Agent verification provider
Microsoft Entra Agent ID
In short
Microsoft Entra Agent ID treats an agent as a service principal that holds no credentials of its own: a blueprint issues the federated credentials it authenticates with, and passwords, SMS codes and passkeys play no part. A sponsor, a person or group, answers when something goes wrong. Tokens are valid only in the tenant that made the identity.
- Type
- Verification provider
- Operator
- Microsoft
- Homepage
- learn.microsoft.com
- In one line
- Microsoft's identity service for AI agents inside an Entra tenant: each agent gets its own service principal created from a blueprint, with tokens, a human sponsor and audit, for agents an organisation runs rather than agents visiting a website.
- Last read
- 2026-11-05
What Microsoft Entra Agent ID does for this layer
From the vendor's own pages
Microsoft defines an Entra agent identity as a special service principal in Microsoft Entra ID that an agent identity blueprint creates and is authorised to impersonate. (learn.microsoft.com) Microsoft Entra agent identities hold no credentials of their own and authenticate only through federated identity credentials issued by the blueprint, which holds certificates, keys, client secrets or federated credentials. (learn.microsoft.com) Microsoft states that AI agents in Entra do not use passwords, SMS, passkeys or authenticator apps to authenticate. (learn.microsoft.com) An Entra agent identity can request tokens where it is the subject, receive tokens where it is the audience, and request user tokens where a user is the subject and the agent is the actor. (learn.microsoft.com)
Each Entra agent identity can carry a sponsor, the human user or group accountable for the agent, who is contacted in a security incident. (learn.microsoft.com) Entra agent identities can receive tokens only in the tenant where they were created, while a blueprint can be multitenant and create tenant-local agent identities in each tenant that adds it. (learn.microsoft.com) Some Entra agents get a second, optional agent's user account, a tenant user account marked as an AI agent and tied one-to-one to the agent identity, for systems that require a user account. (learn.microsoft.com)
Products and plans
| Product | What it does | Price model | From | As of |
|---|---|---|---|---|
| Microsoft Entra Agent ID | Agent identities, blueprints, sponsors and agent user accounts in Microsoft Entra, managed in the admin center or through Microsoft Graph. | |||
Standards
| Standard | Status | Evidence |
|---|---|---|
| Web Bot Auth | No statement | The agent identity overview covers Entra tokens only and does not mention signing HTTP requests to third-party websites (checked 2026-11-05). |
Our checks
| Check | Result | Method | Date |
|---|---|---|---|
| Homepage fetch | HTTP 200 | GET with the crawl user agent after a robots.txt check | 2026-11-05 |
What Microsoft Entra Agent ID does not do
- Microsoft Entra Agent ID does not let an outside website verify a visiting agent; its tokens are issued and accepted inside Entra tenants.
- Microsoft Entra Agent ID gives an agent no way to sign requests to third-party websites; the overview lists only requesting tokens, receiving tokens and on-behalf-of user tokens.
Reading notes
Microsoft as a crawler operator, with Bingbot, MicrosoftPreview and Copilot Actions, has its own profile; this one covers the Entra identity product only.
Related pages on this site
Sources
Last reviewed 2026-11-05