Entra Agent Id

This provisions Microsoft Entra's new Agent Identity system, which gives each AI agent instance its own service principal, audit trail, and independently scoped permissions via Microsoft Graph. You create a Blueprint (the agent type), then a BlueprintPrincipal (which isn't auto-created and will break if you skip it), then individual Agent Identity service principals for each running instance. The two-step fmi_path token exchange lets agents authenticate with distinct identities even when they share Blueprint credentials. Useful when you need per-agent permission grants, cross-tenant flows, or compliance logging that tracks which agent did what. The skill covers direct Graph API calls since there's no dedicated MCP server yet. Watch out for DefaultAzureCredential, it doesn't work here because Azure CLI tokens get hard-rejected.

skills.sh installs: 428.8K
GitHub stars: 1.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add microsoft/azure-skills --skill entra-agent-id --agent claude-code

Installs into .claude/skills of the current project.

Files

Microsoft Entra Agent ID

Create and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.

Quick Reference

Property	Value
Service	Microsoft Entra Agent ID
API	Microsoft Graph (`https://graph.microsoft.com/v1.0`)
Required role	Agent Identity Developer, Agent Identity Administrator, or Application Administrator
Object model	Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP)
Runtime exchange	Two-step `fmi_path` exchange (autonomous and OBO)
.NET helper	`Microsoft.Identity.Web.AgentIdentities`
Polyglot helper	Microsoft Entra SDK for AgentID (sidecar container)