Skip to content

Commit 55f7cfe

Browse files
tafra00tafra00
committed
Promote agentUser and directory-deleteditems APIs from beta to v1.0
- Add agentUser resource and 18 API methods to v1.0 - Add RBAC include for agentUser write operations - Update directory-deleteditems APIs (list, get, restore, delete) to support agentUser - Remove beta disclaimers, update endpoints to /v1.0/, remove SDK snippets - Update TOC mappings for both beta and v1.0 - Add changelog entries for DirectoryServices workload - Update What's New overview for April 2026 Addresses GA promotion of agentUser resource with support for deleted items operations.
1 parent 2967a0f commit 55f7cfe

28 files changed

Lines changed: 2631 additions & 208 deletions

‎api-reference/beta/toc/toc.mapping.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@
163163
]
164164
},
165165
{
166-
"name": "Agent user (preview)",
166+
"name": "Agent user",
167167
"resources": [
168168
"agentUser"
169169
]

‎api-reference/v1.0/api/agentuser-delete-manager.md‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
---
2+
title: "Remove manager (for agentUser)"
3+
description: "Remove an agent user's manager."
4+
author: "yyuank"
5+
ms.reviewer: "iamut"
6+
ms.date: 4/27/2026
7+
ms.localizationpriority: medium
8+
ms.subservice: "entra-agent-id"
9+
doc_type: apiPageType
10+
---
11+
12+
# Remove manager (for agentUser)
13+
14+
Namespace: microsoft.graph
15+
16+
Remove an [agentUser's](../resources/agentuser.md) manager.
17+
18+
## Permissions
19+
20+
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions [only if your app requires it](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions). For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
21+
22+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
23+
|Permission type | Least privileged permission | Higher privileged permissions |
24+
|:--------------------|:---------------------------|:-----------------------------|
25+
|Delegated (work or school account) | AgentIdUser.ReadWrite.IdentityParentedBy | AgentIdUser.ReadWrite.All, User.ReadWrite.All |
26+
|Delegated (personal Microsoft account) | Not supported. | Not supported.|
27+
|Application | AgentIdUser.ReadWrite.IdentityParentedBy | AgentIdUser.ReadWrite.All, User.ReadWrite.All |
28+
29+
[!INCLUDE [rbac-agent-user-apis-write](../includes/rbac-for-apis/rbac-agent-user-apis-write.md)]
30+
31+
## HTTP request
32+
33+
<!-- {
34+
"blockType": "ignored"
35+
}
36+
-->
37+
``` http
38+
DELETE /users/{usersId}/manager/{id}/$ref
39+
```
40+
41+
## Request headers
42+
43+
|Name|Description|
44+
|:---|:---|
45+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
46+
47+
## Request body
48+
49+
Don't supply a request body for this method.
50+
51+
## Response
52+
53+
If successful, this method returns a `204 No Content` response code.
54+
55+
## Examples
56+
57+
### Request
58+
59+
The following example shows a request.
60+
<!-- {
61+
"blockType": "request",
62+
"name": "delete_manager_from_agentuser"
63+
}
64+
-->
65+
``` http
66+
DELETE https://graph.microsoft.com/v1.0/users/{usersId}/manager/{id}/$ref
67+
```
68+
69+
### Response
70+
71+
The following example shows the response.
72+
<!-- {
73+
"blockType": "response",
74+
"truncated": true
75+
}
76+
-->
77+
``` http
78+
HTTP/1.1 204 No Content
79+
```
80+
81+

