Entra Agent Identity Manager

Automates creation of Microsoft Entra Agent Identities — a Microsoft 365 Frontier capability that gives AI agents their own managed identity in Entra ID, independent of any human user.

Requires a Frontier-enrolled Entra tenant.

---

What It Does

Track	Use when	Signs in
Create Blueprint	You need a new Blueprint (parent template)	Once via device code
Create Agent Identity	A Blueprint exists and you want a new agent under it	Once via device code
Both (autonomous)	You want Blueprint + Agent Identity in one go	Once via device code

---

Quick Start — Web UI

# 1. Install dependencies
pip install -r backend/requirements.txt

# 2. Start the server
cd backend
py -m uvicorn main:app --host 0.0.0.0 --port 8000

# 3. Open in browser
# http://localhost:8000

---

Quick Start — CLI Demo Script (Autonomous)

Run everything from the terminal with a config file. One sign-in, everything automated.

Step 1 — Create your config file

Copy the template and fill in your values:

cp config.example.json config.json

Edit config.json:

{
  "mode": "both",
  "tenant_domain": "yourcompany.onmicrosoft.com",
  "blueprint_name": "MyBlueprint",
  "agent_name": "MyAgent"
}

Mode options:

mode	What it does	Extra fields needed
blueprint	Creates a Blueprint only	tenant_domain, blueprint_name
agent-identity	Creates an Agent Identity under an existing Blueprint	tenant_domain, blueprint_app_id, agent_name
both	Creates Blueprint + Agent Identity in one flow (single sign-in)	tenant_domain, blueprint_name, agent_name

Step 2 — Run

py demo_cli.py --config config.json

Or run interactively (will prompt for all inputs):

py demo_cli.py

Step 3 — Sign in once

The script shows a code and URL. Open the URL, enter the code, sign in. Everything else is automatic.

---

Prerequisites

Requirement	Details
Python 3.9+	python.org
Frontier tenant	Enrolled in Microsoft 365 Frontier
Entra role	Application Developer (or higher) in your tenant
pip packages	pip install msal requests (CLI) or pip install -r backend/requirements.txt (Web UI)

---

Repository Structure

AgentID-Autonomous/
├── backend/
│   ├── main.py              # FastAPI backend — all API logic
│   └── requirements.txt     # Python dependencies
├── frontend/
│   └── index.html           # Single-page wizard UI
├── demo_cli.py              # Standalone CLI demo (autonomous mode)
├── config.example.json      # Config template for autonomous runs
├── TECHNICAL_GUIDE.md       # Full API + permissions reference
└── README.md                # This file

---

How It Works (Short Version)

Blueprint creation:

1. Device-code sign-in (delegated, as you)
2. POST /v1.0/applications/ with @odata.type: Microsoft.Graph.AgentIdentityBlueprint
3. POST /v1.0/applications/{id}/addPassword — attach a client secret
4. POST /v1.0/serviceprincipals/microsoft.graph.agentIdentityBlueprintPrincipal — register in tenant

Agent Identity creation (under existing Blueprint):

1. Device-code sign-in (delegated, as Blueprint owner)
2. Look up Blueprint Object ID via alternate key: GET /v1.0/applications(appId='{appId}')
3. Add short-lived temp secret → get Blueprint's own token → delete temp secret
4. POST /beta/serviceprincipals/Microsoft.Graph.AgentIdentity — authenticated as Blueprint

For the full deep-dive, see TECHNICAL_GUIDE.md.

---

Security Notes

• No secrets are stored — the web UI and CLI never write credentials to disk
• Temp secrets are always cleaned up — created and deleted in the same operation
• config.json is in .gitignore — never commit it; it may contain tenant info
• The blueprint_secret shown at the end of Track 1 is your responsibility to store securely (e.g., Azure Key Vault)

---

Troubleshooting

See the FAQ section in TECHNICAL_GUIDE.md for common errors and fixes.