Benefits of Entra Agent ID for Microsoft Foundry Agents

Your Foundry agent just did something odd, and the audit log blames the project's shared identity. That is the day per-agent identity stops sounding like paperwork.

Here are the benefits of Entra Agent ID for Microsoft Foundry agents over shared service principals and API keys, and which parts need a license.

How Entra Agent ID works for a Foundry agent

Agent ID adds two directory objects: a blueprint, the template for a class of agents, and an agent identity, a special service principal for one agent (Foundry agent identity concepts). New Foundry agents get their own blueprint and identity by default. Older "legacy" agents share one project identity, with no in-place upgrade: you recreate the agent from the same definition.

Check which kind you have:

GET {endpoint}/agents/<agent-name>?api-version=2025-11-15-preview
Authorization: Bearer <token>
Foundry-Features: AgentEndpoints=V1Preview

A null instance_identity means a legacy agent on the shared project identity.

Per-agent identity makes least privilege real

A shared identity accumulates every agent's permissions. With one identity each, the invoice reader gets blob access and the FAQ bot gets none. An agent identity is a service principal, so ordinary Azure RBAC applies.

az role assignment create \
    --assignee "<agentIdentityId>" \
    --role "Storage Blob Data Contributor" \
    --scope "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>"

Find <agentIdentityId> in the Entra admin center under Entra ID > Agent ID > All agent identities. Roles on the shared project identity don't carry over, so grant only what the new agent needs.

No stored keys behind tool calls

The blueprint trusts the project's managed identity through a federated credential, so no client secret or certificate sits in the blueprint. At runtime, Agent Service gets a token for the agent identity, then one scoped to the downstream service, which checks that agent's role assignments.

MCP servers and A2A endpoints use the AgenticIdentityToken auth type in the project connection. Two catches: the audience must be the downstream resource, such as https://storage.azure.com, not the MCP server's URL, and only some tools support agent identity auth today.

Conditional Access for agents blocks the ones you didn't approve

Conditional Access runs when Entra issues or refreshes a token, so a policy can block a request before the agent gets in. Conditional Access for agents can target an agent identity, a blueprint (which also covers identities created from it later) or custom security attributes. To block every agent except reviewed ones, tag approved agents with an attribute such as AgentApprovalStatus, then create a policy:

1. Under Users, agents or workload identities, choose Agents, include All agent identities, and exclude agents whose attribute contains HR_Approved.
2. Target All resources, set Grant to Block, and start in Report-only.

Two edges: when an agent acts on behalf of a signed-in user, the policy evaluates the user, not the agent, and an agent that calls a resource with an API key skips Entra entirely.

Risky-agent signals and a kill switch

ID Protection for agents flags anomalies such as unfamiliar resource access and sign-in spikes. In the Risky Agents report you can confirm compromise, which sets risk to High and trips any policy that blocks on High agent risk, or disable the agent to stop all its sign-ins.

Detections are currently offline, so they arrive after the fact, and risk from on-behalf-of flows is attributed to the user.

Sponsors give every agent an owner of record

Every agent identity and blueprint needs at least one sponsor, a business person accountable for the agent's purpose. Sponsors can disable or soft-delete an agent but can't re-enable it, which is a sane split for an incident at 2 a.m.

What is GA, what is preview, and what it costs

• Agent ID platform: generally available, open to all Entra customers.
• Conditional Access for agents: needs Microsoft 365 E7, or an Agent 365 license plus at least Entra P1 or Microsoft 365 E3. Agent risk-based policies add Entra P2 or Microsoft 365 E5.
• ID Protection for agents and the Agent risk condition: Preview, and Learn says an Agent 365 license will soon be required.

When Entra Agent ID is not worth the effort

A single-agent prototype in a dev project doesn't need most of this. It adds little if your tools authenticate with keys, since Conditional Access can't see those calls. Revisit it when a second agent arrives or the first one touches customer data.

If you ship agents into someone else's enterprise, per-agent identity turns "something in the project did it" into a name you can scope, block and hand to an accountable sponsor.