{"id":"5a18b943-256f-4b1f-8819-7811a728c15b","shortId":"Cu3qLA","kind":"skill","title":"entra-agent-id","tagline":"Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blu","description":"# Microsoft Entra Agent ID\n\nCreate and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.\n\n## Quick Reference\n\n| Property | Value |\n|----------|-------|\n| Service | Microsoft Entra Agent ID |\n| API | Microsoft Graph (`https://graph.microsoft.com/v1.0`) |\n| Required role | Agent Identity Developer, Agent Identity Administrator, or Application Administrator |\n| Object model | Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) |\n| Runtime exchange | Two-step `fmi_path` exchange (autonomous and OBO) |\n| .NET helper | `Microsoft.Identity.Web.AgentIdentities` |\n| Polyglot helper | Microsoft Entra SDK for AgentID (sidecar container) |\n\n## When to Use This Skill\n\n- Provisioning a new Agent Identity Blueprint and BlueprintPrincipal\n- Creating per-instance Agent Identities under a Blueprint\n- Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint\n- Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO)\n- Cross-tenant agent token flows\n- Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)\n- Granting per-Agent-Identity application (`appRoleAssignments`) or delegated (`oauth2PermissionGrants`) permissions\n- Diagnosing Agent ID errors such as `AADSTS82001`, `AADSTS700211`, or `PropertyNotCompatibleWithAgentIdentity`\n\n## MCP Tools\n\n| Tool | Use |\n|------|-----|\n| `mcp_azure_mcp_documentation` | Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration |\n\nThere is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python `requests`). Use `mcp_azure_mcp_documentation` to verify request bodies and endpoints against current docs before running.\n\n## Before You Start\n\nUse the `mcp_azure_mcp_documentation` tool to search Microsoft Learn for current Agent ID documentation:\n- \"Microsoft Entra Agent ID setup instructions\"\n- \"Microsoft Entra SDK for AgentID\"\n\nVerify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.\n\n## Conceptual Model\n\n```\nAgent Identity Blueprint (application)         ← one per agent type/project\n  └── BlueprintPrincipal (service principal)    ← MUST be created explicitly\n        ├── Agent Identity (SP): agent-1        ← one per agent instance\n        ├── Agent Identity (SP): agent-2\n        └── Agent Identity (SP): agent-3\n```\n\n| Concept | Description |\n|---------|-------------|\n| **Blueprint** | Application object that defines a type/class of agent. Holds credentials (secret, certificate, federated identity). |\n| **BlueprintPrincipal** | Service principal for the Blueprint in the tenant. Not auto-created. |\n| **Agent Identity** | Service-principal-only identity for a single agent instance. Cannot hold its own credentials. |\n| **Sponsor** | A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation. |\n\n## Prerequisites\n\n### Required Entra Roles\n\nOne of: **Agent Identity Developer**, **Agent Identity Administrator**, or **Application Administrator**.\n\n### PowerShell (interactive setup)\n\n```powershell\n# PowerShell 7+\nInstall-Module Microsoft.Graph.Applications -Scope CurrentUser -Force\n```\n\n### Python (programmatic provisioning)\n\n```bash\npip install azure-identity requests\n```\n\n## Authentication\n\n> **`DefaultAzureCredential` is not supported.** Azure CLI tokens carry `Directory.AccessAsUser.All`, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with `client_credentials`, or `Connect-MgGraph` with explicit delegated scopes.