entra-agent-id
Official sourceProvisions Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance agent identities via Graph, wiring OAuth fmi_path token exchange and per-agent permissions.
Source: Microsoft
At a glance
Verified source- Best for
- Provisioning Agent Identity Blueprints and per-instance agent identities
- Works with
- GitHub Copilot · Claude Code
- Outcome
- Configuring fmi_path token exchange (autonomous, OBO, cross-tenant)
- Source
- microsoft/github-copilot-for-azure
01 / Understand the skill
About entra-agent-id
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Azure RBAC (use azure-rbac), Microsoft Foundry agent authoring (use microsoft-foundry).
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar.
Not a fit when
DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Azure RBAC (use azure-rbac), Microsoft Foundry agent authoring (use microsoft-foundry).
Read full description
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Azure RBAC (use azure-rbac), Microsoft Foundry agent authoring (use microsoft-foundry).
02 / Confirm the fit
Use entra-agent-id when you need to
- Provisioning Agent Identity Blueprints and per-instance agent identities
- Configuring fmi_path token exchange (autonomous, OBO, cross-tenant)
- Granting per-agent application or delegated Graph permissions
- Deploying the Entra AgentID sidecar for polyglot agents
03 / See the workflow
How entra-agent-id works
- 01Install: npx skills add https://github.com/microsoft/github-copilot-for-azure --skill entra-agent-id
- 02Try: Create an Agent Identity Blueprint and two agent instances with User.Read.All app permission.
- 03Get: Graph API calls creating the blueprint, principal, identities, and scoped permission grants.
Check before installing
Compatible platforms
GitHub Copilot · Claude Code
Best fit
Provisioning Agent Identity Blueprints and per-instance agent identities
Review the source instructions if the required output differs from the formats described above.
Install and use
Compatible with GitHub Copilot and Claude Code · Published by Microsoft
Ready to add entra-agent-id?
Use the published instructions below, then provide the required input and describe the result you need.
General instructions · GitHub Copilot · Claude Code
npx skills add https://github.com/microsoft/github-copilot-for-azure --skill entra-agent-id
Review the source repository and license before installing third-party skills.
Continue exploring
Similar skills
Deploys and manages Vercel projects using token-based auth read from the environment, covering deploy, env vars, domains, and inspection without interactive login.
Guides Microsoft Entra ID app registration, OAuth 2.0 setup, API permissions, client credentials, and MSAL integration via portal, CLI, or Bicep.
Runs Azure compliance and security audits with azqr plus Key Vault expiration checks, classifying findings by priority and proposing remediation across resources and certs.
Finds the least-privilege Azure RBAC role for an identity and generates the CLI commands and Bicep to assign it, including custom role definitions when no built-in fits.