PlugWiki

Entra Agent ID Skill for Claude: Create and Secure Agent Identities

entra-agent-id guides your agent through creating Microsoft Entra Agent Identities and the OAuth token exchange they use at runtime, through Microsoft Graph.

Installs
342.5K
on skills.sh
Stars
1.6K
on GitHub
Files
6
besides SKILL.md
Updated
Oct 2026
last repo commit

entra-agent-id helps your agent create an Agent Identity Blueprint, its BlueprintPrincipal and per-instance Agent Identities with Microsoft Graph. It then sets up credentials on the Blueprint, grants permissions per agent, and configures the two-step fmi_path token exchange, including on-behalf-of and cross-tenant cases.

It needs an Entra role (Agent Identity Developer, Agent Identity Administrator or Application Administrator) and several Graph permissions with admin consent. Azure CLI tokens are rejected by the Agent ID APIs, so you need a dedicated app registration. There is no Agent Identity MCP server, so it calls Graph directly from PowerShell or Python.

Good for

  • Developers giving each AI agent its own Entra identity and audit trail
  • Identity admins setting up Blueprints, sponsors and per-agent permissions
  • Teams adding the Entra SDK for AgentID sidecar to Python, Node, Go or Java agents

Install entra-agent-id

Claude Code

  1. 1

    Copy this prompt.

    Install the entra-agent-id skill in Claude Code. Run this command:

/plugin install azure@claude-plugins-official

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js 18+, Azure CLI signed in with az login.

The plugin installs the Azure skills together with the Azure MCP Server that these skills call. The README lists Node.js 18+ (npx starts the MCP servers) and the Azure CLI signed in with az login as prerequisites.

From the project README. Source.

What's in the skill

When it loads

Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).

Sections in SKILL.md

  1. Quick Reference
  2. When to Use This Skill
  3. MCP Tools
  4. Before You Start
  5. Conceptual Model
  6. Prerequisites
  7. Required Entra Roles
  8. PowerShell (interactive setup)
  9. Python (programmatic provisioning)
  10. Authentication
  11. PowerShell (delegated)
  12. Python (application)
  13. Core Workflow
  14. Step 1: Create Agent Identity Blueprint
  15. Step 2: Create BlueprintPrincipal
  16. Step 3: Create Agent Identities

Key facts

Author
Microsoft (metadata.author in SKILL.md)
License
MIT
Installs on skills.sh
342,504 as of 2026-11-02
GitHub stars
1,609 for the whole microsoft/azure-skills repo
skills.sh audits
Gen Agent Trust Hub pass, Socket warn, Snyk pass
What is inside
6 files besides SKILL.md (6 in references/)
Needs
An Entra role (Agent Identity Developer, Agent Identity Administrator or Application Administrator); Graph permissions with admin consent; PowerShell 7 with Microsoft.Graph.Applications or Python with azure-identity and requests; a dedicated app registration (Azure CLI tokens are rejected)
Part of plugin
azure
Last commit to the repo
2026-10-30

What it includes

  • The application that defines a type of agent

    POSTs to Graph at /applications/microsoft.graph.agentIdentityBlueprint with a user sponsor. SKILL.md says to use the typed endpoint.

    Try: “Create an Agent Identity Blueprint for my support agent and set me as sponsor.”

    Write · Create the Blueprint

  • Mandatory second step

    Not created automatically. Skipping it gives the error "The Agent Blueprint Principal for the Agent Blueprint does not exist."

    Write · Create the BlueprintPrincipal

  • One per agent instance

    Service-principal identities that cannot hold their own credentials. Sponsors can be users or groups.

    Write · Create Agent Identities

  • Managed identity with federation, or a client secret

    Workload Identity Federation is advised for production, client secrets for local development only.

    Write · Credentials on the Blueprint

  • Application or delegated grants

    Uses appRoleAssignments for autonomous access and oauth2PermissionGrants for on-behalf-of. Admin consent is done with `az ad app permission admin-consent`.

    Write · Grant permissions per identity

  • Two-step fmi_path flow

    Parent token first, then a Graph token per Agent Identity, with /.default scope. SKILL.md says not to use the RFC 8693 token-exchange grant.

    Network · Runtime token exchange

  • Auth container for Python, Node, Go, Java

    Reference files cover architecture and Docker or Kubernetes deployment. SKILL.md says to keep it on localhost.

    Runs code · Entra SDK for AgentID sidecar

  • DELETE calls in the API reference

    Listed in the API table for Agent Identities and Blueprints.

    Delete · Delete identities and Blueprints

  • AADSTS82001, AADSTS700211 and more

    Maps each error to its cause and fix, such as the wrong tenant on step 1 of a cross-tenant exchange.

    Read · Troubleshooting table

From the official docs

Permissions

High risk

The agent creates identities and grants Microsoft Graph permissions in your Entra tenant. Try it in a test tenant and review every grant before you approve it.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It creates identities and grants permissions

    Blueprints, Agent Identities and their Graph grants are real tenant objects. Use a test tenant and read each grant before you approve it.

  • Admin consent covers broad Graph permissions

    SKILL.md lists write permissions such as Application.ReadWrite.All and tells you to grant admin consent. Ask for the narrowest set that works.

  • It can delete Agent Identities and Blueprints

    The API table includes DELETE for both. Ask for a read-back of the target ID before any delete.

  • Example grants run for 10 years

    The sample delegated grant sets an expiry of 3650 days. Pick a shorter expiry for your tenant.

Technical details
Talks tograph.microsoft.com
Scopes

  • Calls Microsoft Graph to create and change applications, service principals and Agent Identities

  • Needs permissions such as AppRoleAssignment.ReadWrite.All and DelegatedPermissionGrant.ReadWrite.All

  • Can run az ad app permission admin-consent

Questions

What does entra-agent-id do?

It guides your agent through Microsoft Entra Agent ID: creating Blueprints, BlueprintPrincipals and Agent Identities, setting credentials, granting permissions and wiring the runtime token exchange.

How do I install it?

Use the install box at the top of this page, which has tabs for Claude Code, the Claude app and Codex. The install box uses the Azure plugin.

What permissions does it need?

One of the Entra roles Agent Identity Developer, Agent Identity Administrator or Application Administrator. It also lists Graph permissions such as AgentIdentityBlueprint.Create and AgentIdentity.Create.All, with admin consent for application permissions.

Can I use my Azure CLI login?

No. SKILL.md says DefaultAzureCredential is not supported, because Azure CLI tokens carry a scope that Agent Identity APIs reject with a 403. Use a dedicated app registration or Connect-MgGraph with explicit scopes.

Does it need an Agent ID MCP server?

No. SKILL.md says there is none today. It calls Microsoft Graph directly and uses one documentation tool to check current request shapes.

Can it delete identities?

The skill lists DELETE calls for Agent Identities and Blueprints in its API reference, so yes. Ask it to show the call before it runs.

Is it safe?

It creates identities and grants permissions in your Entra tenant, which is sensitive. Use a test tenant first and review each grant. See the audit results under key facts.

Information

updated Nov 2, 2026

Repository
microsoft/azure-skills
Folder
skills/entra-agent-id

microsoft/azure-skillsskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 3
  1. microsoft/azure-skills README · github.com
  2. entra-agent-id SKILL.md · github.com
  3. skills.sh listing and audits · skills.sh

Updated Nov 2, 2026.