\n\n### PowerShell (delegated)\n\n```powershell\nConnect-MgGraph -Scopes @(\n    \"AgentIdentityBlueprint.Create\",\n    \"AgentIdentityBlueprint.ReadWrite.All\",\n    \"AgentIdentityBlueprintPrincipal.Create\",\n    \"AgentIdentity.Create.All\",\n    \"User.Read\"\n)\n```\n\n### Python (application)\n\n```python\nimport os, requests\nfrom azure.identity import ClientSecretCredential\n\ncredential = ClientSecretCredential(\n    tenant_id=os.environ[\"AZURE_TENANT_ID\"],\n    client_id=os.environ[\"AZURE_CLIENT_ID\"],\n    client_secret=os.environ[\"AZURE_CLIENT_SECRET\"],\n)\ntoken = credential.get_token(\"https://graph.microsoft.com/.default\")\n\nGRAPH = \"https://graph.microsoft.com/v1.0\"\nheaders = {\n    \"Authorization\": f\"Bearer {token.token}\",\n    \"Content-Type\": \"application/json\",\n    \"OData-Version\": \"4.0\",\n}\n```\n\n## Core Workflow\n\n### Step 1: Create Agent Identity Blueprint\n\nUse the typed endpoint. Sponsors must be **Users** at Blueprint creation. This snippet assumes the `requests` client and `headers` dict from the Python authentication block above.\n\n```python\nimport subprocess\nimport requests\n\nuser_id = subprocess.run(\n    [\"az\", \"ad\", \"signed-in-user\", \"show\", \"--query\", \"id\", \"-o\", \"tsv\"],\n    capture_output=True, text=True, check=True,\n).stdout.strip()\n\nblueprint_body = {\n    \"displayName\": \"My Agent Blueprint\",\n    \"sponsors@odata.bind\": [\n        f\"https://graph.microsoft.com/v1.0/users/{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}/applications/microsoft.graph.agentIdentityBlueprint\",\n    headers=headers, json=blueprint_body,\n)\nresp.raise_for_status()\n\nblueprint = resp.json()\napp_id = blueprint[\"appId\"]\nblueprint_obj_id = blueprint[\"id\"]\n```\n\n### Step 2: Create BlueprintPrincipal\n\n> Mandatory. Creating a Blueprint does NOT auto-create its service principal. Skipping this step produces:\n> `400: The Agent Blueprint Principal for the Agent Blueprint does not exist.`\n\n```python\nsp_body = {\"appId\": app_id}\nresp = requests.post(\n    f\"{GRAPH}/servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal\",\n    headers=headers, json=sp_body,\n)\nresp.raise_for_status()\n```\n\nMake your provisioning scripts idempotent — always check for the BlueprintPrincipal even when the Blueprint already exists.\n\n### Step 3: Create Agent Identities\n\nSponsors for an Agent Identity may be **Users or Groups**.\n\n```python\nagent_body = {\n    \"displayName\": \"my-agent-instance-1\",\n    \"agentIdentityBlueprintId\": app_id,\n    \"sponsors@odata.bind\": [\n        f\"https://graph.microsoft.com/v1.0/users/{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}/servicePrincipals/microsoft.graph.agentIdentity\",\n    headers=headers, json=agent_body,\n)\nresp.raise_for_status()\nagent = resp.json()\nagent_sp_id = agent[\"id\"]\n```\n\n## Runtime Authentication\n\nAgents authenticate at runtime using credentials configured on the **Blueprint** (not on the Agent Identity — Agent Identities can't hold credentials).\n\n| Option | Use case | Credential on Blueprint |\n|--------|----------|------------------------|\n| **Managed Identity + WIF** | Production (Azure-hosted) | Federated Identity Credential |\n| **Client secret** | Local dev / testing | Password credential |\n| **Microsoft Entra SDK for AgentID** | Polyglot / 3P agents | Sidecar container acquires tokens over HTTP |\n\nFor the two-step `fmi_path` exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct `sub` claim and audit trail, see [references/runtime-token-exchange.md](references/runtime-token-exchange.md).\n\nFor OBO (agent acting on behalf of a user), see [references/obo-blueprint-setup.md](references/obo-blueprint-setup.md).\n\nFor the containerized polyglot auth sidecar (Python, Node, Go, Java — no SDK embedding), see [references/sdk-sidecar.md](references/sdk-sidecar.md).\n\nFor MI+WIF and client-secret setup details, see [references/oauth2-token-flow.md](references/oauth2-token-flow.md).