentIdentity.CreateAsManager'

        'AgentIdentityBlueprint.Create'

        'AgentIdentityBlueprint.CreateAsManager'

        'AgentIdentityBlueprint.ReadWrite.All'

        'AgentIdentityBlueprintPrincipal.Create'

        'Application.ReadWrite.All'

        'Application.ReadWrite.OwnedBy'

        'AppRoleAssignment.ReadWrite.All'

        'BitlockerKey.Read.All'

        'Calendars.Read'

        'ChannelMessage.Read.All'

        'ChannelMessage.Read.Group'

        'Chat.Read.All'

        'Chat.ReadWrite.All'

        'ConsentRequest.ReadWrite.All'

        'CustomSecAttributeAssignment.ReadWrite.All'

        'CustomSecAttributeDefinition.ReadWrite.All'

        'DelegatedPermissionGrant.ReadWrite.All'

        'Device.ReadWrite.All'

        'Device.Write.Restricted'

        'DeviceManagementConfiguration.Read.All'

        'Directory.ReadWrite.All'

        'Directory.Write.Restricted'

        'Domain.ReadWrite.All'

        'EduRoster.ReadWrite.All'

        'EntitlementManagement.ReadWrite.All'

        'Files.Read.All'

        'Files.ReadWrite.All'

        'Group.Create'

        'Group.ReadWrite.All'

        'GroupMember.ReadWrite.All'

        'IdentityProvider.ReadWrite.All'

        'LifecycleManagement.ReadWrite.All'

        'Organization.ReadWrite.All'

        'Policy.ReadWrite.AuthenticationMethod'

        'Policy.ReadWrite.CrossTenantAccess'

        'Policy.ReadWrite.PermissionGrant'

        'Policy.ReadWrite.SecurityDefaults'

        'PrintJob.ReadWrite.All'

        'PrivilegedAccess.ReadWrite.AzureAD'

        'PrivilegedAccess.ReadWrite.AzureResources'

        'RoleManagement.ReadWrite.Directory'

        'Sites.FullControl.All'

        'Sites.Manage.All'

        'Sites.Read.All'

        'Sites.ReadWrite.All'

        'Tasks.ReadWrite.All'

        'User-PasswordProfile.ReadWrite.All'

        'User.DeleteRestore.All'

        'User.EnableDisableAccount.All'

        'User.Invite.All'

        'User.ReadWrite.All'

        'UserAuthenticationMethod.ReadWrite.All'

    )

    Delegated   = @(

        'CustomSecAttributeAssignment.ReadWrite.All'

        'CustomSecAttributeDefinition.ReadWrite.All'

        'DelegatedPermissionGrant.ReadWrite.All'

        'Device.Write.Restricted'

        'Directory.AccessAsUser.All'

        'Directory.ReadWrite.All'

        'Directory.Write.Restricted'

        'Domain.ReadWrite.All'

        'Group.ReadWrite.All'

        'Group.Write.Restricted'

        'GroupMember.ReadWrite.All'

        'RoleManagement.ReadWrite.All'

        'RoleManagement.ReadWrite.Directory'

        'User-PasswordProfile.ReadWrite.All'

        'User.DeleteRestore.All'

        'User.EnableDisableAccount.All'

        'User.ReadWrite.All'

        'UserAuthenticationMethod.Read.All'

        'UserAuthenticationMethod.ReadWrite.All'

    )

}