{
  "_comment": "Chapter 09: a fictional contoso.example tenant (c0ffee00-0000-4000-8000-000000000001) as Microsoft Graph would return its agent identities, blueprints, policies, workflows and audit log. The Benefits Agent Blueprint and Benefits Q&A Agent are the same objects as in Chapter 01's estate.json. Every ID is invented. Served by New-NpiAgentFixtureInvoker for labs and tests.",
  "tenantId": "c0ffee00-0000-4000-8000-000000000001",
  "users": [
    { "id": "5a000000-0000-4000-8000-000000000001", "displayName": "Alice Ng", "userPrincipalName": "alice@contoso.example", "userType": "Member", "accountEnabled": true, "employeeType": "Contractor" },
    { "id": "5a000000-0000-4000-8000-000000000002", "displayName": "Bob Ortiz", "userPrincipalName": "bob@contoso.example", "userType": "Member", "accountEnabled": false, "employeeType": "Employee" },
    { "id": "5a000000-0000-4000-8000-000000000003", "displayName": "Carol Diaz", "userPrincipalName": "carol@contoso.example", "userType": "Member", "accountEnabled": true, "employeeType": "Employee" },
    { "id": "5a000000-0000-4000-8000-000000000004", "displayName": "Dave Partner", "userPrincipalName": "dave_partner.example#EXT#@contosoexample.onmicrosoft.com", "userType": "Guest", "accountEnabled": true, "employeeType": null },
    { "id": "5a000000-0000-4000-8000-000000000005", "displayName": "Erin Shaw", "userPrincipalName": "erin@contoso.example", "userType": "Member", "accountEnabled": true, "employeeType": "Employee" },
    { "id": "5a000000-0000-4000-8000-000000000009", "displayName": "Ian Park", "userPrincipalName": "ian@contoso.example", "userType": "Member", "accountEnabled": true, "employeeType": "Employee" }
  ],
  "groups": [
    { "id": "6a000000-0000-4000-8000-000000000001", "displayName": "Benefits Agent Stewards", "groupTypes": ["DynamicMembership"] }
  ],
  "authorizationPolicy": {
    "id": "authorizationPolicy",
    "defaultUserRolePermissions": {
      "allowedToCreateApps": false,
      "allowedToCreateSecurityGroups": false,
      "allowedToCreateTenants": false,
      "allowedToReadOtherUsers": true,
      "permissionGrantPoliciesAssigned": ["ManagePermissionGrantsForSelf.microsoft-user-default-low"]
    }
  },
  "blueprints": [
    { "@odata.type": "#microsoft.graph.agentIdentityBlueprint", "id": "0a000000-0000-4000-8000-000000000008", "appId": "1a000000-0000-4000-8000-000000000008", "displayName": "Benefits Agent Blueprint", "createdDateTime": "2026-08-20T15:00:00Z", "signInAudience": "AzureADMyOrg", "serviceManagementReference": "CMDB-4001", "tags": ["Production"], "passwordCredentials": [], "keyCredentials": [] },
    { "@odata.type": "#microsoft.graph.agentIdentityBlueprint", "id": "0a000000-0000-4000-8000-000000000009", "appId": "1a000000-0000-4000-8000-000000000009", "displayName": "Case Triage Blueprint", "createdDateTime": "2026-08-10T15:00:00Z", "signInAudience": "AzureADMyOrg", "serviceManagementReference": "CMDB-4002", "tags": ["Production"], "passwordCredentials": [ { "keyId": "9c000000-0000-4000-8000-000000000009", "displayName": "triage-secret", "startDateTime": "2026-10-20T14:00:00Z", "endDateTime": "2027-04-20T14:00:00Z" } ], "keyCredentials": [] },
    { "@odata.type": "#microsoft.graph.agentIdentityBlueprint", "id": "0a000000-0000-4000-8000-00000000000a", "appId": "1a000000-0000-4000-8000-00000000000a", "displayName": "Pilot Sandbox Blueprint", "createdDateTime": "2026-10-20T09:00:00Z", "signInAudience": "AzureADMyOrg", "serviceManagementReference": null, "tags": ["Development"], "passwordCredentials": [ { "keyId": "9c000000-0000-4000-8000-00000000000a", "displayName": "local-dev", "startDateTime": "2026-10-20T09:00:00Z", "endDateTime": "2026-12-20T09:00:00Z" } ], "keyCredentials": [] }
