Entra Agent Id

microsoft/github-copilot-for-azureOfficial

If you're building AI agents that need proper OAuth identities in Azure, this is the skill you want. It walks you through the three-object model (Blueprint, BlueprintPrincipal, Agent Identity) and the two-step fmi_path token exchange that gives each agent instance its own service principal and audit trail. The documentation is thorough on the gotchas: you must explicitly create the BlueprintPrincipal or you'll hit a 400 error, and DefaultAzureCredential won't work because Azure CLI tokens get hard-rejected. Includes both PowerShell and Python examples for provisioning via Microsoft Graph, plus guidance on the AgentID sidecar for polyglot runtimes. This is newer Microsoft infrastructure, so expect some API evolution.

GitHub stars: 217
last updated: Jun 11, 2026

View on GitHub

Install

$ npx -y skills add microsoft/github-copilot-for-azure --skill entra-agent-id --agent claude-code

Installs into .claude/skills of the current project.

Files

Microsoft Entra Agent ID

Create and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.

Quick Reference

Property	Value
Service	Microsoft Entra Agent ID
API	Microsoft Graph (`https://graph.microsoft.com/v1.0`)
Required role	Agent Identity Developer, Agent Identity Administrator, or Application Administrator
Object model	Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP)
Runtime exchange	Two-step `fmi_path` exchange (autonomous and OBO)
.NET helper	`Microsoft.Identity.Web.AgentIdentities`
Polyglot helper	Microsoft Entra SDK for AgentID (sidecar container)