# Entra Agent ID: The blueprint blast radius

DevFeed: [Entra Agent ID: The blueprint blast radius](<https://devfeed.tech/articles/entra-agent-id-the-blueprint-blast-radius-8266.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/agent-id-blueprint-blast-radius/>)

Author: Katie Knowles

Published: 2026-06-11T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Microsoft](<https://devfeed.tech/topics/microsoft.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [identity](<https://devfeed.tech/tags/identity.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [security](<https://devfeed.tech/tags/security.md>), [series](<https://devfeed.tech/tags/series.md>), [technical](<https://devfeed.tech/tags/technical.md>)

## AI overview

This article explains Microsoft Entra Agent ID, an identity and security framework for AI agents. It describes how blueprints, blueprint service principals, agent identities, and agent users extend Entra's application model, and examines how a compromised blueprint can expose identities and permissions across multiple tenants.

## Source excerpt

Entra Agent ID is an extension of Entra's application model that provides identities for AI agents. Unlike applications, the agent identity model allows linking a single app registration (blueprint) to multiple identities and their associated privileges, increasing the potential blast radius of a compromised agent.