\n\n### .NET quick path\n\nFor .NET services, use **`Microsoft.Identity.Web.AgentIdentities`** — it handles Federated Identity Credential management and the two-step exchange for you. See the package README at `github.com/AzureAD/microsoft-identity-web` under `src/Microsoft.Identity.Web.AgentIdentities/`.\n\n## Granting Permissions (Per Agent Identity)\n\nAgent Identities support both application permissions (autonomous) and delegated permissions (OBO). Grants are scoped **per Agent Identity**, not to the BlueprintPrincipal.\n\n### Application permissions (autonomous)\n\n```python\ngraph_sp = requests.get(\n    f\"{GRAPH}/servicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'\",\n    headers=headers,\n).json()[\"value\"][0]\n\nuser_read_all = next(r for r in graph_sp[\"appRoles\"] if r[\"value\"] == \"User.Read.All\")\n\nrequests.post(\n    f\"{GRAPH}/servicePrincipals/{agent_sp_id}/appRoleAssignments\",\n    headers=headers,\n    json={\n        \"principalId\": agent_sp_id,\n        \"resourceId\": graph_sp[\"id\"],\n        \"appRoleId\": user_read_all[\"id\"],\n    },\n).raise_for_status()\n```\n\n### Delegated permissions (OBO)\n\n```python\nfrom datetime import datetime, timedelta, timezone\n\nexpiry = (datetime.now(timezone.utc) + timedelta(days=3650)).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n\nrequests.post(\n    f\"{GRAPH}/oauth2PermissionGrants\",\n    headers=headers,\n    json={\n        \"clientId\": agent_sp_id,\n        \"consentType\": \"AllPrincipals\",\n        \"resourceId\": graph_sp[\"id\"],\n        \"scope\": \"User.Read Tasks.ReadWrite Mail.Send\",\n        \"expiryTime\": expiry,\n    },\n).raise_for_status()\n```\n\nBrowser-based admin consent URLs do not work for Agent Identities — use `oauth2PermissionGrants` for programmatic delegated consent.\n\n## Cross-Tenant Agent Identities\n\nBlueprints can be multi-tenant (`signInAudience: AzureADMultipleOrgs`). When exchanging tokens cross-tenant:\n\n> **Step 1 of the parent token exchange MUST target the Agent Identity's home tenant**, not the Blueprint's. Wrong tenant → `AADSTS700211: No matching federated identity record found`.\n\nSee [references/runtime-token-exchange.md](references/runtime-token-exchange.md) for full cross-tenant examples.\n\n## API Reference\n\n| Operation | Method | Endpoint |\n|-----------|--------|----------|\n| Create Blueprint | `POST` | `/applications/microsoft.graph.agentIdentityBlueprint` |\n| Create BlueprintPrincipal | `POST` | `/servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal` |\n| Create Agent Identity | `POST` | `/servicePrincipals/microsoft.graph.agentIdentity` |\n| Add FIC to Blueprint | `POST` | `/applications/{id}/microsoft.graph.agentIdentityBlueprint/federatedIdentityCredentials` |\n| List Agent Identities | `GET` | `/servicePrincipals/microsoft.graph.agentIdentity` |\n| Grant app permission | `POST` | `/servicePrincipals/{id}/appRoleAssignments` |\n| Grant delegated permission | `POST` | `/oauth2PermissionGrants` |\n| Delete Agent Identity | `DELETE` | `/servicePrincipals/{id}` |\n| Delete Blueprint | `DELETE` | `/applications/{id}` |\n\nBase URL: `https://graph.microsoft.com/v1.0`.\n\n## Required Graph Permissions\n\n| Permission | Purpose |\n|-----------|---------|\n| `AgentIdentityBlueprint.Create` | Create Blueprints |\n| `AgentIdentityBlueprint.ReadWrite.All` | Read/update Blueprints |\n| `AgentIdentityBlueprintPrincipal.Create` | Create BlueprintPrincipals |\n| `AgentIdentity.Create.All` | Create Agent Identities |\n| `AgentIdentity.ReadWrite.All` | Read/update Agent Identities |\n| `Application.ReadWrite.All` | Blueprint CRUD on application objects |\n| `AppRoleAssignment.ReadWrite.All` | Grant application permissions |\n| `DelegatedPermissionGrant.ReadWrite.All` | Grant delegated permissions |\n\nGrant admin consent (required for application permissions):\n\n```bash\naz ad app permission admin-consent --id <client-id>\n```\n\nAfter admin consent, tokens may not include new claims for 30–120 seconds — retry with exponential backoff.