ESC
Type to search...
↑↓ Navigate ↵ Open ESC Close

AgentCollection.ReadWrite.All

Export JSON
Export CSV
Copy URL
Print
ApplicationDelegated Read/Write All Resources

Allows the app to create, read, update, and delete all collections and manage their membership in your organization's Agent Registry without a signed-in user.

In short

AgentCollection.ReadWrite.All is available as both an application permission and a delegated permission in the Microsoft Graph API, grouped under the AgentCollection category. Allows the app to create, read, update, and delete all collections and manage their membership in your organization's Agent Registry without a signed-in user. It grants read and write access to resources. Application permissions always require admin consent.

Permission data: October 3, 2026 at 3:19 AM UTC
Delegated Access App-Only Access

Permission Details

Application Permission

Read and write all collections in Agent Registry, except quarantined and global

Allows the app to create, read, update, and delete all collections and manage their membership in your organization's Agent Registry without a signed-in user.

Permission ID: feb31d7d-a227-4487-898c-e014840d07b3
Delegated Permission Admin consent required

Read and write collections in Agent Registry, except quarantined and global

Allows the app to create, read, update, and delete collections and manage their membership in your organization's Agent Registry on behalf of the signed-in user.

User sees: Allows the app to create, read, update, and delete collections and manage their membership on your behalf.
Permission ID: 6d8a7002-a05e-4b95-a768-0e6f0badc6c8

Properties

Microsoft Graph beta exact-category-docs

Properties is shown from beta metadata because a stable v1.0 schema is not available for this resource mapping.

Property Type Description
createdBy String Object ID of the user or app that created the agent instance.
createdDateTime DateTimeOffset Timestamp when agent collection was created.
description String Description / purpose of the collection.
displayName String Friendly name of the collection.
id String Unique identifier for the collection. Key. Inherited from entity.
lastModifiedDateTime DateTimeOffset Timestamp of last update.
managedBy String appId (referred to as Application (client) ID on the Microsoft Entra admin center) of the service principal managing this agent.
originatingStore String Source system/store where the collection originated. For example Copilot Studio.
ownerIds String collection List of object IDs for the owners of the agent instance.
copilotTools copilotTool collection

JSON Representation

Microsoft Graph beta exact-category-docs

JSON representation is shown from beta metadata because a stable v1.0 schema is not available for this resource mapping.

JSON representation 
{
  "@odata.type": "#microsoft.graph.agentCollection",
  "id": "String (identifier)",
  "ownerIds": [
    "String"
  ],
  "managedBy": "String",
  "originatingStore": "String",
  "createdBy": "String",
  "displayName": "String",
  "description": "String",
  "createdDateTime": "String (timestamp)",
  "lastModifiedDateTime": "String (timestamp)"
}

Relationships

Microsoft Graph beta exact-category-docs

Relationships is shown from beta metadata because a stable v1.0 schema is not available for this resource mapping.

Relationship Type Description
members agentInstance collection List of agent instances that are members of this collection. Supports $expand.
copilotTools copilotTool collection Related copilotTools data exposed by this resource.

Graph Methods

Delegated access App-only access
Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

No API methods available for this version.

Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /agentRegistry/agentCollections
GET /agentRegistry/agentCollections/{agentCollectionId}
GET /agentRegistry/agentInstances/{agentInstanceId}/collections/{agentCollectionId}/members
POST /agentRegistry/agentCollections
POST /agentRegistry/agentInstances/{agentInstanceId}/collections/{agentCollectionId}/members/$ref
PATCH /agentRegistry/agentCollections/{agentCollectionId}
DELETE /agentRegistry/agentCollections/{agentCollectionId}
DELETE /agentRegistry/agentInstances/{agentInstanceId}/collections/{agentCollectionId}/members/{id}/$ref
No Microsoft Learn PowerShell mapping available

Microsoft Graph PowerShell v1.0 commands are not available from refreshed Microsoft Learn PowerShell snippets for this permission.

