🪲 New-EntraBetaAgentIDUserForAgentId doesn't automatically use the id from previous run of New-EntraBetaAgentIDForAgentIdentityBlueprint

Thanks for reporting the bug. Please ensure you've gone through the following checklist before opening an issue:

• Make sure you can reproduce this issue using the latest released version of Microsoft.Entra or Microsoft.Entra.Beta.
• Please search the existing issues to see if there has been a similar issue filed.

Describe the bug

To Reproduce

Steps to reproduce the behavior:

1. New‑EntraBetaAgentIdentityBlueprint
2. New‑EntraBetaAgentIdentityBlueprintPrincipal
3. Add‑EntraBetaClientSecretToAgentIdentityBlueprint
4. New‑EntraBetaAgentIDForAgentIdentityBlueprint
5. New‑EntraBetaAgentIDUserForAgentId

Step 5 fails unless an id is manually specified.

Expected behavior

Step 5 should automatically use the id from Step 4.

Debug Output

This isn't a full debug output, but hopefully its sufficient. If not, I can go get the debug output:

cmdlet New-EntraBetaAgentIDForAgentIdentityBlueprint at command pipeline position 1
Supply values for the following parameters:
(Type !? for Help.)
DisplayName: Test1235
Connecting to Microsoft Graph using Agent Identity Blueprint credentials...
Successfully connected as Agent Identity Blueprint: b96b1b32-535e-47ed-9587-1380957f0faf
Enter sponsor user IDs (comma-separated, or press Enter to skip): c395aa15-4378-4149-8f4f-d2a03b86f38d
Enter sponsor group IDs (comma-separated, or press Enter to skip):
Enter owner user IDs (comma-separated, or press Enter to skip):
Agent Identity created successfully!

Name Value

---

displayName Test1235
applicationTemplateId
certification
isDisabled
createdDateTime
signInAudience
preferredTokenSigningKeyThumb…
isAuthorizationServiceEnabled False
passwordCredentials {}
publisherName
agentAppId b96b1b32-535e-47ed-9587-1380957f0faf
appId 09b32a28-46ce-4e21-a3c5-04f5620577a2
resourceSpecificApplicationPe… {}
tokenEncryptionKeyId
samlSLOBindingType httpRedirect
replyUrls {}
notificationEmailAddresses {}
servicePrincipalType ServiceIdentity
appRoles {}
notes
loginUrl
publishedPermissionScopes {}
preferredTokenSigningKeyEndDa…
appOwnerOrganizationId
description
appRoleAssignmentRequired False
appDescription
isManagementRestricted
alternativeNames {}
accountEnabled True
samlSingleSignOnSettings
errorUrl
@odata.context https://graph.microsoft.com/beta/$metadata#servicePrincipals/microsoft.graph.agentIdentity/$entity
deletedDateTime
samlMetadataUrl
deviceManagementAppType
disabledByMicrosoftStatus
tags {}
appDisplayName
addIns {}
createdByAppId b96b1b32-535e-47ed-9587-1380957f0faf
preferredSingleSignOnMode
info
api {[resourceSpecificApplicationPermissions, System.Object[]]}
agentIdentityBlueprintId b96b1b32-535e-47ed-9587-1380957f0faf
assignmentRequiredForPrincipa…
keyCredentials {}
id 09b32a28-46ce-4e21-a3c5-04f5620577a2
logoutUrl
verifiedPublisher {[displayName, ], [verifiedPublisherId, ], [addedDateTime, ]}
homepage
servicePrincipalNames {09b32a28-46ce-4e21-a3c5-04f5620577a2}

PS C:\Users<me> New-EntraBetaAgentIDUserForAgentId

cmdlet New-EntraBetaAgentIDUserForAgentId at command pipeline position 1
Supply values for the following parameters:
(Type !? for Help.)
DisplayName: Test12345
Connecting to Microsoft Graph using Agent Identity Blueprint credentials...
Successfully connected as Agent Identity Blueprint: b96b1b32-535e-47ed-9587-1380957f0faf
New-EntraBetaAgentIDUserForAgentId: No Agent Identity ID found. Please provide -AgentIdentityId parameter or run New-EntraBetaAgentIDForAgentIdentityBlueprint first to create an Agent Identity.

Module Version

1.2.0 (Beta)

Environment Data

Filing this from testing notes so I don't have this handy, but I can get it if needed.

Screenshots

N/A

Additional context

N/A

Start by running the five reproduction steps in order, from New-EntraBetaAgentIdentityBlueprint through New-EntraBetaAgentIDUserForAgentId, using the reported module version if available. Compare the value returned by New-EntraBetaAgentIDForAgentIdentityBlueprint with what the final cmdlet receives. Done means Step 5 uses the prior Agent Identity ID without requiring -AgentIdentityId.