  ],
  "blueprintSponsors": {
    "0a000000-0000-4000-8000-000000000008": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000005" }, { "@odata.type": "#microsoft.graph.group", "id": "6a000000-0000-4000-8000-000000000001" } ],
    "0a000000-0000-4000-8000-000000000009": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000003" } ],
    "0a000000-0000-4000-8000-00000000000a": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000001" } ]
  },
  "blueprintOwners": {
    "0a000000-0000-4000-8000-000000000008": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000001" } ],
    "0a000000-0000-4000-8000-000000000009": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000003" } ],
    "0a000000-0000-4000-8000-00000000000a": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000001" } ]
  },
  "federatedIdentityCredentials": {
    "0a000000-0000-4000-8000-000000000008": [ { "id": "fc000000-0000-4000-8000-000000000008", "name": "benefits-agent-mi", "issuer": "https://login.microsoftonline.com/c0ffee00-0000-4000-8000-000000000001/v2.0", "subject": "7c000000-0000-4000-8000-000000000001", "audiences": ["api://AzureADTokenExchange"] } ]
  },
  "inheritablePermissions": {
    "0a000000-0000-4000-8000-000000000008": [ { "resourceAppId": "00000003-0000-0000-c000-000000000000", "inheritableScopes": { "@odata.type": "microsoft.graph.enumeratedScopes", "kind": "enumerated", "scopes": ["User.Read"] }, "inheritableRoles": { "@odata.type": "microsoft.graph.noRoles", "kind": "none" } } ],
    "0a000000-0000-4000-8000-000000000009": [ { "resourceAppId": "00000003-0000-0000-c000-000000000000", "inheritableScopes": { "@odata.type": "microsoft.graph.allAllowedScopes", "kind": "allAllowed" }, "inheritableRoles": { "@odata.type": "microsoft.graph.allAllowedRoles", "kind": "allAllowed" } } ]
  },
  "agentIdentities": [
    { "@odata.type": "#microsoft.graph.agentIdentity", "id": "5b000000-0000-4000-8000-000000000015", "displayName": "Benefits Q&A Agent", "agentIdentityBlueprintId": "1a000000-0000-4000-8000-000000000008", "createdByAppId": "1a000000-0000-4000-8000-000000000008", "createdDateTime": "2026-09-02T10:00:00Z", "accountEnabled": true, "disabledByMicrosoftStatus": null, "servicePrincipalType": "ServiceIdentity", "tags": ["Production"] },
    { "@odata.type": "#microsoft.graph.agentIdentity", "id": "5b000000-0000-4000-8000-000000000016", "displayName": "Case Triage Agent", "agentIdentityBlueprintId": "1a000000-0000-4000-8000-000000000009", "createdByAppId": "1a000000-0000-4000-8000-000000000009", "createdDateTime": "2026-08-15T10:00:00Z", "accountEnabled": true, "disabledByMicrosoftStatus": null, "servicePrincipalType": "ServiceIdentity", "tags": ["Production"] },
    { "@odata.type": "#microsoft.graph.agentIdentity", "id": "5b000000-0000-4000-8000-000000000017", "displayName": "Records Search Agent", "agentIdentityBlueprintId": "1a000000-0000-4000-8000-000000000008", "createdByAppId": "1a000000-0000-4000-8000-000000000008", "createdDateTime": "2026-09-10T10:00:00Z", "accountEnabled": true, "disabledByMicrosoftStatus": null, "servicePrincipalType": "ServiceIdentity", "tags": ["Production"] },
    { "@odata.type": "#microsoft.graph.agentIdentity", "id": "5b000000-0000-4000-8000-000000000018", "displayName": "Sandbox Helper", "agentIdentityBlueprintId": "1a000000-0000-4000-8000-00000000000a", "createdByAppId": "1a000000-0000-4000-8000-00000000000a", "createdDateTime": "2026-10-21T10:00:00Z", "accountEnabled": true, "disabledByMicrosoftStatus": null, "servicePrincipalType": "ServiceIdentity", "tags": ["Development"] }
  ],
