Token Observe vs Microsoft Entra Agent ID
Entra decides which identity the agent holds and whether it may be issued a token. Token Observe decides the individual call that token does not cover.
2 September 2026
- Microsoft Learn — What is Microsoft Entra Agent ID?
- Microsoft Learn — Overview of agent identities in Microsoft Entra
- Microsoft Learn — Conditional Access for agents
- Microsoft Learn — Microsoft Entra Agent ID logs
- Microsoft Learn — Governing agent identities
- Microsoft Learn — ID Protection for agents
- Microsoft Learn — Secure Web and AI Gateway for Copilot Studio agents
- Microsoft Learn — Purview data security and compliance for Microsoft Agent 365
- Microsoft Learn — Managing AI experiences enabled by usage-based billing
- Microsoft — Agent 365 plans and pricing
Their claims, not our testing. Verify anything that decides it for you.
On this page
For agent identity itself, Entra Agent ID is the better purchase for most readers, and Token Observe’s roadmap concedes it in writing
If the problem you are solving is which identity an agent holds, who is accountable for it, and under what conditions it may be issued a token, buy the product whose whole surface is that question — and buy it from the directory that already governs your people, because a second identity system is a second place for an account to be missed at leaver time. Microsoft publishes an agent identity as a special service principal with no credentials of its own, created from a reusable agent identity blueprint that holds the credentials and acquires tokens on its behalf; a sponsor field recording the human user or group accountable for the agent, with sponsorship transferring automatically to that person’s manager when they leave, and lifecycle workflows that notify cosponsors and managers of impending sponsorship changes; entitlement management through access packages granting security group membership, application OAuth API permissions including Microsoft Graph application permissions, and Microsoft Entra roles, with expiry dates that notify the sponsor as they approach and lapse the assignment if nobody acts. Token Observe has none of that and is not going to grow it. Its identity surface is console sign-in federated to an OIDC provider, directory groups mapped to roles, and bounded SCIM user provisioning for viewer accounts.
The second advantage is reach across the Microsoft estate, and it is the kind of advantage an external control plane cannot buy. Microsoft describes agent identities being provisioned and managed automatically by Microsoft Foundry across a project’s lifecycle, configurable in Azure App Service and Azure Functions, created automatically for Microsoft Copilot Studio agents in a Power Platform environment — a capability their governance page marks as preview — and managed for Teams agents through the Developer Portal, with support for OAuth 2.0, Model Context Protocol and agent-to-agent communication, and with third-party agents from platforms such as AWS Bedrock and n8n brought in through the Microsoft Entra ID Auth SDK sidecar or workload identity federation. Alongside it, Microsoft Entra ID Protection publishes a set of agent risk detections — early life malicious activity, directory reconnaissance, failed access attempts, threat intelligence matches, sign-in spikes, suspicious credential usage and unfamiliar resource access — that feed risk-based Conditional Access, with the documented caveat that all risk detections for risky agents are offline at this time and that in on-behalf-of flows the risky activity is attributed to the user rather than the agent. Token Observe’s detection is heuristic pattern matching inside one request; it has no tenant-wide behavioural baseline and no threat intelligence feed, and it should not be read as offering one.
That reach extends past Entra, and it takes back two of the controls this page might otherwise be read as claiming for Token Observe alone. Microsoft Purview supports data loss prevention, insider risk management, communication compliance, eDiscovery, retention and data classification over Agent 365 agent instances, with prompts and responses captured in the unified audit log and sensitive information types found inside them. The Microsoft 365 admin center’s Cost management dashboard sets spending policies over Copilot Credits with monthly limits, optional per-user limits, alert thresholds and hard caps, scoped by Entra group and by selected agent or service. If your agents are Microsoft agents billed in Copilot Credits, the payload control and the spend ceiling are already inside the estate you are licensing, and buying a second product to get them would be paying twice.
