MICROSOFT ENTRA AGENT ACCESS REVIEW
Review owner: __________________  UTC date/time: __________________
Change approval / incident / request: __________________
Tenant cloud / workstation / .NET SDK and runtime: __________________
Management-client consent baseline saved before adding scopes? __________
Baseline path / management client application and object IDs: __________
Existing cleanup operator/client authorization confirmed before the lab? ____

1. OBJECT MAP (keep identifiers in your private record)
Blueprint name, application ID and object ID:
Blueprint principal object ID:
Child identity name, application ID and object ID:
Resource name, application ID and service principal ID:
Application role value and role ID:
Owner / sponsor / approved purpose:

2. ACCESS PATH
[ ] Required resource access inspected (a declaration is not a grant).
[ ] Parent principal's actual app-role assignments inspected.
[ ] Parent delegated grants inspected: consent type, user and scope list.
[ ] Inheritance configuration inspected for this resource.
[ ] Direct child assignments and delegated grants inspected separately.
[ ] Entra roles, groups, Azure RBAC and resource-specific access considered.
[ ] Blueprint credentials and ownership reviewed.
[ ] api.requestedAccessTokenVersion is 2; only the synthetic Lab.Read role exists.
[ ] Portal grant-source display recorded, with UTC time.
[ ] Inventory queries complete, including all pages; any failure marked incomplete.
[ ] Configured object IDs and parent-child association verified.
[ ] Operator may read the typed blueprint/inheritance endpoints as well as grants.
    Directory Readers alone is not a guarantee; record owner/supported role: ____

3. THREE-MOMENT SYNTHETIC TEST
A: No resource grant. UTC: ____ Token issued? ____ API called? ____ HTTP: ____
   Ticket returned? ____ Explanation excluding configuration errors: ____
B: Parent granted Lab.Read; child has no direct grant.
   Assignment ID: ____ UTC: ____ Fresh token issued UTC: ____ HTTP: ____
   Expected child caller validated? ____ Lab.Read present? ____ Ticket: ____
C: Exact parent grant removed. UTC: ____ Deletion verified? ____
   All inheriting children and their owners/dependencies reviewed? ____
   New client process? ____ Fresh token issued UTC: ____ HTTP: ____
   Intermediate propagation results / other authorization paths: ____

Record observed results, not only expected results. A token issuance error,
API 401 and API 403 are different findings. Do not save bearer tokens,
client assertions, private keys or customer data in the evidence package.
Removing a grant is not proof that every already-issued token is invalid.

4. CLEANUP
[ ] Exact lab role assignment removed.
[ ] Blueprint certificate authorization removed.
[ ] Test child identity and blueprint removed; active inventories verified.
[ ] Disposable API application and service principal removed.
[ ] Local API stopped and dedicated local certificate removed.
[ ] Consent callback helper stopped; operator Graph session disconnected.
[ ] Only newly added management-client permissions removed; existing ones preserved.
    Grant IDs / AllPrincipals or Principal / exact user object ID: __________
    Plan and WhatIf reviewed; actual readback verified: _____________________
    Additional preserved scopes reviewed separately: _______________________
[ ] Blueprint-registration setting checked against the intended final state.
[ ] Sanitized screenshots, UTC times and limitations retained.

Reviewer: __________________  Outcome / follow-up: __________________

The published screenshots are from the original .NET 8 tenant test.
The updated .NET 10 package has separate local validation; record your own
runtime/version and A/B/C tenant results. A zero probe exit code alone does
not replace the independent grant inventory. Existing tokens were not tested
for immediate invalidation by the recorded lab.