entra-agent-id

Name: entra-agent-id
Author: microsoft

1.3kstars215forks

How to install entra-agent-id?

microsoft/azure-skills/entra-agent-id

$npx -y skills add microsoft/azure-skills --skill entra-agent-id

Installs into the current project.

Summary

Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blu

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Entra Agent ID
2
3	Create and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.
4
5	## Quick Reference
6
7	\| Property \| Value \|
8	\|----------\|-------\|
9	\| Service \| Microsoft Entra Agent ID \|
10	\| API \| Microsoft Graph (`https://graph.microsoft.com/v1.0`) \|
11	\| Required role \| Agent Identity Developer, Agent Identity Administrator, or Application Administrator \|
12	\| Object model \| Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) \|
13	\| Runtime exchange \| Two-step `fmi_path` exchange (autonomous and OBO) \|
14	\| .NET helper \| `Microsoft.Identity.Web.AgentIdentities` \|
15	\| Polyglot helper \| Microsoft Entra SDK for AgentID (sidecar container) \|
16
17	## When to Use This Skill
18
19	- Provisioning a new Agent Identity Blueprint and BlueprintPrincipal
20	- Creating per-instance Agent Identities under a Blueprint
21	- Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint
22	- Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO)
23	- Cross-tenant agent token flows
24	- Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)
25	- Granting per-Agent-Identity application (`appRoleAssignments`) or delegated (`oauth2PermissionGrants`) permissions
26	- Diagnosing Agent ID errors such as `AADSTS82001`, `AADSTS700211`, or `PropertyNotCompatibleWithAgentIdentity`
27
28	## MCP Tools
29
30	\| Tool \| Use \|
31	\|------\|-----\|
32	\| `mcp_azure_mcp_documentation` \| Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration \|
33
34	There is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python `requests`). Use `mcp_azure_mcp_documentation` to verify request bodies and endpoints against current docs before running.
35
36	## Before You Start
37
38	Use the `mcp_azure_mcp_documentation` tool to search Microsoft Learn for current Agent ID documentation:
39	- "Microsoft Entra Agent ID setup instructions"
40	- "Microsoft Entra SDK for AgentID"
41
42	Verify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.
43
44	## Conceptual Model
45
46	```
47	Agent Identity Blueprint (application) ← one per agent type/project
48	└── BlueprintPrincipal (service principal) ← MUST be created explicitly
49	├── Agent Identity (SP): agent-1 ← one per agent instance
50	├── Agent Identity (SP): agent-2
51	└── Agent Identity (SP): agent-3
52	```
53
54	\| Concept \| Description \|
55	\|---------\|-------------\|
56	\| Blueprint \| Application object that defines a type/class of agent. Holds credentials (secret, certificate, federated identity). \|
57	\| BlueprintPrincipal \| Service principal for the Blueprint in the tenant. Not auto-created. \|
58	\| Agent Identity \| Service-principal-only identity for a single agent instance. Cannot hold its own credentials. \|
59	\| Sponsor \| A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation. \|
60
61	## Prerequisites
62
63	### Required Entra Roles
64
65	One of: Agent Identity Developer, Agent Identity Administrator, or Application Administrator.
66
67	### PowerShell (interactive setup)
68
69	```powershell
70	# PowerShell 7+
71	Install-Module Microsoft.Graph.Applications -Scope CurrentUser -Force
72	```
73
74	### Python (programmatic provisioning)
75
76	```bash
77	pip install azure-identity requests
78	```
79
80	## Authentication
81
82	> `DefaultAzureCredential` is not supported. Azure CLI tokens carry `Directory.AccessAsUser.All`, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with `client_credentials`, or `Connect-MgGraph` with explicit delegated scopes.
83
84	### PowerShell (delegated)
85
86	```powershell
87	Connect-MgGraph -Scopes @(
88	"AgentIdentityBlueprint.Create",
89	"AgentIdentityBlueprint.ReadWrite.All",
90	"AgentIdentityBlueprintPrincipal.Create",
91	"AgentIdentity.Create.All",
92	"User.Read"
93	)
94	```
95
96	### Python (application)
97
98	```python
99	import os, requests
100	from azure.identity import ClientSecretCredential
101
102	credential = ClientSecretCredential(
103	tenant_id=os.environ["AZURE_TENANT_ID"],
104	client_id=os.environ["AZURE_CLIENT_ID"],
105	client_secret=os.environ["AZURE_CLIENT_SECRET"],
106	)
107	token = credential.get_token("http

