entra-agent-user Skill for Claude Code: What It Does and How to Install It

Walks your agent through creating a Microsoft Entra agent user from an agent identity, using Microsoft Graph.

Installs: 8.6K; on skills.sh
Stars: 40.7K; on GitHub
Updated: Oct 2026; last repo commit

An agent user is a user account in Microsoft Entra ID that an AI agent can act as. It can reach services that need a user identity, such as an Exchange mailbox, Teams and org charts. The skill gives your assistant four steps: check the agent identity, create the agent user, optionally set a manager, and optionally set a usage location and assign a license.

Each step comes as a Microsoft Graph beta HTTP request and as PowerShell. You need an Entra tenant with Agent ID, an agent identity made from an agent identity blueprint, and the AgentIdUser.ReadWrite.IdentityParentedBy permission (or AgentIdUser.ReadWrite.All or User.ReadWrite.All).

Good for

Entra administrators setting up agent identities
Teams that want an AI agent to own a mailbox or appear in Teams
Developers who need user-only APIs (idtyp=user tokens) for an agent

Install entra-agent-user

Claude Code

Copy this prompt.

Install the entra-agent-user skill in Claude Code. Run this command:

npx skills add https://github.com/github/awesome-copilot --skill entra-agent-user

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Create Agent Users in Microsoft Entra ID from Agent Identities, enabling AI agents to act as digital workers with user identity capabilities in Microsoft 365 and Azure environments.

Sections in SKILL.md

Overview
Prerequisites
Architecture
Step 1: Verify the Agent Identity Exists
PowerShell
Step 2: Create the Agent User
HTTP Request
Required Properties
PowerShell
Key Notes
Step 3: Assign a Manager (Optional)
PowerShell
Step 4: Set Usage Location and Assign Licenses (Optional)
Set Usage Location
List Available Licenses
Assign a License

Key facts

Author: Awesome Copilot Community (repo is github/awesome-copilot; the README says its customizations come from third-party developers)
License: MIT (LICENSE: Copyright GitHub, Inc.)
Installs on skills.sh: 8,611 (Nov 2, 2026)
GitHub stars: 40,666 for the whole github/awesome-copilot repo (Nov 2, 2026)
Last repo commit: Oct 30, 2026
What it includes: 1 file: SKILL.md. It bundles no scripts
skills.sh audits: Gen Agent Trust Hub: pass; Socket: pass; Snyk: pass (Nov 2, 2026)
Needs: A Microsoft Entra tenant with Agent ID, an agent identity, and one of the AgentIdUser.ReadWrite.IdentityParentedBy, AgentIdUser.ReadWrite.All or User.ReadWrite.All permissions

What it includes

GET the service principal and check it is an agentIdentity
The response must show #microsoft.graph.agentIdentity and servicePrincipalType ServiceIdentity. A regular app registration fails.
Runs code · Step 1: Verify the agent identity
POST to /users/microsoft.graph.agentUser
Needs accountEnabled, displayName, mailNickname, userPrincipalName and identityParentId. Each agent identity can have one agent user.
Try: “Create an agent user for my agent identity in Entra”
Runs code · Step 2: Create the agent user
PUT the manager reference so the agent appears in org charts
Lets the agent user show up in Teams org charts.
Runs code · Step 3: Assign a manager (optional)
Sets usageLocation, lists subscribed SKUs, assigns a license
A license is needed for a mailbox or Teams presence. Usage location must be set first.
Runs code · Step 4: Usage location and license (optional)
Reference tables for wait times and what an agent user cannot do
Exchange mailbox 5 to 30 minutes, Teams 15 minutes to 24 hours, org chart up to 24 to 48 hours.
Read · Provisioning times and limits

From the official docs

Permissions

High risk

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It creates identities in your tenant
Step 2 creates a user object in Entra ID, and step 4 assigns a license to it. SKILL.md says an agent user can join Entra groups (including dynamic groups) and administrative units, own a mailbox and calendar, and take part in Teams. Run it only against the tenant and agent identity you mean, and review each request first. github.com
It needs write permissions on users
SKILL.md lists AgentIdUser.ReadWrite.IdentityParentedBy as least privileged, with AgentIdUser.ReadWrite.All and User.ReadWrite.All as alternatives. The PowerShell examples also use Application.Read.All and Organization.Read.All. Pick the narrowest one. github.com
It uses the Graph beta endpoint
The requests in the skill use graph.microsoft.com/beta. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode. Step 1 is a GET request; steps 2 to 4 send POST, PUT or PATCH requests.
Talks to	graph.microsoft.com (Microsoft Graph beta)
Sign-in and keys	SKILL.md names no stored credentials. Its PowerShell examples sign in with Connect-MgGraph, using a device code in the examples that name a tenant.
Scopes	Creates a user account in your Entra tenant (POST /users/microsoft.graph.agentUser) Can set a manager, set usageLocation and assign a license to that user Reads service principals and subscribed license SKUs

Questions

What does the entra-agent-user skill do?

It makes your agent create an agent user in Microsoft Entra ID from an existing agent identity. It can also set a manager, a usage location and a license.

What do I need before I use it?

A Microsoft Entra tenant with Agent ID and an agent identity made from a blueprint. You also need one of three Graph permissions, and in delegated use at least the Agent ID Administrator role.

How do I install it in Claude Code?

Use the install box at the top of this page. It is a single-file skill from the awesome-copilot repo, so the skills CLI route or a skills folder both work.

Can an agent user sign in or have a password?

No. SKILL.md says agent users cannot have passwords, passkeys or interactive sign-in. They authenticate through their parent agent identity.

How long until the mailbox or Teams works?

SKILL.md gives Exchange mailbox 5 to 30 minutes, Teams 15 minutes to 24 hours, SharePoint and OneDrive 5 to 30 minutes, and org chart or People search up to 24 to 48 hours.

Is it safe?

It creates a user account in your Entra tenant and can assign a license, so treat each request as a real admin change. SKILL.md lists AgentIdUser.ReadWrite.IdentityParentedBy as the least privileged permission. Our advice: use that one and read each request before it runs.

Information

updated Nov 2, 2026

Repository: github/awesome-copilot
Folder: skills/entra-agent-user

github/awesome-copilot skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 2

entra-agent-user SKILL.md · github.com
awesome-copilot README · github.com