  "agentSponsors": {
    "5b000000-0000-4000-8000-000000000015": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000005" }, { "@odata.type": "#microsoft.graph.group", "id": "6a000000-0000-4000-8000-000000000001" } ],
    "5b000000-0000-4000-8000-000000000016": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000003" } ],
    "5b000000-0000-4000-8000-000000000017": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000003" }, { "@odata.type": "#microsoft.graph.group", "id": "6a000000-0000-4000-8000-000000000001" } ],
    "5b000000-0000-4000-8000-000000000018": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000001" } ]
  },
  "agentOwners": {
    "5b000000-0000-4000-8000-000000000015": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000001" } ],
    "5b000000-0000-4000-8000-000000000016": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000003" } ],
    "5b000000-0000-4000-8000-000000000017": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000001" } ],
    "5b000000-0000-4000-8000-000000000018": [ { "@odata.type": "#microsoft.graph.user", "id": "5a000000-0000-4000-8000-000000000001" } ]
  },
  "customSecurityAttributes": {
    "5b000000-0000-4000-8000-000000000015": { "AgentAttributes": { "@odata.type": "#Microsoft.DirectoryServices.CustomSecurityAttributeValue", "AgentApprovalStatus@odata.type": "#Collection(String)", "AgentApprovalStatus": ["Production_Approved"] } },
    "5b000000-0000-4000-8000-000000000017": { "AgentAttributes": { "@odata.type": "#Microsoft.DirectoryServices.CustomSecurityAttributeValue", "AgentApprovalStatus@odata.type": "#Collection(String)", "AgentApprovalStatus": ["Production_Approved"] } },
    "5b000000-0000-4000-8000-000000000018": { "AgentAttributes": { "@odata.type": "#Microsoft.DirectoryServices.CustomSecurityAttributeValue", "AgentApprovalStatus@odata.type": "#Collection(String)", "AgentApprovalStatus": ["Production_Approved"] } }
  },
  "appRoleAssignments": {
    "5b000000-0000-4000-8000-000000000015": [ { "id": "ara-01", "principalId": "5b000000-0000-4000-8000-000000000015", "resourceId": "5b000000-0000-4000-8000-000000000010", "resourceDisplayName": "Microsoft Graph", "appRoleId": "df021288-bdef-4463-88db-98f22de89214" } ],
    "5b000000-0000-4000-8000-000000000016": [ { "id": "ara-02", "principalId": "5b000000-0000-4000-8000-000000000016", "resourceId": "5b000000-0000-4000-8000-000000000010", "resourceDisplayName": "Microsoft Graph", "appRoleId": "b633e1c5-b582-4048-a93e-9f11b44c7e96" } ]
  },
  "roleAssignments": [
    { "id": "ra-01", "principalId": "5b000000-0000-4000-8000-000000000016", "roleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "directoryScopeId": "/" },
    { "id": "ra-02", "principalId": "5b000000-0000-4000-8000-000000000017", "roleDefinitionId": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b", "directoryScopeId": "/" }
  ],
  "roleNames": {
    "29232cdf-9323-42fd-ade2-1d097af3e4de": "Exchange Administrator",
    "88d8e3e3-8f55-4a1e-953a-9b9898b8876b": "Directory Readers"
  },
  "conditionalAccessPolicies": [
    { "id": "ca000000-0000-4000-8000-000000000001", "displayName": "NPI-AGENT-01 Block agent identities not approved in the handshake (report-only)", "state": "enabledForReportingButNotEnforced", "conditions": { "clientApplications": { "includeAgentIdServicePrincipals": ["All"], "excludeAgentIdServicePrincipals": [], "agentIdServicePrincipalFilter": { "mode": "exclude", "rule": "CustomSecurityAttribute.AgentAttributes_AgentApprovalStatus -contains \"Production_Approved\"" } }, "applications": { "includeApplications": ["All"], "excludeApplications": [] } }, "grantControls": { "operator": "AND", "builtInControls": ["block"] } },
