Microsoft Entra Agent ID

Microsoft Entra Sdk For Agent Identities

14 August 2026Updated+6 / −6 lines

In brief

The documentation now identifies app-only tokens as using client credentials, expands on-behalf-of to OBO, and consistently uses the `agent-identity-client-id` placeholder in request examples.

What Entra admins need to know

This improves clarity when configuring or reviewing agent identity requests. No product behavior change or required administrative action is indicated.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Specify the downstream API by including its name in the request URL based on your Microsoft Entra ID Auth SDK (sidecar) configuration. The authorization header endpoint takes the format `/AuthorizationHeader/{serviceName}` where `serviceName` is the name of the downstream API configured in the SDK settings.

To acquire an ~~app~~ app-only (client credentials) token for an autonomous agent, you provide the agent identity client ID in the request.
```
GET /AuthorizationHeader/Graph?AgentIdentity=<agent-id-identity-client-IDid>
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGc...
```
To acquire token for an autonomous agent's user account, provide either the user object ID or User Principal Name but not both. This means providing either AgentUsername or AgentUserId. Providing both causes a validation error. You must also provide the AgentIdentity to specify which agent identity to use for token acquisition. If the agent identity parameter is missing, the request fails with a validation error.
```
GET /AuthorizationHeader/Graph?AgentIdentity=<agent-id-identity-client-id>&AgentUserId=<agent-user-object-id>
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGc...
```
```
GET /AuthorizationHeader/Graph?AgentIdentity=<agent-id-identity-client-id>&AgentUsername=<agent-user-principal-name>
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGc...
```
For interactive agents, use the on-~~behalf~~ behalf-of (OBO) flow. The agent first validates the user token granted to it before acquiring the resource token to call the downstream API.

Agent web API receives user token from the calling application and validates the token via the Microsoft Entra ID Auth SDK (sidecar) /Validate endpoint Acquire token for downstream APIs by calling /AuthorizationHeader with only the AgentIdentity and the incoming authorization header Authorization: Bearer

Step 2: Get authorization header on behalf of the user

GET /AuthorizationHeader/Graph?AgentIdentity= ~~Authorization: Bearer~~

Authorization: Bearer

@@ -51,26 +51,26 @@ These are the steps to acquire tokens using the Microsoft Entra ID Auth SDK (sid      Specify the downstream API by including its name in the request URL based on your Microsoft Entra ID Auth SDK (sidecar) configuration. The authorization header endpoint takes the format `/AuthorizationHeader/{serviceName}` where `serviceName` is the name of the downstream API configured in the SDK settings. -1. To acquire an app only token for an autonomous agent, you provide the agent identity client ID in the request.+1. To acquire an app-only (client credentials) token for an autonomous agent, you provide the agent identity client ID in the request.      ```bash-    GET /AuthorizationHeader/Graph?AgentIdentity=<agent-id-client-ID>+    GET /AuthorizationHeader/Graph?AgentIdentity=<agent-identity-client-id>     Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGc...     ```  1. To acquire token for an autonomous agent's user account, provide either the user object ID or User Principal Name but not both. This means providing either `AgentUsername` or `AgentUserId`. Providing both causes a validation error. You must also provide the `AgentIdentity` to specify which agent identity to use for token acquisition. If the agent identity parameter is missing, the request fails with a validation error.      ```bash-    GET /AuthorizationHeader/Graph?AgentIdentity=<agent-id-client-id>&AgentUserId=<agent-user-object-id>+    GET /AuthorizationHeader/Graph?AgentIdentity=<agent-identity-client-id>&AgentUserId=<agent-user-object-id>     Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGc...     ```      ```bash-    GET /AuthorizationHeader/Graph?AgentIdentity=<agent-id-client-id>&AgentUsername=<agent-user-principal-name>+    GET /AuthorizationHeader/Graph?AgentIdentity=<agent-identity-client-id>&AgentUsername=<agent-user-principal-name>     Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGc...     ``` -1. For interactive agents, use the on-behalf of flow. The agent first validates the user token granted to it before acquiring the resource token to call the downstream API.+1. For interactive agents, use the on-behalf-of (OBO) flow. The agent first validates the user token granted to it before acquiring the resource token to call the downstream API.      Agent web API receives user token from the calling application and validates the token via the Microsoft Entra ID Auth SDK (sidecar) `/Validate` endpoint     Acquire token for downstream APIs by calling `/AuthorizationHeader` with only the `AgentIdentity` and the incoming authorization header@@ -81,7 +81,7 @@ These are the steps to acquire tokens using the Microsoft Entra ID Auth SDK (sid     Authorization: Bearer <user-token>          # Step 2: Get authorization header on behalf of the user-    GET /AuthorizationHeader/Graph?AgentIdentity=<agent-client-id>+    GET /AuthorizationHeader/Graph?AgentIdentity=<agent-identity-client-id>     Authorization: Bearer <user-token>     ```