People who liked this also viewed

6 picks

Type

entra-agent-id

1.3kstars215forks

View on GitHub

How to install entra-agent-id?

microsoft/azure-skills/entra-agent-id

$npx -y skills add microsoft/azure-skills --skill entra-agent-id

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Entra Agent ID
2
3	Create and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.
4
5	## Quick Reference
6
7	\| Property \| Value \|
8	\|----------\|-------\|
9	\| Service \| Microsoft Entra Agent ID \|
10	\| API \| Microsoft Graph (`https://graph.microsoft.com/v1.0`) \|
11	\| Required role \| Agent Identity Developer, Agent Identity Administrator, or Application Administrator \|
12	\| Object model \| Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) \|
13	\| Runtime exchange \| Two-step `fmi_path` exchange (autonomous and OBO) \|
14	\| .NET helper \| `Microsoft.Identity.Web.AgentIdentities` \|
15	\| Polyglot helper \| Microsoft Entra SDK for AgentID (sidecar container) \|
16
17	## When to Use This Skill
18
19	- Provisioning a new Agent Identity Blueprint and BlueprintPrincipal
20	- Creating per-instance Agent Identities under a Blueprint
21	- Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint
22	- Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO)
23	- Cross-tenant agent token flows
24	- Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)
25	- Granting per-Agent-Identity application (`appRoleAssignments`) or delegated (`oauth2PermissionGrants`) permissions
26	- Diagnosing Agent ID errors such as `AADSTS82001`, `AADSTS700211`, or `PropertyNotCompatibleWithAgentIdentity`
27
28	## MCP Tools
29
30	\| Tool \| Use \|
31	\|------\|-----\|
32	\| `mcp_azure_mcp_documentation` \| Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration \|
33
34	There is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python `requests`). Use `mcp_azure_mcp_documentation` to verify request bodies and endpoints against current docs before running.
35
36	## Before You Start
37
38	Use the `mcp_azure_mcp_documentation` tool to search Microsoft Learn for current Agent ID documentation:
39	- "Microsoft Entra Agent ID setup instructions"
40	- "Microsoft Entra SDK for AgentID"
41
42	Verify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.
43
44	## Conceptual Model
45
46	```
47	Agent Identity Blueprint (application) ← one per agent type/project
48	└── BlueprintPrincipal (service principal) ← MUST be created explicitly
49	├── Agent Identity (SP): agent-1 ← one per agent instance
50	├── Agent Identity (SP): agent-2
51	└── Agent Identity (SP): agent-3
52	```
53
54	\| Concept \| Description \|
55	\|---------\|-------------\|
56	\| Blueprint \| Application object that defines a type/class of agent. Holds credentials (secret, certificate, federated identity). \|
57	\| BlueprintPrincipal \| Service principal for the Blueprint in the tenant. Not auto-created. \|
58	\| Agent Identity \| Service-principal-only identity for a single agent instance. Cannot hold its own credentials. \|
59	\| Sponsor \| A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation. \|
60
61	## Prerequisites
62
63	### Required Entra Roles
64
65	One of: Agent Identity Developer, Agent Identity Administrator, or Application Administrator.
66
67	### PowerShell (interactive setup)
68
69	```powershell
70	# PowerShell 7+
71	Install-Module Microsoft.Graph.Applications -Scope CurrentUser -Force
72	```
73
74	### Python (programmatic provisioning)
75
76	```bash
77	pip install azure-identity requests
78	```
79
80	## Authentication
81
82	> `DefaultAzureCredential` is not supported. Azure CLI tokens carry `Directory.AccessAsUser.All`, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with `client_credentials`, or `Connect-MgGraph` with explicit delegated scopes.
83
84	### PowerShell (delegated)
85
86	```powershell
87	Connect-MgGraph -Scopes @(
88	"AgentIdentityBlueprint.Create",
89	"AgentIdentityBlueprint.ReadWrite.All",
90	"AgentIdentityBlueprintPrincipal.Create",
91	"AgentIdentity.Create.All",
92	"User.Read"
93	)
94	```
95
96	### Python (application)
97
98	```python
99	import os, requests
100	from azure.identity import ClientSecretCredential
101
102	credential = ClientSecretCredential(
103	tenant_id=os.environ["AZURE_TENANT_ID"],
104	client_id=os.environ["AZURE_CLIENT_ID"],
105	client_secret=os.environ["AZURE_CLIENT_SECRET"],
106	)
107	token = credential.get_token("http

People who liked this also viewed

6 picks

Type