‎api-reference/v1.0/api/agentuser-delete-sponsors.md‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
---
2+
title: "Remove sponsor (for agentUser)"
3+
description: "Remove a user or group from the sponsors of an agent user."
4+
author: "yyuank"
5+
ms.reviewer: "iamut"
6+
ms.date: 4/27/2026
7+
ms.localizationpriority: medium
8+
ms.subservice: "entra-agent-id"
9+
doc_type: apiPageType
10+
---
11+
12+
# Remove sponsor (for agentUser)
13+
14+
Namespace: microsoft.graph
15+
16+
Remove an [agentUser's](../resources/agentuser.md) sponsor.
17+
18+
## Permissions
19+
20+
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions [only if your app requires it](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions). For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
21+
22+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
23+
|Permission type | Least privileged permission | Higher privileged permissions |
24+
|:--------------------|:---------------------------|:-----------------------------|
25+
|Delegated (work or school account) | AgentIdUser.ReadWrite.IdentityParentedBy | AgentIdUser.ReadWrite.All, User.ReadWrite.All |
26+
|Delegated (personal Microsoft account) | Not supported. | Not supported.|
27+
|Application | AgentIdUser.ReadWrite.IdentityParentedBy | AgentIdUser.ReadWrite.All, User.ReadWrite.All |
28+
29+
[!INCLUDE [rbac-user-sponsors-apis-write](../includes/rbac-for-apis/rbac-user-sponsors-apis-write.md)]
30+
31+
## HTTP request
32+
33+
<!-- {
34+
"blockType": "ignored"
35+
}
36+
-->
37+
``` http
38+
DELETE /users/{usersId}/sponsors/{id}/$ref
39+
```
40+
41+
## Request headers
42+
43+
|Name|Description|
44+
|:---|:---|
45+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
46+
47+
## Request body
48+
49+
Don't supply a request body for this method.
50+
51+
## Response
52+
53+
If successful, this method returns a `204 No Content` response code.
54+
55+
## Examples
56+
57+
### Request
58+
59+
The following example shows a request.
60+
<!-- {
61+
"blockType": "request",
62+
"name": "delete_sponsors_from_agentuser"
63+
}
64+
-->
65+
``` http
66+
DELETE https://graph.microsoft.com/v1.0/users/{usersId}/sponsors/{id}/$ref
67+
```
68+
69+
### Response
70+
71+
The following example shows the response.
72+
<!-- {
73+
"blockType": "response",
74+
"truncated": true
75+
}
76+
-->
77+
``` http
78+
HTTP/1.1 204 No Content
79+
```
80+
81+

‎api-reference/v1.0/api/agentuser-delete.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
---
2+
title: "Delete agentUser"
3+
description: "Delete an agentUser object."
4+
author: "yyuank"
5+
ms.reviewer: "iamut"
6+
ms.date: 4/27/2026
7+
ms.localizationpriority: medium
8+
ms.subservice: "entra-agent-id"
9+
doc_type: apiPageType
10+
---
11+
12+
# Delete agentUser
13+
14+
Namespace: microsoft.graph
15+
16+
Delete an [agentUser](../resources/agentuser.md) object.
17+
18+
## Permissions
19+
20+
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions [only if your app requires it](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions). For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
21+
22+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
23+
|Permission type | Least privileged permission | Higher privileged permissions |
24+
|:--------------------|:---------------------------|:-----------------------------|
25+
|Delegated (work or school account) | AgentIdUser.ReadWrite.IdentityParentedBy | AgentIdUser.ReadWrite.All, User.DeleteRestore.All, User.ReadWrite.All |
26+
|Delegated (personal Microsoft account) | Not supported. | Not supported.|
27+
|Application | AgentIdUser.ReadWrite.IdentityParentedBy | AgentIdUser.ReadWrite.All, User.DeleteRestore.All, User.ReadWrite.All |
28+
29+
> [!IMPORTANT]
30+
> The calling user must be assigned at least one of the following [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json):
31+
> - User Administrator
32+
> - Privileged Authentication Administrator
33+
> - Agent ID Administrator
34+
>
35+
> To delete users with privileged administrator roles in delegated scenarios, the app must be assigned the *Directory.AccessAsUser.All* delegated permission, and the calling user must have a higher privileged administrator role as indicated in [Who can perform sensitive actions](../resources/users.md#who-can-perform-sensitive-actions).
36+
>
37+
> In app-only scenarios, the *User.ReadWrite.All* application permission isn't enough privilege to delete users with privileged administrative roles. The agent must be assigned a higher privileged administrator role as indicated in [Who can perform sensitive actions](../resources/users.md#who-can-perform-sensitive-actions).
38+
39+
## HTTP request
40+
41+
<!-- {
42+
"blockType": "ignored"
43+
}
44+
-->
45+
``` http
46+
DELETE /users/microsoft.graph.agentUser/{userId}
47+
```
48+
Note: An agent user can be deleted through the standard users' endpoint as well: DELETE /users/userId. No special odata type needs to be specified in the request.
49+
50+
## Request headers
51+
52+
|Name|Description|
53+
|:---|:---|
54+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
55+
56+
## Request body
57+
58+
Don't supply a request body for this method.
59+
60+
## Response
61+
62+
If successful, this method returns a `204 No Content` response code.
63+
64+
## Examples
65+
66+
### Request
67+
68+
The following example shows a request.
69+
<!-- {
70+
"blockType": "request",
71+
"name": "delete_agentuser"
72+
}
73+
-->
74+
``` http
75+
DELETE https://graph.microsoft.com/v1.0/users/microsoft.graph.agentUser/ba9a3254-9f18-4209-aeb3-9e42a35b5be4
76+
```
77+
78+
### Response
79+
80+
The following example shows the response.
81+
<!-- {
82+
"blockType": "response",
83+
"truncated": true
84+
}
85+
-->
86+
``` http
87+
HTTP/1.1 204 No Content
88+
```
89+
90+

0 commit comments

Comments
 (0)