\n\n## Best Practices\n\n1. **Always create BlueprintPrincipal after Blueprint** — not auto-created.\n2. **Use typed endpoints** (`/applications/microsoft.graph.agentIdentityBlueprint`) instead of raw `/applications` with `@odata.type`.\n3. **Credentials live on the Blueprint** — Agent Identities can't hold secrets/certs (`PropertyNotCompatibleWithAgentIdentity`).\n4. **Include `OData-Version: 4.0`** on every Graph request.\n5. **Use Workload Identity Federation for production** — client secrets only for local dev.\n6. **Set `identifierUris: [\"api://{appId}\"]` on the Blueprint** before OAuth2 scope resolution.\n7. **Never use Azure CLI tokens** for Agent Identity APIs — `Directory.AccessAsUser.All` causes hard 403.\n8. **Use `fmi_path`** with `client_credentials` — NOT RFC 8693 `urn:ietf:params:oauth:grant-type:token-exchange` (returns `AADSTS82001`).\n9. **Always use `/.default` scope** in both steps of the exchange — individual scopes fail.\n10. **Step 1 targets the Agent Identity's home tenant** in cross-tenant flows.\n11. **Grant permissions per Agent Identity**, not to the BlueprintPrincipal.\n12. **Handle permission-propagation delays** — retry 403s with 30–120s backoff after admin consent.\n13. **Keep the Entra SDK for AgentID on localhost** — never expose via LoadBalancer or Ingress.\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n|-------|-------|-----|\n| `AADSTS82001` | Used RFC 8693 token-exchange grant | Use `client_credentials` with `fmi_path` |\n| `AADSTS700211` | Step 1 parent token targeted wrong tenant | Target Agent Identity's home tenant |\n| `AADSTS50013` | OBO user token targets Graph, not Blueprint | Use `api://{blueprint_app_id}/access_as_user` |\n| `AADSTS65001` | Missing grant or used individual scopes | Use `/.default` and verify `oauth2PermissionGrants` |\n| `403 Authorization_RequestDenied` | No grant on this Agent Identity | Add via `appRoleAssignments` or `oauth2PermissionGrants` |\n| `PropertyNotCompatibleWithAgentIdentity` | Tried to add credential to Agent Identity SP | Put credentials on the Blueprint |\n| `Agent Blueprint Principal does not exist` | BlueprintPrincipal not created | Step 2 of the Core Workflow |\n| `AADSTS650051` on admin consent | SP already exists from partial consent | Grant directly via `appRoleAssignments` |\n\n## References\n\n| File | Contents |\n|------|----------|\n| [references/runtime-token-exchange.md](references/runtime-token-exchange.md) | Two-step `fmi_path` exchange: autonomous + OBO, cross-tenant |\n| [references/oauth2-token-flow.md](references/oauth2-token-flow.md) | MI + WIF (production) and client secret (local dev) |\n| [references/obo-blueprint-setup.md](references/obo-blueprint-setup.md) | Configuring the Blueprint as an OAuth2 API for OBO |\n| [references/sdk-sidecar.md](references/sdk-sidecar.md) | Microsoft Entra SDK for AgentID — architecture, configuration, endpoints |\n| [references/sdk-sidecar-deployment.md](references/sdk-sidecar-deployment.md) | SDK code patterns (Python/TypeScript), Docker/Kubernetes manifests, security, troubleshooting |\n| [references/known-limitations.md](references/known-limitations.md) | Documented gaps organized by category |\n\n### External Links\n\n| Resource | URL |\n|----------|-----|\n| Agent ID Setup Guide | https://learn.microsoft.com/en-us/entra/agent-id/identity-platform/agent-id-setup-instructions |\n| AI-Guided Setup | https://learn.microsoft.com/en-us/entra/agent-id/identity-platform/agent-id-ai-guided-setup |\n| Microsoft Entra SDK for AgentID | https://learn.microsoft.com/en-us/entra/msidweb/agent-id-sdk/overview |\n| Microsoft.Identity.Web.AgentIdentities (.NET) | https://github.com/AzureAD/microsoft-identity-web/blob/master/src/Microsoft.Identity.Web.AgentIdentities/README.AgentIdentities.md |","tags":["entra","agent","azure","skills","microsoft","agent-skills"],"capabilities":["skill","source-microsoft","skill-entra-agent-id","topic-agent-skills"],"categories":["azure-skills"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/microsoft/azure-skills/entra-agent-id","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add microsoft/azure-skills","source_repo":"https://github.com/microsoft/azure-skills","install_from":"skills.sh"}},"qualityScore":"0.950","qualityRationale":"deterministic score 0.95 from registry signals: · indexed on github topic:agent-skills · official publisher · 1014 github stars · SKILL.md body (15,258 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T18:53:17.156Z","embedding":null,"createdAt":"2026-04-29T18:53:12.770Z","updatedAt":"2026-05-18T18:53:17.156Z","lastSeenAt":"2026-05-18T18:53:17.156Z","tsv":"'-0000':986,987 '-000000000000':989 '-1':348 '-2':357 '-3':362 '/.default':546,1397,1516 '/access_as_user':1507 '/applications':1183,1212,1308 '/applications/microsoft.graph.agentidentityblueprint':642,1168,1304 '/approleassignments':1017,1197 '/azuread/microsoft-identity-web':943 '/azuread/microsoft-identity-web/blob/master/src/microsoft.identity.web.agentidentities/readme.agentidentities.md':1671 '/en-us/entra/agent-id/identity-platform/agent-id-ai-guided-setup':1658 '/en-us/entra/agent-id/identity-platform/agent-id-setup-instructions':1651 '/en-us/entra/msidweb/agent-id-sdk/overview':1666 '/microsoft.graph.agentidentityblueprint/federatedidentitycredentials':1185 '/oauth2permissiongrants':1063,1202 '/serviceprincipals':981,1013,1195,1207 '/serviceprincipals/microsoft.graph.agentidentity':767,1177,1190 '/serviceprincipals/microsoft.graph.agentidentityblueprintprincipal':704,1172 '/v1.0':92,550,1218 '/v1.0/users/':635,760 '0':994 '00000003':985 '1':567,752,1124,1290,1410,1483 '10':1408 '11':1423 '12':1433 '120':1282 '120s':1443 '13':1448 '2':663,1300,1558 '2.0':24,54 '3':730,1311 '30':1281,1442 '3650':1052 '3p':835 '4':1324 '4.0':563,1329 '400':682 '403':482,1371,1520 '403s':1440 '5':1334 '6':1347 '7':447,1358 '8':1372 '8693':1381,1470 '9':1394 'aadsts50013':1495 'aadsts65001':1508 'aadsts650051':1563 'aadsts700211':221,1144,1481 'aadsts82001':220,1393,1467 'acquir':839 'act':877 'ad':607,1264 'add':1178,1529,1537 'admin':1089,1256,1268,1272,1446,1565 'admin-cons':1267 'administr':100,103,438,441 'agent':3,8,16,43,48,59,64,85,95,98,110,144,153,185,198,206,215,237,250,299,304,329,335,344,347,351,353,356,358,361,373,393,403,416,433,436,476,569,629,684,689,732,737,745,750,771,776,778,781,785,798,800,836,855,862,876,949,951,966,1014,1022,1068,1096,1107,1133,1174,1187,1204,1235,1239,1317,1365,1413,1427,1490,1527,1540,1548,1645 'agentid':39,133,194,312,833,1454,1620,1663 'agentidentity.create.all':509,1233 'agentidentity.readwrite.all':1237 'agentidentityblueprint.create':506,1224 'agentidentityblueprint.readwrite.all':507,1227 'agentidentityblueprintid':753 'agentidentityblueprintprincipal.create':508,1230 'ai':58,1653 'ai-guid':1652 'allprincip':1072 'alreadi':727,1568 'alway':718,1291,1395 'api':87,241,261,324,478,1160,1367,1611 'app':486,653,698,754,1192,1265,1505 'appid':656,697,983,1350 'applic':102,107,208,332,366,440,512,955,972,1245,1249,1260 'application.readwrite.all':1241 'application/json':559 'approl':1005 'approleassign':209,1531,1576 'approleassignment.readwrite.all':1247 'approleid':1029 'architectur':1621 