$ ~/registry/skill/microsoft-plugin-skills-entra-agent-id

SKILL

entra-agent-id

Name: entra-agent-id
Author: microsoft

为智能体快速配置 Microsoft Entra 身份蓝图、实例身份与 OAuth 令牌交换。

星标

★ 232

来源

GitHub

更新于

2026-07-13

// 安全评估需留意

仅提示词，不执行代码
开源可审计

总评

该技能材料显示其为开源的提示型技能，本身未声明内置密钥、远程端点或本地执行能力，整体风险较低。但其面向 Microsoft Graph 上的身份与权限配置，若按指引实际操作，可能涉及高权限目录对象与 OAuth 配置变更，需谨慎核验最小权限与官方文档。

凭证密钥需留意

材料顶部标注无需密钥/环境变量，但 README 明确涉及为 Blueprint 配置凭据（FIC、Managed Identity 或 client secret）及 OAuth 令牌交换流程；说明技能本体不自带凭证，但实际使用场景会处理敏感身份配置，存在误配或泄露后的滥用面。

网络外发需留意

README 指向已知官方端点 Microsoft Graph（https://graph.microsoft.com/v1.0），并建议通过 Microsoft Learn/MCP 文档工具核对接口；未见向不明第三方外发数据的迹象，但若照此执行将把身份配置请求发送到微软服务。

代码执行低风险

系统客观检查项已标注为 prompt-only，且文档仅描述指导直接调用 Graph API（如 PowerShell 或 Python requests），未声明该技能自身会在本机启动进程、执行脚本或授予额外系统能力。

数据访问需留意

材料未声明可直接读写本地文件，但其目标是创建和管理 Entra Blueprint、Service Principal、Agent Identity、权限授予与跨租户/OBO 令牌流，属于对租户身份与授权资源的敏感管理面；README 还列出需要 Agent Identity Developer/Administrator 或 Application Administrator 角色，应关注是否超出业务所需。

来源供应链低风险

来源为 GitHub 上的微软仓库，且系统标注 open-source，源码可审计，这是明显的降风险因素。负面点是许可证未声明、star 为 0、维护状态未知，因此可信度并非最佳，但基于现有材料未见闭源外传、恶意注入或明显失维红旗。

安全建议

仅在最小权限原则下分配 README 所述目录角色，并优先在测试租户验证。
若需要配置 client secret、FIC 或令牌交换，请使用官方密钥管理方案并避免将凭证写入提示、代码仓库或日志。
执行任何 Graph API 变更前，先对照 Microsoft Learn 与当前 SDK/Graph 版本确认请求体和端点。
对创建的 Blueprint、Service Principal、Agent Identity 与权限授予建立审计和定期回收流程。

审计模型: gpt-5.4 · 2026-06-17

// 安装

复制安装指令，让 AI 自动完成配置 · 推荐新手

请帮我安装 askskill 上的 "entra-agent-id" 技能：
1. 下载 https://raw.githubusercontent.com/microsoft/GitHub-Copilot-for-Azure/main/plugin/skills/entra-agent-id/SKILL.md
2. 保存为 ~/.claude/skills/entra-agent-id/SKILL.md
3. 装好后重载技能，告诉我可以用了

// 下载

下载 SKILL.md机读安装清单 ↗

// 用法示例

创建智能体身份蓝图

输入

请为一个企业内部 AI 智能体设计 Microsoft Entra Agent Identity Blueprint，包含 BlueprintPrincipal、所需权限范围、命名规范，以及通过 Microsoft Graph 进行创建的步骤示例。

预期产出

返回可实施的身份蓝图设计、主体配置建议与 Graph 创建流程示例。

配置 OBO 令牌交换

输入

帮我为一个多服务智能体配置 OAuth 2.0 OBO 令牌交换流程，说明前置条件、Microsoft Entra 配置项、令牌流转步骤，以及常见错误排查要点。

预期产出

给出完整的 OBO 配置说明、流程图式步骤与排障清单。

接入 AgentID sidecar

输入

请说明如何在一个 polyglot 智能体系统中集成 Microsoft Entra SDK for AgentID sidecar，实现每实例身份与跨租户令牌交换，并提供部署与配置建议。

预期产出

输出 sidecar 集成方案、身份分配方式、跨租户交换配置重点与部署建议。

// 文档

Microsoft Entra Agent ID

Create and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.

Quick Reference

Property	Value
Service	Microsoft Entra Agent ID
API	Microsoft Graph (`https://graph.microsoft.com/v1.0`)
Required role	Agent Identity Developer, Agent Identity Administrator, or Application Administrator
Object model	Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP)
Runtime exchange	Two-step `fmi_path` exchange (autonomous and OBO)
.NET helper	`Microsoft.Identity.Web.AgentIdentities`
Polyglot helper	Microsoft Entra SDK for AgentID (sidecar container)

When to Use This Skill

Provisioning a new Agent Identity Blueprint and BlueprintPrincipal
Creating per-instance Agent Identities under a Blueprint
Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint
Implementing the two-step fmi_path runtime token exchange (autonomous or OBO)
Cross-tenant agent token flows
Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)
Granting per-Agent-Identity application (appRoleAssignments) or delegated (oauth2PermissionGrants) permissions
Diagnosing Agent ID errors such as AADSTS82001, AADSTS700211, or PropertyNotCompatibleWithAgentIdentity

MCP Tools

Tool	Use
`mcp_azure_mcp_documentation`	Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration

There is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python requests). Use mcp_azure_mcp_documentation to verify request bodies and endpoints against current docs before running.

Before You Start

Use the mcp_azure_mcp_documentation tool to search Microsoft Learn for current Agent ID documentation:

"Microsoft Entra Agent ID setup instructions"
"Microsoft Entra SDK for AgentID"

Verify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.

Conceptual Model

Agent Identity Blueprint (application)         ← one per agent type/project
  └── BlueprintPrincipal (service principal)    ← MUST be created explicitly
        ├── Agent Identity (SP): agent-1        ← one per agent instance
        ├── Agent Identity (SP): agent-2
        └── Agent Identity (SP): agent-3

Concept	Description
Blueprint	Application object that defines a type/class of agent. Holds credentials (secret, certificate, federated identity).
BlueprintPrincipal	Service principal for the Blueprint in the tenant. Not auto-created.
Agent Identity	Service-principal-only identity for a single agent instance. Cannot hold its own credentials.
Sponsor	A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation.

Prerequisites

Required Entra Roles

One of: Agent Identity Developer, Agent Identity Administrator, or Application Administrator.

PowerShell (interactive setup)

# PowerShell 7+
Install-Module Microsoft.Graph.Applications -Scope CurrentUser -Force

Python (programmatic provisioning)

pip install azure-identity requests

Authentication

DefaultAzureCredential is not supported. Azure CLI tokens carry Directory.AccessAsUser.All, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with client_credentials, or Connect-MgGraph with explicit delegated scopes.

PowerShell (delegated)

Connect-MgGraph -Scopes @(
    "AgentIdentityBlueprint.Create",
    "AgentIdentityBlueprint.ReadWrite.All",
    "AgentIdentityBlueprintPrincipal.Create",
    "AgentIdentity.Create.All",
    "User.Read"
)

Python (application)

…

查看完整文档 ↗

为 AI 代理提供企业级认证鉴权、令牌校验与访问控制能力

—装→

$ loading_