entra-agent-id

Provision OAuth 2.0 identities for AI agents with per-instance credentials and audit trails via Microsoft Graph.

microsoft ↓ 194k

Claude Code

View source ↗

What it does

Provisioning a new Agent Identity Blueprint and BlueprintPrincipal
Creating per-instance Agent Identities under a Blueprint
Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint
Implementing the two-step fmipath runtime token exchange (autonomous or OBO)
Cross-tenant agent token flows
Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)
Granting per-Agent-Identity application (appRoleAssignments) or delegated (oauth2PermissionGrants) permissions

Requirements & configuration

Implementing the two-step fmipath runtime token exchange (autonomous or OBO)
Cross-tenant agent token flows
token = credential.gettoken("https://graph.microsoft.com/.default")
"Authorization": f"Bearer {token.token}",
For the two-step fmipath exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct sub claim and audit trail, see references/runtime-token-exchange.md.

Configuration: AADSTS82001AADSTS700211POSTDELETEAADSTS50013AADSTS65001AADSTS650051

Derived from the skill's own SKILL.md documentation · extracted 2026-07-23

Provision OAuth 2.0 identities for AI agents with per-instance credentials and audit trails via Microsoft Graph.

Source

Repository: https://github.com/microsoft/azure-skills

entra-agent-id FAQ

What does the entra-agent-id skill do?

Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry). Provisioning a new Agent Identity Blueprint and BlueprintPrincipal Creating per-instance Agent Identities under a Blueprint

What does entra-agent-id require?

Implementing the two-step fmipath runtime token exchange (autonomous or OBO) Cross-tenant agent token flows token = credential.gettoken("https://graph.microsoft.com/.default") "Authorization": f"Bearer {token.token}", For the two-step fmipath exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct sub claim and audit trail, see references/runtime-token-exchange.md. Configuration keys: AADSTS82001, AADSTS700211, POST, DELETE, AADSTS50013, AADSTS65001, AADSTS650051.

How do I install entra-agent-id?

Run: npx -y skills add https://github.com/microsoft/azure-skills --skill entra-agent-id --agent claude-code — the source lives at github.com/microsoft/azure-skills.

Maintain entra-agent-id?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[![entra-agent-id on getagentictools](https://getagentictools.com/badge/skills/microsoft-azure-skills-entra-agent-id.svg)](https://getagentictools.com/skills/microsoft-azure-skills-entra-agent-id?ref=badge)

npx agentictools info skills/microsoft-azure-skills-entra-agent-id

The second line is the CLI lookup for this page — handy in READMEs and docs.