Workload and agent identities — Conditional Access for service principals, CAE, and Microsoft Entra Agent ID
What can block a non-human identity's tokens, and how AI agents are modelled in Entra — Conditional Access for workload identities (single-tenant service principals, block by location or risk, Workload Identities Premium, no managed identities or groups), CAE for service principals, Entra Agent ID blueprints, agent identities and agent users, their token claims, role assignments with AgentServicePrincipal and AgentUser, and Agent ID error codes.
markdownreferencev1BN6D-5JZFstage: designtrust: officialservice: entrainterface: anyConditional Access workload identitiesAADSTS53003 service principalAccess has been blocked due to Conditional Access policies.Workload Identities Premiumservice principal riskservice principal sign-insConditional Access group service principal not enforcedmanaged identity Conditional Accesscontinuous access evaluation workload identitiescp1 client capabilityclaims challenge 401Microsoft Entra Agent IDagent identity blueprintagent identityagent user accountagent identity blueprint principalAgentServicePrincipalAgentUserxms_act_fctxms_sub_fctMicrosoftIdentityTokenCredentialAgent_Directory_QuotaExceededAgentIdentity_CredentialsNotSupportedAgentIdentity_IncompatibleParentTypeError_AgentIdentitiesCreatingAgentIdentitiesNotAllowedConditional Access for agents Agent 365
Workload and agent identities
Conditional Access for workload identities
A Conditional Access policy can block a service principal's token requests by location (outside allowed public IP ranges) or by service principal risk from ID Protection, or in combination with authentication contexts. The only grant control is Block.
- Scope: single-tenant service principals registered in your tenant, assigned to the policy directly. Policies assigned to a group don't apply to service principals in it. Multitenant and Microsoft apps aren't covered, and managed identities aren't covered at all.
- Licence: creating or changing these policies needs Workload Identities Premium; without it, existing policies keep working but can't be edited.
- Symptom: the token request fails with
AADSTS53003(BlockedByConditionalAccess); in Sign-in logs → Service principal sign-ins, the failure reason isAccess has been blocked due to Conditional Access policies.and the Conditional Access tab names the policy. - Fix as an agent: you can't satisfy it in code. Report the policy and the caller's egress IP to your human; for pipelines, run from an allowed network or a managed identity. Policies target the service principal's object ID from Enterprise applications, not the app registration's.
Continuous access evaluation (CAE) for workload identities: a client that declares the cp1 capability gets long-lived tokens (up to 24 hours) that Microsoft Graph revokes on events such as the service principal being disabled or high risk; the resource answers 401 with a claims challenge, and the client must request a new token with those claims. Only Microsoft Graph supports it, only for line-of-business single-tenant apps, not managed identities.
Microsoft Entra Agent ID
Agent ID models AI agents as directory objects:
| Object | What it is |
|---|---|
| Agent identity blueprint | An application-like template that holds the credentials (and permissions, app roles, token settings) for every agent of one kind |
| Agent identity blueprint principal | The blueprint's service principal in a tenant; it creates and manages agent identities through Microsoft Graph |
| Agent identity | A single-tenant service principal with an "agent" subtype. It has no credentials of its own: the blueprint acquires tokens on its behalf (federated credentials under the hood). Permissions and roles are granted to it |
| Agent's user account (optional) | A user object marked as an agent, for systems that require a user |
Agents act three ways: on behalf of a signed-in user (delegated), as the agent identity (app-only, autonomous), or as their agent user. Tokens carry xms_act_fct (actor facet), xms_sub_fct (subject facet), idtyp and xms_idrel to tell these apart.
Azure resources: give the agent identity Azure roles on the specific resources, like any service principal. The role assignment principalType enum now includes AgentServicePrincipal and AgentUser: set the matching value (reference/rbac/role-assignments-and-scopes.md). In code, Microsoft's samples use MicrosoftIdentityTokenCredential from Microsoft.Identity.Web.Azure (.NET) as the Azure SDK TokenCredential; @azure/identity 4.14.0 has no agent identity credential (checked in its type definitions). Agents built before Agent ID (older Copilot Studio and Foundry agents) use ordinary service principals.
Conditional Access for agents is separate from workload identity CA: it needs Microsoft 365 E7, or a Microsoft Agent 365 licence with Entra P1 or Microsoft 365 E3, and evaluates the agent identity, agent user or delegated user depending on the access pattern.
Agent ID error codes (Microsoft Graph)
| Code | Cause → fix |
|---|---|
Agent_Directory_QuotaExceeded | Blueprints and agent identities passed 95% of the tenant quota: permanently delete unused ones (soft-deleted ones count) |
AgentBlueprint_LimitExceeded / AgentIdentity_LimitExceeded | Maximum count reached, including soft-deleted items |
AgentIdentity_CredentialsNotSupported | Credentials go on the blueprint, never on an agent identity |
AgentIdentity_IncompatibleParentType | AgentIdentityBlueprintId isn't the AppId of a blueprint |
AgentIdentity_AgentBlueprintPrincipalDoesNotExist | Create the blueprint principal in the tenant first |
Error_AgentIdentitiesCreatingAgentIdentitiesNotAllowed | Agent identities can't create agent identities; use the blueprint principal |
Error_AgentIdentitySelfCreateRequired | An application can only create agent identities under its own blueprint |
…_NotSupportedOnApiVersion | The Graph API version used doesn't support Agent ID objects |
…_IncompatibleProperty | The request sets a property agent objects don't allow |