Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →microsoft/entra-agent-id
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app regist
Passed 23 of 23 test cases with the skill, and 8 of 23 without it.
and 24 more in the full report
15 fixed8 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 15 test cases the skill fixed. Same model, same prompt, with and without the skill.
My Agent Identity Blueprint is configured for multi-tenant use. An agent instance is running in a customer's tenant (Tenant B), while the Blueprint is in my tenant (Tenant A). When performing step 1 of the parent token exchange, which tenant ID should I target in the URL?
| Checked | Without skill | With skill |
|---|---|---|
| Targets the Agent Identity's home tenant | Missed | Passed |
The instructions your model reads when the skill loads.
Create and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.
| Property | Value |
|---|---|
| Service | Microsoft Entra Agent ID |
| API | Microsoft Graph (https://graph.microsoft.com/v1.0) |
| Required role | Agent Identity Developer, Agent Identity Administrator, or Application Administrator |
| Object model | Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) |
| Runtime exchange | Two-step fmi_path exchange (autonomous and OBO) |
| .NET helper | Microsoft.Identity.Web.AgentIdentities |
| Polyglot helper | Microsoft Entra SDK for AgentID (sidecar container) |
fmi_path runtime token exchange (autonomous or OBO)appRoleAssignments) or delegated (oauth2PermissionGrants) permissionsAADSTS82001, AADSTS700211, or PropertyNotCompatibleWithAgentIdentity| Tool | Use |
|---|---|
mcp_azure_mcp_documentation | Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration |
There is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python requests). Use mcp_azure_mcp_documentation to verify request bodies and endpoints against current docs before running.
Use the mcp_azure_mcp_documentation tool to search Microsoft Learn for current Agent ID documentation:
test cases passed, vs 8 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.