Why Is Get Agent Unavailable for an Intune Security Copilot Agent?
You have a Microsoft Entra tenant that contains the users shown in the following table.
You have a Microsoft Security Copilot workspace.
From Microsoft Security Store, you plan to deploy a partner-built agent named Agent1 that requires access to Microsoft Intune.
When User1 selects Agent1, the Get agent option is unavailable.
You need to enable User1 to complete the agent setup. The solution must follow the principle of least privilege.
What should you do first?
Community Insight
This item tests whether you recognize that the blocker is tenant-level consent for Agent1’s Intune permissions, not a missing Entra role for User1.
Deploying a partner-built Security Copilot agent that needs Intune access requires tenant-level admin consent before User1 can select Get agent. The page explains why having the existing Global Administrator approve Agent1 first is the least-privilege solution.
The common error is choosing D and assigning User1 Agent ID Administrator, which can manage agent identities but does not grant the Intune/Microsoft Graph consent the partner agent requests.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
User1 is blocked at the Get agent stage because Agent1 requests access to Microsoft Intune, which requires tenant-level admin consent for the agent’s Microsoft Graph/Intune permissions. As a Security Copilot Contributor, User1 cannot grant that consent. Having User2, the existing Global Administrator, review and approve the agent setup resolves the blocker without granting User1 any additional privileged Entra role, which satisfies least privilege. After approval, User1 can return to the agent and complete the remaining setup steps.Why the Other Options Are Wrong
Creating an agent identity (A) is part of agent provisioning, but it does not supply the missing tenant-wide consent and may itself depend on the correct role and consent flow. Configuring a data source (B) comes after the agent is acquired and consent is granted, so it cannot make Get agent available. Assigning AI Administrator (C) or Agent ID Administrator (D) gives User1 broader or unrelated administrative rights; Agent ID Administrator manages agent identities but does not grant Intune/Graph consent, and neither is needed when an existing Global Administrator can approve the one-time request.Community Comment Notes
Greens focused on the real blocker, explaining that the consent is tenant-level and that “a Security Copilot Contributor can’t give it”, which is why the Get agent control is greyed out. rRick and Eltooth also favored using User2 to approve the setup as the least-privilege path. LukeAR78 argued for Agent ID Administrator because User1 must complete the setup, but that role does not address the Intune permission consent that Agent1 is requesting.Official Reference
Exam Strategy
When a Get agent or install control is disabled for a partner agent that requests access to another workload, look for the consent step before role assignment. Ask which existing administrator can grant tenant-wide permissions; assigning broad Entra roles to the requester is usually the least-privilege trap.
Frequently Asked Questions
Why is assigning Agent ID Administrator not enough for Agent1?
Agent ID Administrator can create and manage agent identities, but it does not grant the tenant-wide Intune/Microsoft Graph consent that this partner-built agent requires.
Does User1 need AI Administrator to select Get agent?
No. The Get agent option is blocked by missing admin consent for Agent1's Intune access; an existing Global Administrator can approve it without assigning User1 a broader role.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →