Updated 31 January 2026:
Microsoft confirmed that the publication of this offer was an internal mistake.
On January 23, 2026, an internal test offer “Yuwu9669P1” was inadvertently published to the Partner Center, Microsoft Marketplace and Microsoft 365 admin center. Upon identifying this error, we removed the test offer on January 29, 2026. Our investigation determined that this was caused by a product defect, and we are implementing repair items to help prevent similar occurrences. … There is no evidence that this agent took action or had access to data.
Updated 30 January 2026:
Yesterday, I submitted an MSRC report to flag the suspicious Copilot agent to Microsoft. Microsoft has removed the agent from all tenants and removed it from the marketplace.
******************
Last Saturday (24 January), someone published the Yuwu9669P1 agent into your Microsoft 365 tenant.
I first noticed the agent on Monday because of its unusual name and the completely useless publisher information. It’s a 3rd party agent and does not include any information about publisher certification. I blocked the agent immediately. Deleting it is not possible.
The agent ID is 69b287c4-98c6-4c34-9f18-e5c0142d770d (or via export P_24f4cc02-48bf-7f89-fd2f-1c2683351170). However, I cannot find it as a service principal in Entra, in the Agent Registry, or in the sign-in logs.
This ID is linked to a blueprint provided through Entra Agent Identities.
https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/AllAgents.MenuView/~/allAgentIds/agentIdentityBlueprintId/69b287c4-98c6-4c34-9f18-e5c0142d770d
The blueprint itself is unavailable or hidden from you.
As this agent is in all tenants, it is likely a multi-tenant blueprint. Microsoft describes these blueprint objects here.
Agent identity blueprints are always created in a Microsoft Entra tenant. An agent identity blueprint is often used to create agent identities in that same tenant. These agent identity blueprints are called “single-tenant.” Agent identity blueprints can also be configured as “multitenant” and published to potential customers via Microsoft catalogs. Customers can then add these blueprints to their tenant, so that they can be used to create agent identities.
In either case, an agent identity blueprint principal is always created when a blueprint is added to a tenant. The presence of this principal indicates that a blueprint exists in a tenant and can be used to create agent identities. Customers can remove a blueprint from their tenant by deleting the agent identity blueprint principal.
There is also a Microsoft Marketplace app with the same name.
- The support section includes a reference to Microsoft Support.
- The app also references AdDuplex, an app publisher that shut down the service in 2023.
The agent was published through this Marketplace app. It is clearly not a production-ready agent and is either suspicious or the result of a misdeployment.
If you block this agent, users can still find it in Teams, but Copilot will not allow it to be added or used.