'assum':585 'audit':70,869 'auth':890 'authent':465,595,784,786 'author':552,1521 'auto':391,673,1298 'auto-cr':390,672,1297 'autonom':121,179,957,974,1588 'az':606,1263 'azur':229,269,289,462,470,526,532,538,817,1361 'azure-host':816 'azure-ident':461 'azure.identity':518 'azureadmultipleorg':1116 'backoff':1287,1444 'base':1088,1214 'bash':458,1262 'bearer':554 'behalf':879 'best':1288 'block':596 'blu':45 'blueprint':10,106,146,157,168,331,365,385,571,581,625,630,646,651,655,657,660,669,685,690,726,794,811,1109,1140,1166,1181,1210,1226,1229,1242,1295,1316,1353,1502,1504,1547,1549,1607 'blueprintprincip':11,108,148,337,380,665,722,971,1170,1232,1293,1432,1554 'bodi':275,315,626,647,696,709,746,772 'browser':1087 'browser-bas':1086 'c000':988 'call':262 'cannot':405 'capabl':55 'captur':617 'carri':473 'case':808 'categori':1640 'caus':1369,1465 'certif':377 'check':622,719 'claim':867,1279 'cli':471,1362 'client':164,489,529,533,535,539,588,822,907,1341,1377,1476,1599 'client-secret':906 'clientid':1067 'clientsecretcredenti':520,522 'code':1627 'concept':363 'conceptu':327 'configur':22,158,245,791,1605,1622 'connect':493,503 'connect-mggraph':492,502 'consent':1090,1103,1257,1269,1273,1447,1566,1572 'consenttyp':1071 'contain':135,838 'container':888 'content':557,1579 'content-typ':556 'core':564,1561 'creat':50,149,342,392,568,664,667,674,731,1165,1169,1173,1225,1231,1234,1292,1299,1556 'creation':426,582 'credenti':159,375,409,490,521,790,805,809,821,828,926,1312,1378,1477,1538,1544 'credential.get':542 'cross':31,183,1105,1121,1157,1420,1591 'cross-ten':30,182,1104,1120,1156,1419,1590 'crud':1243 'current':236,279,298 'currentus':453 'datetim':1042,1044 'datetime.now':1048 'day':1051 'dedic':249,485 'defaultazurecredenti':466 'defin':369 'delay':1438 'deleg':211,497,500,959,1037,1102,1199,1253 'delegatedpermissiongrant.readwrite.all':1251 'delet':1203,1206,1209,1211 'deploy':188 'descript':364 'detail':910 'dev':825,1346,1602 'develop':97,435 'diagnos':214 'dict':591 'direct':258,1574 'directory.accessasuser.all':474,1368 'displaynam':627,747 'distinct':68,865 'doc':280 'docker/kubernetes':1630 'document':231,271,291,301,1636 'dt':1056 'embed':898 'endpoint':277,317,575,1164,1303,1623 'entra':2,7,36,47,84,130,191,303,309,429,830,1451,1617,1660 'entra-agent-id':1 'eq':984 'error':217,1464 'even':723 'everi':63,1331 'evolv':326 'exampl':1159 'exchang':26,114,120,178,850,933,1118,1129,1391,1404,1473,1587 'exist':693,728,1553,1569 'expiri':1047,1082 'expirytim':1081 'explicit':343,496 'exponenti':1286 'expos':1458 'extern':1641 'f':553,632,640,702,757,765,979,1011,1061 'fail':1407 'feder':378,819,924,1147,1338 'fic':160,1179 'file':1578 'filter':982 'fix':1466 'flow':187,1422 'fmi':27,118,174,848,1374,1479,1585 'forc':454 'found':1150 'full':1155 'gap':1637 'get':66,1189 'github.com':942,1670 'github.com/azuread/microsoft-identity-web':941 'github.com/azuread/microsoft-identity-web/blob/master/src/microsoft.identity.web.agentidentities/readme.agentidentities.md':1669 'give':860 'go':201,894 'grant':77,203,946,962,1191,1198,1248,1252,1255,1387,1424,1474,1510,1524,1573 'grant-typ':1386 'graph':20,62,89,240,260,323,547,641,703,766,857,976,980,1003,1012,1026,1062,1074,1220,1332,1500 'graph.microsoft.com':91,545,549,634,759,1217 'graph.microsoft.com/.default':544 'graph.microsoft.com/v1.0':90,548,1216 'graph.microsoft.com/v1.0/users/':633,758 'group':414,743 'guid':257,1648,1654 'h':1057 'handl':923,1434 'hard':480,1370 'hard-reject':479 'header':551,590,643,644,705,706,768,769,990,991,1018,1019,1064,1065 'helper':125,128 'hold':374,406,804,1321 'home':1136,1416,1493 'host':818 'http':842 'id':4,49,86,216,238,300,305,524,528,530,534,604,614,637,654,659,661,699,755,762,780,782,1016,1024,1028,1033,1070,1076,1184,1196,1208,1213,1270,1506,1646 