What Changed
The EntraNHIAssets_DataConnectorDefinition.json connector definition (v1.0.1 to v1.0.2) removes all four declared dataTypes entries (EntraAgentIdentities, EntraAgentIdentityBlueprintPrincipals, EntraAgentIdentityBlueprints, EntraAgentUsers), setting the array to empty.
The root cause was that each data type lacked a lastDataReceivedQuery field. The connector page auto-generates a last-data-received KQL query from the data types list; when lastDataReceivedQuery is absent, the generated KQL contains an empty subquery that fails parsing with Query could not be parsed at pipe. The connector page became non-functional for any deployment with this connector installed.
Security Impact (Visibility and Fidelity)
Prior to this fix: The Microsoft Agent Identities connector page threw a KQL parse error, preventing operators from confirming data ingestion status for agent identity and blueprint data. This is an operational blind spot: the connector may still be ingesting, but there is no way to confirm last-data-received from the connector page.
After this fix: The parse error is resolved. However, automated PR review flagged that emptying dataTypes removes the connector declared data type metadata, which may break other connector page behaviors that depend on the data type contract. The PR description states the intent was to add lastDataReceivedQuery per data type; the implementation instead removes the data types entirely.
Net effect: The connector page parse error is resolved at the cost of the connector advertising zero data types. Environments running v1.0.1 have had a broken connector status page since that version was deployed; upgrading to v1.0.2 clears the error but the connector metadata contract change may introduce downstream issues.
Connector Scope
| Data Type | Description |
|---|---|
| EntraAgentIdentities | Agent identity records |
| EntraAgentIdentityBlueprintPrincipals | Blueprint principal assignments |
| EntraAgentIdentityBlueprints | Blueprint definitions |
| EntraAgentUsers | Agent-linked user accounts |
These tables support non-human identity (NHI) asset tracking: visibility into AI agent and service principal identity lifecycle in Microsoft Entra ID.
Affected Files
Solutions/Agent 365/Data Connectors/EntraNHIAssets_DataConnectorDefinition.json
(packaging artefacts: 3.1.3.zip, ReleaseNotes.md, Solution_A365.json, mainTemplate.json)