Subchapter 30.2

Oauth2 Token Flow

references/oauth2-token-flow.mdMarkdown4 KBView on GitHub

Source: Agent ID Setup Instructions (opens in a new tab)

Agent Identities authenticate at runtime using credentials configured on the Blueprint (not on the Agent Identity — Agent Identities cannot hold credentials).

Option	Use case	Credential type
Managed Identity + WIF	Production (Azure-hosted)	Federated Identity Credential on Blueprint

Oauth2 Token Flow · Entra Agent Id · microsoft/azure-skills · Skills Docs

fic_body = {
    "name": "my-fic-name",
    "issuer": f"https://login.microsoftonline.com/{tenant_id}/v2.0",
    "subject": mi_principal_id,   # The MI's object ID (principalId), NOT client ID
    "audiences": ["api://AzureADTokenExchange"],
}
requests.post(
    f"{GRAPH}/applications/{blueprint_obj_id}"
    f"/microsoft.graph.agentIdentityBlueprint/federatedIdentityCredentials",
    headers=headers, json=fic_body,
).raise_for_status()

from azure.identity import ManagedIdentityCredential

cred = ManagedIdentityCredential(client_id=MI_CLIENT_ID)
token = cred.get_token(f"api://{blueprint_app_id}/.default")
# Authorization: Bearer {token.token}

import jwt
from jwt import PyJWKClient

jwks_client = PyJWKClient(
    f"https://login.microsoftonline.com/{tenant_id}/discovery/v2.0/keys"
)
signing_key = jwks_client.get_signing_key_from_jwt(token_str)

claims = jwt.decode(
    token_str,
    signing_key.key,
    algorithms=["RS256"],
    audience=f"api://{blueprint_app_id}",
    issuer=f"https://sts.windows.net/{tenant_id}/",
)

$body = @{
    "passwordCredential" = @{
        "displayName" = "Dev Secret"
        "endDateTime" = "2027-01-01T00:00:00Z"
    }
}

$credential = Invoke-MgGraphRequest -Method POST `
    -Uri "https://graph.microsoft.com/v1.0/applications/<BLUEPRINT_OBJECT_ID>/addPassword" `
    -Headers @{ "OData-Version" = "4.0"; "Content-Type" = "application/json" } `
    -Body ($body | ConvertTo-Json -Depth 5) -OutputType PSObject

$credential.secretText   # Save NOW — not retrievable later

resp = requests.post(
    f"{GRAPH}/applications/{blueprint_obj_id}/addPassword",
    headers=headers,
    json={"passwordCredential": {
        "displayName": "Dev Secret",
        "endDateTime": "2027-01-01T00:00:00Z",
    }},
)
resp.raise_for_status()
secret_text = resp.json()["secretText"]   # Save NOW

Oauth2 Token Flow

Oauth2 Token Flow

Option A: Managed Identity + Workload Identity Federation (Production)

1. Set the Application ID URI on the Blueprint

2. Create a Federated Identity Credential on the Blueprint

3. Acquire a token from the caller

4. Validate on the backend

Key Rules (WIF)

Option B: Client Secret (Local Dev)

1. Add a password credential to the Blueprint

2. Drive the two-step exchange

Key Rules (Client Secret)