Microsoft Entra Agent ID extends Microsoft Entra to AI agents. As of 17 October 2026, Microsoft's overview describes it as "an identity and security framework that extends Microsoft Entra capabilities to AI agents". Teams searching for Entra Agent ID alternatives rarely want to replace their identity provider. Most want to know what Agent ID covers, what it costs to extend Entra security to agents, and whether they need another layer for what agents do after they have a token. This guide answers those questions. Other vendor guides are on the comparison hub.

What Microsoft Entra Agent ID covers (as of 17 October 2026)

From Microsoft's documentation:

  • Agent identities. Agent identities are identity accounts within Microsoft Entra ID that identify and authenticate AI agents. Microsoft separates them from application identities, which expect long-term stability, and from human user identities. Where an agent must act like a user, it can be paired with an agent's user account.
  • Blueprints. Agent identity blueprints are templates for creating agent identities with parent-child relationships, so one policy can apply to many agents.
  • Access patterns. An agent can act on its own access rights (autonomous access) or on rights a user delegates to it (delegated access). It can request tokens for Microsoft Graph, your own services and third-party services.
  • Protocols and platforms. The overview says the platform supports OAuth 2.0, the Model Context Protocol and agent-to-agent (A2A). It works with agents built on other platforms, such as AWS Bedrock and n8n, through the Microsoft Entra ID Auth SDK sidecar or workload identity federation.
  • Built-in adoption. Each agent created in Copilot Studio gets an agent identity in the tenant, and its creator is recorded as its sponsor.
  • Logging. Microsoft states that all agent authentication and activity is logged for compliance and audit.

Security features sit on top of the identity:

  • Conditional Access for agents extends the Conditional Access policy engine to agents. It can allow, block or limit access, or require more verification steps, using agent, user, device, location and risk signals.
  • ID Protection for agents detects identity-based risks on agents. Microsoft's page says that, at the time we checked, all risk detections for risky agents are offline.
  • Global Secure Access for agents applies web content filtering, threat intelligence filtering and network file filtering to the traffic of Copilot Studio agents.

Licensing

Microsoft states that Agent ID is available for all Microsoft Entra customers. Extending Entra security features to agents requires Microsoft Agent 365. Agent 365 is included with Microsoft 365 E7 and is available as an add-on to Microsoft E5, A5 and Business Premium, or to Microsoft Defender Suite with Microsoft Purview Suite. Conditional Access for agents requires Microsoft 365 E7, or an Agent 365 licence paired with at least Entra P1 or Microsoft 365 E3. Check current terms with Microsoft before you budget.

Where Entra Agent ID is strong

  • One directory for people and agents. Agents appear next to users and workloads, with sponsors, lifecycle governance and access packages in tools identity teams already use.
  • Copilot Studio by default. Agents built there get an identity without extra work.
  • Standard protocols. OAuth 2.0 tokens and support for MCP and A2A mean a resource can identify the calling agent with the same mechanisms it uses for applications.
  • Reach beyond Microsoft. Workload identity federation and the sidecar bring agents from other platforms into the same directory.

Agent ID is one part of Microsoft's wider agent-governance stack. Our post on Microsoft's agent governance stack and independent control planes covers that wider picture.

The question Entra Agent ID leaves to you

Microsoft's Conditional Access documentation is precise about where its decision sits: Conditional Access is evaluated whenever Entra ID issues or refreshes an access token, and some resources support Continuous Access Evaluation for near-real-time enforcement on specific events. After that, "the target resource validates the token and uses its claims to make authorization decisions."

That is the normal OAuth design, and it is sound. It also means the decision about each tool call belongs to whatever receives the token: an MCP server, an API, or a gateway in front of them. (For MCP servers, the guide to securing MCP servers covers that per-tool decision.) Three questions follow:

  1. Who decides this tool call with these arguments? A token says which agent is calling and for which audience. It does not say whether a refund of 5,000 is allowed when a refund of 50 is.
  2. Who holds a risky call for a person? Step-up for a user at sign-in is different from a person approving one agent action before it runs.
  3. Who keeps the record of the decision? Sign-in and activity logs record authentication. A record of authorization decisions on tool calls is a different artifact.

Our explainer on machine, workload and agent identity covers why identity and per-action authorization are separate layers.

Alternatives and complements

What you need Category Examples covered on this site
Agent identity inside your existing Microsoft directory IdP extension Microsoft Entra Agent ID
Agent identity tied to a CIAM or developer auth platform Agentic identity platform Descope and WorkOS
Secretless access between workloads and the services they call Workload identity Aembit
Inventory and posture for non-human identities across vendors NHI security Astrix Security, Oasis Security
Tool-call decisions, approvals and a signed decision record Agent control plane Praesidia

For a Microsoft-centred estate, the realistic choice is rarely Entra Agent ID or something else. It is Entra Agent ID plus whatever other layers your design needs.

Where Praesidia fits

Praesidia is our product. It is an AI agent control plane, not an identity provider. Human sign-in to Praesidia supports SSO (SAML/OIDC) and SCIM 2.0 on Enterprise. What it does for agents:

  • Credentials per agent. Each registered app, agent and MCP server gets its own credentials for authentication and attribution, independent of the humans who deployed it.
  • A decision on each governed tool call. The decision uses the agent's identity, the tool's permission on that connection and the arguments, and, on the Advanced tier and Enterprise, what the agent did just before. New policies start in observe mode; denials and holds apply once a policy is set to enforce.
  • Approvals. A step-up rule turns an MCP tool call into a durable approval request that expires if nobody answers. Approving a held call is in every plan; multi-step approval workflows are Enterprise.
  • Containment. Quarantine withdraws an agent's live task credentials and is reversible; revoking an identity is permanent.
  • Signed record. Praesidia records the decisions it makes in an append-only, hash-chained audit trail, signed under the default configuration; an operator can turn signing off. A signed record shows it was not changed afterwards. It does not show that every action was captured. Calls that do not pass through Praesidia are not recorded.

Ask any control plane, Praesidia included, how its agent identities map to the identities in your directory, so one agent is the same subject in both places. The identity and access guide covers the design.

Questions to ask in an evaluation

  1. Which of your agents are in Entra? Copilot Studio agents are there by default. Agents built on non-Microsoft platforms need the sidecar or workload identity federation.
  2. Which licences do you need? Agent ID alone, or Agent 365 for Conditional Access and other security features.
  3. Where is the per-call decision made? Name the component that decides each tool call for each agent path.
  4. How fast does a block take effect? Token lifetime and Continuous Access Evaluation support on the resource set how quickly a revoked or risky agent loses access.
  5. What evidence will an auditor get? Authentication logs, decision records, or both.

Common questions

What is Microsoft Entra Agent ID? It is a product within Microsoft Entra for creating and managing agent identities and agent identity blueprints. Agent identities are identity accounts in Entra ID built for AI agents.

Is Entra Agent ID free? Microsoft states that Agent ID is available for all Microsoft Entra customers. Extending Entra security features such as Conditional Access to agents requires Microsoft Agent 365. Check Microsoft's current pricing for your tenant.

Does Conditional Access check every agent request? Conditional Access is evaluated when Entra ID issues or refreshes an access token. Some resources support Continuous Access Evaluation for near-real-time enforcement on specific events. The resource that receives the token makes its own authorization decision on each request.

Does Praesidia replace Entra Agent ID? No. Praesidia is not an identity provider. It decides governed tool calls, holds risky MCP calls for approval and keeps a signed record of its decisions. Many teams use an IdP for identity and a control plane for actions.

Sources (as of 17 October 2026)