entra-agent-id
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
Profile →npx skills add microsoft/azure-skills --skill entra-agent-id --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Microsoft Entra Agent ID Create and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants. ## Quick Reference | Property | Value | |----------|-------| | Service | Microsoft Entra Agent ID | | API | Microsoft Graph (`https://graph.microsoft.com/v1.0`) | | Required role | Agent Identity Developer, Agent Identity Administrator, or Application Administrator | | Object model | Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) | | Runtime exchange | Two-step `fmi_path` exchange (autonomous and OBO) | | .NET helper | `Microsoft.Identity.Web.AgentIdentities` | | Polyglot helper | Microsoft Entra SDK for AgentID (sidecar container) | ## When to Use This Skill - Provisioning a new Agent Identity Blueprint and BlueprintPrincipal - Creating per-instance Agent Identities under a Blueprint - Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint - Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO) - Cross-tenant agent token flows - Deploying the Microsoft Entra SDK for AgentID sidecar for polygl
- Quick Reference
- When to Use This Skill
- MCP Tools
- Before You Start
- Conceptual Model
- Prerequisites
- Required Entra Roles
- PowerShell (interactive setup)
- Python (programmatic provisioning)
- Authentication
- PowerShell (delegated)
- Python (application)
- Core Workflow
- Step 1: Create Agent Identity Blueprint
pip install azure-identity requests az ad app permission admin-consent --id <client-id>
What does the entra-agent-id skill do?
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
How do I install it?
Run `npx skills add microsoft/azure-skills --skill entra-agent-id --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From microsoft/azure-skills, a repository with 1,353 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.