Request agent tokens for autonomous agents

When agents perform operations using their own identity, rather than acting as a delegate of a user, they're called autonomous agents. To perform operations, agents must first authenticate with Microsoft Entra ID and obtain an access token using their agent identity (agent ID). This article walks you through the process of requesting an access token for an agent identity in Microsoft Entra ID using a two-step process. You'll:

Obtain a token for an agent identity blueprint.
Exchange the agent identity blueprint token for an agent ID token.

Prerequisites

Before implementing agent token authentication, ensure you have:

An agent identity. You'll need the agent identity client ID.
Understand oauth protocols in Microsoft Entra Agent ID
An agent identity blueprint.

Configure your client credentials

Get your client credential details. This could be your client secret, a certificate or a managed identity that you are using as a federated identity credential.

Warning

Client secrets shouldn't be used as client credentials in production environments for agent identity blueprints due to security risks. Instead, use more secure authentication methods such as federated identity credentials (FIC) with managed identities or client certificates. These methods provide enhanced security by eliminating the need to store sensitive secrets directly within your application configuration.

Microsoft Graph API
Microsoft.Identity.Web

Proceed to the next step

{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "TenantId": "<your-tenant-id>",
    "ClientId": "<agent-blueprint-clientid>",
    "ClientCredentials": [
      {
        "SourceType": "ClientSecret",
        "ClientSecret": "your-client-secret"
        }
    ]
  }
}

Request a token for the agent identity blueprint

When requesting the token for the agent identity blueprint, provide the agent ID's client ID in the fmi_path parameter. Provide the client_secret parameter instead of client_assertion and client_assertion_type when using a client secret as a credential during local development. For certificates and managed identities, use client_assertion and client_assertion_type.

Microsoft Graph API
Microsoft.Identity.Web

POST https://login.microsoftonline.com/<my-test-tenant>/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

client_id=<agent-blueprint-client-id>
&scope=api://AzureADTokenExchange/.default
&grant_type=client_credentials
&client_secret=<client-secret>
&fmi_path=<agent-identity-client-id>

With Microsoft.Identity.Web, you don't need to request explicitly a token for the agent identity blueprint. Microsoft.Identity.Web does it for you.

dotnet add package Microsoft.Identity.Web
dotnet add package Microsoft.Identity.Web.AgentIdentities

Once you have the agent identity blueprint token (T1), use it to request for the agent identity token.

POST https://login.microsoftonline.com/<my-test-tenant>/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

client_id=<agent-identity-client-id>
&scope=https://graph.microsoft.com/.default
&grant_type=client_credentials
&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
&client_assertion=<agent-blueprint-token-T1>

Microsoft.Identity.Web handles the details of token acquisition protocol for you, provided you use the new services.AddAgentIdentities() in your service collection at the initialization of the application.

Initialize the application:

// Program.cs
using Microsoft.AspNetCore.Authorization;
using Microsoft.Identity.Abstractions;
using Microsoft.Identity.Web;
using Microsoft.Identity.Web.Resource;
using Microsoft.Identity.Web.TokenCacheProviders.InMemory;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddMicrosoftIdentityWebApiAuthentication(builder.Configuration);
builder.Services.AddAgentIdentities();
builder.Services.AddInMemoryTokenCaches();

Use the .WithAgentIdentity() pattern to request access tokens:

// Get the service to call the downstream API (preconfigured in the appsettings.json file)
IAuthorizationHeaderProvider authorizationHeaderProvider = serviceProvider.GetService<IAuthorizationHeaderProvider>();
AuthorizationHeaderProviderOptions options = new AuthorizationHeaderProviderOptions().WithAgentIdentity("<agent-identity-client-id>");

// Request agent identity tokens
string authorizationHeaderWithAppTokens = await authorizationHeaderProvider.CreateAuthorizationHeaderForAppAsync("https://resource/.default", options);

// The authHeader contains "Bearer " + the access token (or another protocol
// depending on the options)

Feedback

Was this page helpful?

Last updated on 2025-11-18