'idempot':717 'ident':9,17,44,56,69,96,99,111,145,154,162,207,251,330,345,354,359,379,394,399,417,423,434,437,463,477,570,733,738,799,801,813,820,856,925,950,952,967,1097,1108,1134,1148,1175,1188,1205,1236,1240,1318,1337,1366,1414,1428,1491,1528,1541 'identifieruri':1349 'ietf':1383 'implement':169 'import':514,519,599,601,1043 'includ':33,1277,1325 'independ':74 'independently-scop':73 'individu':1405,1513 'ingress':1462 'instal':320,449,460 'install-modul':448 'instanc':15,65,152,352,404,751,863 'instead':1305 'instruct':307 'interact':443 'java':202,895 'json':645,707,770,992,1020,1066 'keep':1449 'learn':234,296 'learn.microsoft.com':1650,1657,1665 'learn.microsoft.com/en-us/entra/agent-id/identity-platform/agent-id-ai-guided-setup':1656 'learn.microsoft.com/en-us/entra/agent-id/identity-platform/agent-id-setup-instructions':1649 'learn.microsoft.com/en-us/entra/msidweb/agent-id-sdk/overview':1664 'link':1642 'list':1186 'live':1313 'loadbalanc':1460 'local':824,1345,1601 'localhost':1456 'm':1055,1058 'mail.send':1080 'make':713 'manag':52,161,812,927 'mandatori':666 'manifest':1631 'match':1146 'may':739,1275 'mcp':224,228,230,252,268,270,288,290 'method':1163 'mggraph':494,504 'mi':903,1595 'microsoft':6,19,35,46,61,83,88,129,190,233,259,295,302,308,829,1616,1659 'microsoft.graph.applications':451 'microsoft.identity.web.agentidentities':126,921,1667 'miss':1509 'model':105,328 'modul':450 'multi':1113 'multi-ten':1112 'must':340,577,1130 'my-agent-inst':748 'net':124,914,918,1668 'never':1359,1457 'new':143,1278 'next':998 'node':200,893 'o':615 'oauth':23,53,1385 'oauth2':1355,1610 'oauth2permissiongrants':212,1099,1519,1533 'obj':658 'object':104,367,1246 'obo':29,123,181,875,961,1039,1496,1589,1613 'odata':561,1327 'odata-vers':560,1326 'odata.type':1310 'one':333,349,431 'oper':1162 'option':806 'organ':1638 'os':515 'os.environ':525,531,537 'output':618 'packag':938 'param':1384 'parent':851,1127,1484 'partial':1571 'password':827 'path':28,119,175,849,916,1375,1480,1586 'pattern':1628 'per':14,151,205,334,350,854,948,965,1426 'per-agent-ident':204,853 'per-inst':13,150 'permiss':76,213,947,956,960,973,1038,1193,1200,1221,1222,1250,1254,1261,1266,1425,1436 'permission-propag':1435 'pip':459 'polyglot':127,197,834,889 'post':1167,1171,1176,1182,1194,1201 'powershel':263,442,445,446,499,501 'practic':1289 'prerequisit':427 'princip':339,382,397,677,686,1550 'principalid':1021 'produc':681 'product':815,1340,1597 'programmat':456,1101 'propag':1437 'properti':80 'propertynotcompatiblewithagentident':223,1323,1534 'provis':5,141,457,715 'purpos':1223 'put':1543 'python':199,265,455,511,513,594,598,694,744,892,975,1040 'python/typescript':1629 'queri':613 'quick':78,915 'r':999,1001,1007 'rais':1034,1083 'raw':1307 'read':996,1031 'read/update':1228,1238 'readm':939 'record':1149 'refer':79,1161,1577 'references/known-limitations.md':1634,1635 'references/oauth2-token-flow.md':912,913,1593,1594 'references/obo-blueprint-setup.md':884,885,1603,1604 'references/runtime-token-exchange.md':872,873,1152,1153,1580,1581 'references/sdk-sidecar-deployment.md':1624,1625 'references/sdk-sidecar.md':900,901,1614,1615 'registr':487 'reject':481 'request':266,274,314,464,516,587,602,1333 'requestdeni':1522 'requests.get':978 'requests.post':639,701,764,1010,1060 'requir':93,424,428,1219,1258 'resolut':1357 'resourc':1643 'resourceid':1025,1073 'resp':638,700,763 'resp.json':652,777 'resp.raise':648,710,773 'respons':420 'retri':1284,1439 'return':1392 'rfc':1380,1469 'role':94,430 'run':282 'runtim':113,176,783,788 'scope':75,452,498,505,964,1077,1356,1398,1406,1514 'script':716 'sdk':37,131,192,244,310,321,831,897,1452,1618,1626,1661 'search':232,294 'second':1283 