The third advantage is assurance and commercial shape, and it decides some procurements on its own. Microsoft publishes prices — the Agent 365 plans and pricing page lists Agent 365 at $15.00 user/month paid yearly, Microsoft 365 E7 at $99.00 user/month paid yearly and Microsoft 365 E7 without Teams at $90.45 user/month paid yearly — alongside product terms, and Agent ID itself is described as available for all Microsoft Entra customers with the security extensions requiring an Agent 365 licence. Token Observe publishes no price list, holds no SOC 2, no ISO 27001, no ISO 42001 and no independent penetration-test result, offers no availability SLA, and its licence is a template pending review by counsel rather than an executed grant. If your gate is a certification, a signed uptime commitment or a licence your legal team has seen before, that gate is passed on the Microsoft side and not on this one. Confirm current licensing, preview status and regional availability with Microsoft during procurement, because those move quickly and this page is a dated reading rather than a test report.
Token Observe and Microsoft Entra Agent ID, capability by capability
The Microsoft Entra Agent ID column paraphrases Microsoft’s own published material as it stood on 2 September 2026. None of it has been independently tested here, products in this category ship quickly, and a capability that is absent from a vendor’s documentation is not the same thing as a capability the product lacks. Check anything that decides it for you against their own current documentation.
Where each one sits
At token issuance. Their Conditional Access page states that Conditional Access is evaluated whenever Microsoft Entra ID issues or refreshes an access token, that the token is then presented to the target resource, and that the resource validates it and uses its claims to make authorisation decisions. Some resources also support Continuous Access Evaluation for near-real-time enforcement on specific events.
In the request itself. Eleven ordered steps run in one process — authenticate, resolve agent, open trace, sanitise, scan, govern, enact, route, call upstream, govern the response, meter and record — with a single decision point at step 6.
Both are inline. They are inline at different moments: one before a credential exists, one before a payload leaves.
Their Conditional Access page states plainly that Conditional Access only protects resources secured by Microsoft Entra ID, and that if an agent accesses resources using an API key it bypasses the Microsoft Entra ID authentication and token issuance pipeline entirely, so Conditional Access policies will not apply.
Governed. The gateway authenticates the agent’s own bearer token at step 1 and decides the call regardless of how the upstream provider authenticates, so an OpenAI or Anthropic key held by the gateway is inside the control rather than outside it.
This row is the reason the two products compose rather than compete, and Microsoft is the one who wrote the boundary down.
Their page describes Conditional Access bringing together real-time signals such as the user’s and agent’s context, device, location and session risk to determine whether to allow, block or limit access. Separately, Global Secure Access for agents forwards Copilot Studio agent traffic — HTTP node traffic, custom connectors and the MCP Server Connector — to a globally distributed proxy where network security policies are evaluated.
The payload. Unicode is sanitised first so smuggled invisible characters cannot slip past a detector reading a different string from the one the model will read, then PII and secret detection and prompt-injection heuristics run over prompt content and over tool results, which are scored 1.25×.
Through identity. Their overview describes an agent identity platform that lets developers create and manage agent identities, with agent identity blueprints serving as the templates those identities are created from, support for OAuth 2.0, Model Context Protocol and agent-to-agent communication, and third-party agents from platforms such as AWS Bedrock and n8n integrated using the Microsoft Entra ID Auth SDK (sidecar) or workload identity federation.
Through the base URL. For supported OpenAI-compatible, Anthropic and Gemini ingress, changing OPENAI_BASE_URL or ANTHROPIC_BASE_URL and the key is normally the whole integration, plus one Streamable HTTP endpoint for MCP.
The identity. Their documentation describes an agent identity as a special service principal that holds no credentials of its own, created from an agent identity blueprint that holds the credentials and acquires tokens on the agent’s behalf, and issued tokens only in the tenant where it was created.
The governed call and its record. Token Observe issues no directory identity, and a replacement enterprise identity provider or credential vault is one of its seven named strategic non-goals.
What each one enforces
Conditional Access as if-then statements: if the conditions defined in a policy are met the configured access controls are enforced; if the required controls are satisfied access is granted, and if they are not, access is denied. Their example is requiring multifactor authentication before a user can authorise an agent to access their email.
A single evaluation returning one verdict — allow, block or require approval — plus a redaction plan, taken in a fixed order: engaged kill switches first, then lifecycle, then deny-by-default permissions, then budget and rate ceilings, then the policies whose scope selects the subject.
Their controls gate access to a resource. Token Observe’s gate one request to that resource, which is a narrower object.
At the agent identity blueprint, which their page describes as automatically covering all agent identities derived from it including ones added in future, with the documented limit that targeting the blueprint covers the agent identity and not the agent’s user account. Custom security attributes are offered as the attribute-driven alternative for categorising agent identities and resources.
