Agent skill · software engineering · github
entra-agent-user
Create Agent Users in Microsoft Entra ID from Agent Identities, enabling AI agents to act as digital workers with user identity capabilities in Microsoft 365 and Azure environments.
Why this skill is useful
Adds specific API commands and permissions for creating agent users in Microsoft Entra ID that the AI wouldn't reliably generate on its own.
What it needs
Requires microsoft account access. About 4k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
SKILL: Creating Agent Users in Microsoft Entra Agent ID Overview An agent user is a specialized user identity in Microsoft Entra ID that enables AI agents to act as digital workers. It allows agents to access APIs and services that strictly require user identities (e.g., Exchange mailboxes, Teams, org charts), while maintaining appropriate security boundaries. Agent users receive tokens with idtyp=user, unlike regular agent identities which receive idtyp=app. --- Prerequisites A Microsoft Entra tenant with Agent ID capabilities An agent identity (service principal of type ServiceIdentity) created from an agent identity blueprint One of the following permissions: AgentIdUser.ReadWrite.IdentityParentedBy (least privileged) AgentIdUser.ReadWrite.All User.ReadWrite.All The caller must have at minimum the Agent ID Administrator role (in delegated scenarios) Important: The identityParentId must reference a true agent identity (created via an agent identity blueprint), NOT a regular application service principal. You can verify by checking that the service principal has @odata.type: #microsoft.graph.agentIdentity and servicePrincipalType: ServiceIdentity. --- Architecture Component Type Token Claim Purpose --- --- --- --- Agent Identity Service Principal idtyp=app Backend/API operations Agent User User (agentUser) idtyp=user Act as a digital worker in M365 --- Step 1: Verify the Agent Identity Exists Before creating an agent user, confirm the agent identity is a proper agentIdentity type: Verify the response contains: PowerShell Common mistake: Using an app registration's appId or a regular application service principal's id will fail. Only agent identities created from blueprints work. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/entra-agent-user