'secret':165,376,536,540,823,908,1342,1600 'secrets/certs':1322 'secur':1632 'see':871,883,899,911,936,1151 'server':253 'servic':82,338,381,396,676,919 'service-principal-on':395 'set':1348 'setup':239,306,444,909,1647,1655 'shape':242,325 'show':612 'sidecar':40,134,195,837,891 'sign':609 'signed-in-us':608 'signinaudi':1115 'singl':402 'skill':140,256 'skill-entra-agent-id' 'skip':678 'snippet':584 'source-microsoft' 'sp':109,112,346,355,360,695,708,779,977,1004,1015,1023,1027,1069,1075,1542,1567 'sponsor':410,576,734 'sponsors@odata.bind':631,756 'src/microsoft.identity.web.agentidentities':945 'start':285 'status':650,712,775,1036,1085 'stdout.strip':624 'step':117,173,566,662,680,729,847,932,1123,1401,1409,1482,1557,1584 'strftime':1053 'sub':866 'subprocess':600 'subprocess.run':605 'support':469,953 'sz':1059 'target':1131,1411,1486,1489,1499 'tasks.readwrite':1079 'tenant':32,184,388,523,527,1106,1114,1122,1137,1143,1158,1417,1421,1488,1494,1592 'test':826 'text':620 'timedelta':1045,1050 'timezon':1046 'timezone.utc':1049 'today':254 'token':25,177,186,472,541,543,840,852,858,1119,1128,1274,1363,1390,1472,1485,1498 'token-exchang':1389,1471 'token.token':555 'tool':225,226,292 'topic-agent-skills' 'trail':71,870 'tri':1535 'troubleshoot':1463,1633 'true':619,621,623 'tsv':616 'two':116,172,846,931,1583 'two-step':115,171,845,930,1582 'type':558,574,1302,1388 'type/class':371 'type/project':336 'url':1091,1215,1644 'urn':1382 'use':41,60,138,227,267,286,483,572,789,807,920,1098,1301,1335,1360,1373,1396,1468,1475,1503,1512,1515 'user':412,579,603,611,636,741,761,882,995,1030,1497 'user.read':510,1078 'user.read.all':1009 'valu':81,993,1008 'verifi':273,313,1518 'version':322,562,1328 'via':18,1459,1530,1575 'wif':814,904,1596 'work':1094 'workflow':565,1562 'workload':1336 'wrong':1142,1487 'y':1054","prices":[{"id":"2af71434-3434-45db-bbb8-62a57fc560bc","listingId":"5a18b943-256f-4b1f-8819-7811a728c15b","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"microsoft","category":"azure-skills","install_from":"skills.sh"},"createdAt":"2026-04-29T18:53:12.770Z"}],"sources":[{"listingId":"5a18b943-256f-4b1f-8819-7811a728c15b","source":"github","sourceId":"microsoft/azure-skills/entra-agent-id","sourceUrl":"https://github.com/microsoft/azure-skills/tree/main/skills/entra-agent-id","isPrimary":false,"firstSeenAt":"2026-04-29T18:53:12.770Z","lastSeenAt":"2026-05-18T18:53:17.156Z"},{"listingId":"5a18b943-256f-4b1f-8819-7811a728c15b","source":"skills_sh","sourceId":"microsoft/azure-skills/entra-agent-id","sourceUrl":"https://skills.sh/microsoft/azure-skills/entra-agent-id","isPrimary":true,"firstSeenAt":"2026-05-01T23:40:14.952Z","lastSeenAt":"2026-05-07T22:40:14.363Z"}],"details":{"listingId":"5a18b943-256f-4b1f-8819-7811a728c15b","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"microsoft","slug":"entra-agent-id","github":{"repo":"microsoft/azure-skills","stars":1014,"topics":["agent-skills"],"license":"mit","html_url":"https://github.com/microsoft/azure-skills","pushed_at":"2026-05-18T14:38:04Z","description":"Official agent plugin providing skills and MCP server configurations for Azure scenarios.","skill_md_sha":"5aaf917945171757112bdb341fb593b4517542cd","skill_md_path":"skills/entra-agent-id/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/microsoft/azure-skills/tree/main/skills/entra-agent-id"},"layout":"multi","source":"github","category":"azure-skills","frontmatter":{"name":"entra-agent-id","license":"MIT","description":"Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Azure RBAC (use azure-rbac), Microsoft Foundry agent authoring (use microsoft-foundry)."},"skills_sh_url":"https://skills.sh/microsoft/azure-skills/entra-agent-id"},"updatedAt":"2026-05-18T18:53:17.156Z"}}