Policy scope matches on agent id, on team case-insensitively, and on tag case-sensitively, and every agent resolves to one registry row that the gateway reads on each call rather than to a copy of it.
Their governance page describes agent identities being created with limited permissions such as OAuth 2 delegated permission scopes inherited from the parent blueprint, with further access assigned through access packages covering security group memberships, application OAuth API permissions including Microsoft Graph application permissions, and Microsoft Entra role assignments.
Action-level and deny-by-default: an allow on tool:orderdb/get_details with tool:payments/issue_refund simply absent and therefore denied. An explicit deny beats every allow wherever it is written, and a delegation chain between agents intersects rather than unions.
Their governance page describes access requests being routed to designated approvers based on the access package configuration, sponsors requesting access on an agent’s behalf, and an extension request near expiry triggering a new approval cycle in which approvers confirm whether continued access is still appropriate.
An approval bound to one payload: the SHA-256 of the canonicalised action plus the execution context it was proposed in, single-use through a compare-and-set, expiring at 60 minutes by default and between one minute and seven days by policy.
Different objects with the same name. Theirs approves an access grant that then persists; Token Observe’s approves one action instance and nothing else.
Published, in a different part of the estate. The Cost management dashboard in the Microsoft 365 admin center governs Copilot Credit spend through spending policies: a monthly limit per policy, an optional per-user monthly limit, alert thresholds and hard caps, scoped to Microsoft Entra ID groups and to the agents and services you select — and when users hit the limit they lose access to those agents and services until credits reset at the start of the month. Inside the Entra Agent ID request path itself the nearest published control is a risk signal rather than a limit: ID Protection lists a sign-in spike detection, where an agent makes a higher number of sign-ins than its usual frequency. A per-agent ceiling denominated in USD against a third-party provider’s billing is not described in their published documentation as of 2026-09-02, which follows from the unit — their ceilings are denominated in Copilot Credits for Microsoft-billed services.
Hard USD ceilings per request, rolling hour, UTC day and UTC month, plus requests, tool calls and tokens per minute, reserved in one per-agent database transaction before egress; a budgeted route with an unpriced reachable target is refused rather than priced at zero.
ID Protection for agents publishes detections including early life malicious activity, Entra directory reconnaissance, failed access attempts, threat intelligence matches, sign-in spikes, suspicious credential usage and unfamiliar resource access, with the stated caveat that at this time all risk detections for risky agents are offline, and risk-based Conditional Access policies that block on high agent risk.
Heuristic, and inside one request rather than across a tenant: injection scoring on prompts and tool results, and a kill switch scoped to one agent, one team or the whole estate, checked first in the pipeline.
Two published controls in two products. Global Secure Access for agents applies web content filtering, threat intelligence filtering and network file filtering to Copilot Studio agent traffic once forwarding is enabled per environment in the Power Platform Admin Center, using the tenant-level baseline profile. Microsoft Purview supports data loss prevention for Agent 365 — an agent instance is named in a DLP policy as you would a user, or through a security group, with deep content inspection and contextual analysis, and block or audit of agent-to-human and human-to-agent interactions for Microsoft Teams, OneDrive or SharePoint, and emails; Purview also records that because an agent instance is unaware of the block action, the agent owner has to monitor the policy. Redaction that removes a detected value and lets the same call continue, rather than blocking or auditing the interaction, is not described in their published documentation as of 2026-09-02.
Detected values are tokenised or blocked before the payload leaves the network, including on streamed responses, where a hold-back buffer with a 64-character floor stops a card number split across two chunks from escaping output redaction.
What each one records
In the directory’s own logs. Their logs page describes agent activity being logged under the base identity type it originates from — blueprint activity as application events, agent identity activity as service principal events, and agent’s user account activity as user events — with an agentType property on the initiatedBy, performedBy and targetResources fields, a blueprintId correlating an instance back to its template, and an agentSignIn sign-in event type.
One trace per governed request plus append-only events. The trace id is minted at step 3, before the verdict, so a blocked request is recorded too, and it is returned on every response in x-acp-trace-id.
