entra-agent-id

# Microsoft Entra Agent ID Create and manage OAuth2-capable identities for AI agents using Microsoft Graph beta API. > **Preview API** — All Agent Identity endpoints are under `/beta` only. Not available in `/v1.0`. ## Before You Start Search `microsoft-docs` MCP for the latest Agent ID documentation: - Query: "Microsoft Entra agent identity setup" - Verify: API parameters match current preview behavior ## Conceptual Model ``` Agent Identity Blueprint (application) ← one per agent type/project └── BlueprintPrincipal (service principal) ← MUST be created explicitly ├── Agent Identity (SP): agent-1 ← one per agent instance ├── Agent Identity (SP): agent-2 └── Agent Identity (SP): agent-3 ``` ## Prerequisites ### PowerShell (recommended for interactive setup) ```powershell # Requires PowerShell 7+ Install-Module Microsoft.Graph.Beta.Applications -Scope CurrentUser -Force ``` ### Python (for programmatic provisioning) ```bash pip install azure-identity requests ``` ### Required Entra Roles One of: **Agent Identity Developer**, **Agent Identity Administrator**, or **Application Administrator**. ## Environment Variables ```bash AZURE_TENANT_ID=<your-tenant-id> AZURE_CLIENT_ID=<app-registration-client-id> AZURE_CLIENT_SECRET=<app-registration-secret> ``` ## Authentication > **⚠️ `DefaultAzureCredential` is NOT supported.** Azure CLI tokens contain > `Directory.AccessAsUser.All`, which Agent Identity APIs explicitly reject (40...