No deterministic PowerShell command map is available for this permission.

Browse PowerShell docs
No Microsoft Learn PowerShell mapping available

Microsoft Graph PowerShell beta commands are not available from refreshed Microsoft Learn PowerShell snippets for this permission.

No deterministic PowerShell command map is available for this permission.

Browse PowerShell docs

Code Examples

C# / .NET SDK
Create agentCollection
View official example on Microsoft Learn
// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Beta.Models;

var requestBody = new AgentCollection
{
	Id = "Security Copilot Platform Workspace: 001",
	OwnerIds = new List<string>
	{
		"daf58b0e-44e1-433c-b6b0-ca70cae320b8",
		"b9108c41-d2d2-4e78-b073-92f57b752bd0",
	},
	ManagedBy = "719cc904-9700-4e08-9941-fd826cc84c60",
	OriginatingStore = "Microsoft Security Copilot",
	CreatedBy = "d47bffae-411a-4de9-8548-05e79bc01f0d",
	DisplayName = "Conditional Access Agents",
	Description = "A collection of agents to manage your organizations conditional access policies",
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.AgentRegistry.AgentCollections.PostAsync(requestBody);
JavaScript
Add agentInstance to agentCollection
View official example on Microsoft Learn
const options = {
	authProvider,
};

const client = Client.init(options);

const agentInstance = {
  '@odata.id': 'https://graph.microsoft.com/beta/agentRegistry/agentInstances(\'agent-instance-id\')'
};

await client.api('/agentRegistry/agentInstances/{agentInstanceId}/collections/{agentCollectionId}/members/$ref')
	.version('beta')
	.post(agentInstance);
PowerShell 
Connect-MgGraph -Scopes "AgentCollection.ReadWrite.All"
Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/agentRegistry/agentCollections"
Python
Create agentCollection
View official example on Microsoft Learn
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.agent_collection import AgentCollection
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = AgentCollection(
	id = "Security Copilot Platform Workspace: 001",
	owner_ids = [
		"daf58b0e-44e1-433c-b6b0-ca70cae320b8",
		"b9108c41-d2d2-4e78-b073-92f57b752bd0",
	],
	managed_by = "719cc904-9700-4e08-9941-fd826cc84c60",
	originating_store = "Microsoft Security Copilot",
	created_by = "d47bffae-411a-4de9-8548-05e79bc01f0d",
	display_name = "Conditional Access Agents",
	description = "A collection of agents to manage your organizations conditional access policies",
)

result = await graph_client.agent_registry.agent_collections.post(request_body)

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for AgentCollection.ReadWrite.All

4

Grant Admin Consent

Application permissions always require admin consent.

Frequently asked questions

What is the AgentCollection.ReadWrite.All Microsoft Graph permission?

AgentCollection.ReadWrite.All is available as both an application permission and a delegated permission in the Microsoft Graph API, grouped under the AgentCollection category. Allows the app to create, read, update, and delete all collections and manage their membership in your organization's Agent Registry without a signed-in user. It grants read and write access to resources. Application permissions always require admin consent. It is mapped to the Microsoft Graph agentcollection resource type. 8 documented Microsoft Graph REST methods require it.

Is AgentCollection.ReadWrite.All an application or a delegated permission?

AgentCollection.ReadWrite.All is available as both an application permission (app-only access, no signed-in user) and a delegated permission (access on behalf of a signed-in user).

Does AgentCollection.ReadWrite.All require admin consent?

Application permissions always require admin consent.

What is the permission ID (GUID) for AgentCollection.ReadWrite.All?

For AgentCollection.ReadWrite.All, the application (app role) ID is feb31d7d-a227-4487-898c-e014840d07b3, and the delegated (OAuth2 scope) ID is 6d8a7002-a05e-4b95-a768-0e6f0badc6c8. These are the real Microsoft Graph identifiers and can be used directly in an app registration manifest.