    { "id": "ca000000-0000-4000-8000-000000000002", "displayName": "Require MFA for all users", "state": "enabled", "conditions": { "users": { "includeUsers": ["All"] }, "applications": { "includeApplications": ["All"] } }, "grantControls": { "operator": "OR", "builtInControls": ["mfa"] } }
  ],
  "workflows": [
    { "id": "wf000000-0000-4000-8000-000000000001", "displayName": "Leaver: transition agent sponsorships", "category": "leaver", "isEnabled": true, "isSchedulingEnabled": true },
    { "id": "wf000000-0000-4000-8000-000000000002", "displayName": "Mover: notify about agent sponsorships", "category": "mover", "isEnabled": true, "isSchedulingEnabled": true }
  ],
  "workflowTasks": {
    "wf000000-0000-4000-8000-000000000001": [
      { "id": "t1", "displayName": "Send email to manager about sponsorship changes", "taskDefinitionId": "b8c4e1f9-3a7d-4b2e-9c5f-8d6a9b1c2e3f", "isEnabled": true, "category": "leaver,mover" },
      { "id": "t2", "displayName": "Send email to co-sponsors about sponsor changes", "taskDefinitionId": "ad3b85cd-75b1-43e7-b4b9-0e52faba3944", "isEnabled": true, "category": "leaver,mover" },
      { "id": "t3", "displayName": "Transfer agent identity sponsorships to manager", "taskDefinitionId": "b8f4c3d5-9e7a-4b1c-8f2d-6a5e8b9c7f4a", "isEnabled": true, "category": "leaver,mover" }
    ],
    "wf000000-0000-4000-8000-000000000002": [
      { "id": "t4", "displayName": "Send email to manager about sponsorship changes", "taskDefinitionId": "b8c4e1f9-3a7d-4b2e-9c5f-8d6a9b1c2e3f", "isEnabled": true, "category": "leaver,mover" },
      { "id": "t5", "displayName": "Send email to co-sponsors about sponsor changes", "taskDefinitionId": "ad3b85cd-75b1-43e7-b4b9-0e52faba3944", "isEnabled": true, "category": "leaver,mover" }
    ]
  },
  "directoryAudits": [
    { "id": "au-01", "category": "ApplicationManagement", "activityDisplayName": "Update application – Certificates and secrets management", "activityDateTime": "2026-10-20T14:00:00Z", "result": "success", "initiatedBy": { "user": { "id": "5a000000-0000-4000-8000-000000000003", "userPrincipalName": "carol@contoso.example" } }, "targetResources": [ { "id": "0a000000-0000-4000-8000-000000000009", "displayName": "Case Triage Blueprint", "type": "Application", "agentType": "agenticApp" } ] },
    { "id": "au-02", "category": "ApplicationManagement", "activityDisplayName": "Update application – Certificates and secrets management", "activityDateTime": "2026-10-05T09:00:00Z", "result": "success", "initiatedBy": { "app": { "displayName": "Identity pipeline", "servicePrincipalId": "5b000000-0000-4000-8000-000000000014" } }, "targetResources": [ { "id": "0a000000-0000-4000-8000-000000000008", "displayName": "Benefits Agent Blueprint", "type": "Application", "agentType": "agenticApp" } ] },
    { "id": "au-03", "category": "ApplicationManagement", "activityDisplayName": "Add service principal", "activityDateTime": "2026-10-21T10:00:00Z", "result": "success", "initiatedBy": { "user": { "id": "5a000000-0000-4000-8000-000000000001", "userPrincipalName": "alice@contoso.example" } }, "targetResources": [ { "id": "5b000000-0000-4000-8000-000000000018", "displayName": "Sandbox Helper", "type": "ServicePrincipal", "agentType": "agenticAppInstance" } ] },
    { "id": "au-04", "category": "UserManagement", "activityDisplayName": "Update user", "activityDateTime": "2026-10-09T17:00:00Z", "result": "success", "initiatedBy": { "app": { "displayName": "HR provisioning" } }, "targetResources": [ { "id": "5a000000-0000-4000-8000-000000000002", "displayName": "Bob Ortiz", "type": "User", "agentType": "notAgentic" } ] }
  ]
}
