--- cuppy_hub: azure cuppy_path: reference/entra/workload-and-agent-identities.md cuppy_section: docs cuppy_doc: BN6D-5JZF cuppy_doc_uuid: 03680718-1c7a-45bd-9639-855be79983d8 cuppy_permalink: https://cuppy.io/azure/d/BN6D-5JZF cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/entra/workload-and-agent-identities cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 7d9fda3e6c1669261450c4c0777139dc68f72cd02f5bc1e9483e35442e9c08bf # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Workload and agent identities ## Conditional Access for workload identities A Conditional Access policy can **block a service principal's token requests** by location (outside allowed public IP ranges) or by **service principal risk** from ID Protection, or in combination with authentication contexts. The only grant control is **Block**. - **Scope:** single-tenant service principals registered in your tenant, **assigned to the policy directly**. Policies assigned to a group don't apply to service principals in it. Multitenant and Microsoft apps aren't covered, and **managed identities aren't covered at all**. - **Licence:** creating or changing these policies needs **Workload Identities Premium**; without it, existing policies keep working but can't be edited. - **Symptom:** the token request fails with `AADSTS53003` (`BlockedByConditionalAccess`); in **Sign-in logs → Service principal sign-ins**, the failure reason is `Access has been blocked due to Conditional Access policies.` and the Conditional Access tab names the policy. - **Fix as an agent:** you can't satisfy it in code. Report the policy and the caller's egress IP to your human; for pipelines, run from an allowed network or a managed identity. Policies target the service principal's **object ID** from Enterprise applications, not the app registration's. **Continuous access evaluation (CAE)** for workload identities: a client that declares the `cp1` capability gets long-lived tokens (up to 24 hours) that Microsoft Graph revokes on events such as the service principal being disabled or high risk; the resource answers **401 with a claims challenge**, and the client must request a new token with those claims. Only Microsoft Graph supports it, only for line-of-business single-tenant apps, not managed identities. ## Microsoft Entra Agent ID Agent ID models AI agents as directory objects: | Object | What it is | |---|---| | **Agent identity blueprint** | An application-like template that holds the **credentials** (and permissions, app roles, token settings) for every agent of one kind | | **Agent identity blueprint principal** | The blueprint's service principal in a tenant; it creates and manages agent identities through Microsoft Graph | | **Agent identity** | A single-tenant service principal with an "agent" subtype. **It has no credentials of its own**: the blueprint acquires tokens on its behalf (federated credentials under the hood). Permissions and roles are granted to it | | **Agent's user account** (optional) | A user object marked as an agent, for systems that require a user | Agents act three ways: **on behalf of a signed-in user** (delegated), **as the agent identity** (app-only, autonomous), or **as their agent user**. Tokens carry `xms_act_fct` (actor facet), `xms_sub_fct` (subject facet), `idtyp` and `xms_idrel` to tell these apart. **Azure resources:** give the agent identity Azure roles on the specific resources, like any service principal. The role assignment `principalType` enum now includes **`AgentServicePrincipal`** and **`AgentUser`**: set the matching value (`reference/rbac/role-assignments-and-scopes.md`). In code, Microsoft's samples use `MicrosoftIdentityTokenCredential` from `Microsoft.Identity.Web.Azure` (.NET) as the Azure SDK `TokenCredential`; `@azure/identity` 4.14.0 has no agent identity credential (checked in its type definitions). Agents built before Agent ID (older Copilot Studio and Foundry agents) use ordinary service principals. **Conditional Access for agents** is separate from workload identity CA: it needs Microsoft 365 E7, or a Microsoft Agent 365 licence with Entra P1 or Microsoft 365 E3, and evaluates the agent identity, agent user or delegated user depending on the access pattern. ## Agent ID error codes (Microsoft Graph) | Code | Cause → fix | |---|---| | `Agent_Directory_QuotaExceeded` | Blueprints and agent identities passed 95% of the tenant quota: permanently delete unused ones (soft-deleted ones count) | | `AgentBlueprint_LimitExceeded` / `AgentIdentity_LimitExceeded` | Maximum count reached, including soft-deleted items | | `AgentIdentity_CredentialsNotSupported` | Credentials go on the blueprint, never on an agent identity | | `AgentIdentity_IncompatibleParentType` | `AgentIdentityBlueprintId` isn't the AppId of a blueprint | | `AgentIdentity_AgentBlueprintPrincipalDoesNotExist` | Create the blueprint principal in the tenant first | | `Error_AgentIdentitiesCreatingAgentIdentitiesNotAllowed` | Agent identities can't create agent identities; use the blueprint principal | | `Error_AgentIdentitySelfCreateRequired` | An application can only create agent identities under its own blueprint | | `…_NotSupportedOnApiVersion` | The Graph API version used doesn't support Agent ID objects | | `…_IncompatibleProperty` | The request sets a property agent objects don't allow | --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.