Skip to content

Guided tour

FabrCore 2.0 · Release and package availability

These guides track the current 2.0 source. Stable 2.0.0 publication is pending; package commands show the release target. Until it is published, follow the source quick start or use a matching available prerelease set. Release migration · Runtime modes

MODULE 10 · LESSON 10.11

Use optional Entra Agent ID

Use Entra Agent ID as an explicit optional identity path.

Lesson 63 of 86 · FabrCore 2.0

Overview

Agent ID token exchange binds parent blueprint credentials and a child identity. Delegated mode also needs a human assertion. FabrCore's integration performs exchanges; it does not provision every identity, sponsor or governance/consent requirement for you.

Parent and child identities participate in the token flow

The Agent ID integration exchanges credentials/assertions using the configured parent blueprint identity and child agent identity. In delegated mode a human assertion also participates. Those identities must already be provisioned and permitted in the Microsoft environment; FabrCore's exchange code does not create the entire identity/governance setup.

Workload identity is not user permission

An agent identity names the acting workload. It does not automatically authorize access to every user's resource. Keep the intended resource, scopes and delegated versus application mode explicit in the connection contract. Sponsorship, consent and provisioning remain responsibilities of the identity administration path used by the organization.

Understand the Agent ID exchange

  1. Provision the parent/child identities through the supported Microsoft administration process and confirm the deployed broker supports Agent ID. The fragment below shows application mode; delegated mode additionally requires the documented user assertion and blueprint audience.
  2. Merge those fields into a valid owner/resource-scoped connection profile with protected credential resolution. Do not treat the fragment as a complete profile or identity provisioning command.
  3. Perform one authorized resource call and inspect its outcome without displaying tokens. Use the tests below to verify the identity/resource boundary.
Connection profile fragment · pre-provisioned Agent ID identities 
{
  "Authentication": "AgentIdApplication",
  "ClientId": "<parent-blueprint-client-id>",
  "AgentIdentityClientId": "<child-agent-identity-client-id>",
  "CredentialReference": "<host-resolved-parent-credential>"
}

Validate prerequisites before a resource call

  1. Record the provisioned parent/child identifiers, credential reference, requested resource and selected authentication mode for a test integration. Confirm the deployed feature advertises the required support.
  2. Perform a supported token-backed test call without exposing the token in logs. Inspect the accepted identity/resource and the resulting access outcome.
  3. Remove a required assertion or use an unauthorized child/resource in a controlled test. Expect exchange or access failure, with no fallback that silently changes the acting identity.

This establishes the exchange prerequisites for one authorized integration. It does not prove organization-wide identity provisioning or consent.

If the result is different

A standard Entra app registration does not require Agent ID. Use it when its identity model is needed and verify live compatibility rather than inferring it from protocol tests.

Go deeper

Explore the related documentation.