Directory operations and sign-ins: their documented examples are adding, updating and deleting an agent identity blueprint or an agent identity, adding an agent’s user account, and the sign-in events an agent generates across the four sign-in log types.
The request itself: the prompt, the tool calls the model proposed, the results, normalised token usage priced into a ledger, and the policy decisions with the rule that fired.
Neither record substitutes for the other. One says a token was issued to this identity; the other says what was then sent, and what it cost.
Their ID Protection page states that risk detections are retained for up to 90 days for investigation purposes, and that risk data can be exported by configuring diagnostic settings to send it to a Log Analytics workspace, archive it to a storage account, stream it to an event hub, or send it to a SIEM.
Default trace retention is keep-forever, which is a decision you should make deliberately rather than inherit — the storage growth is published, and a retention policy is yours to set.
Their logs page describes filtering sign-in logs in the Microsoft Entra admin center by Agent type and Is Agent, and querying the same data through Microsoft Graph on the beta endpoint with an OData filter over signInEventTypes and agent type.
A plain-English question translated into a validated filter object over fourteen allow-listed fields and never into SQL, shown back as editable chips, degrading to a deterministic keyword parser when no model is configured.
Provider-operated, which is the ordinary shape of a managed audit log. Their logs page documents the audit and sign-in log schema, the agentType and blueprintId properties and the Graph beta surfaces, and Purview additionally captures agent prompts and responses in the unified audit log with retention policies and eDiscovery over them. A customer-verifiable integrity mechanism over the log itself — a hash chain or signature the customer recomputes — is not described in their published documentation as of 2026-09-02; you rely on Microsoft’s own controls rather than on your own verification, which is what most auditors expect from a hyperscaler.
The audit log is hash-chained, each row covering its canonical content and the previous row’s hash, sealed with a MAC at boot and optionally anchored off-box with Ed25519 to a sink outside the database administrator’s control. Tamper-evident, not tamper-proof.
Diagnostic settings to a Log Analytics workspace, a storage account, an event hub or a SIEM, plus the Risky Agents report and agent risk detections through the Microsoft Graph riskyAgents and agentRiskDetections collections.
A compliance export containing the traces and events for the period, the approvals with approver identity and rationale, the audit entries, a chain verification result naming the sequence number of any break, and a SHA-256 digest of the bundle. The bundle is digest-sealed, not signed.
Identity, deployment and assurance
Microsoft-operated, inside your Microsoft Entra tenant. Their documentation states that agent identities can only be issued tokens in the tenant where they are created and cannot access resources or APIs in other tenants, while blueprints may be configured as multitenant and create tenant-local agent identities elsewhere.
Self-hosted and bring-your-own-key: one Node process and one SQLite file in your own network, with no product telemetry, phone-home, prompts, keys or trace database reaching the vendor.
A sponsor field recording the human user or group accountable for an agent, used for purposes such as contacting a human when a security incident happens, with sponsorship automatically transferring to the sponsor’s manager if they leave and lifecycle workflow tasks notifying cosponsors and managers of impending changes.
An owner email is one of four fields required to create an agent, and recertification binds a SHA-256 digest of the exact configuration reviewed — including each role’s normalised permissions — so editing a role makes every affected review stale without rewriting what was attested.
Their sponsor governs the identity’s lifecycle; Token Observe’s owner is attached to the enforcement row. An estate can hold both, pointing at the same person.
Broad on the Microsoft side and beyond it: their pages describe Microsoft Foundry provisioning agent identities across a project lifecycle, configuration in Azure App Service and Azure Functions, automatic creation for Copilot Studio agents in a Power Platform environment (marked preview on their governance page), blueprint management in the Developer Portal for Teams, and third-party agents from platforms such as AWS Bedrock and n8n.
Broad on the provider side: OpenAI, Anthropic, Google Gemini, OpenRouter, Amazon Bedrock and Azure OpenAI as first-class upstreams plus OpenAI-compatible endpoints you register, with equivalence enforced by a table-driven test over every provider kind.
OAuth 2.0, Model Context Protocol and agent-to-agent communication, with documented OAuth flows for on-behalf-of access, autonomous app-only access and an agent’s user account.
OpenAI-compatible, Anthropic and Gemini dialects for model traffic and Streamable HTTP for MCP, with an on-behalf-of header that intersects a named human’s mapped authority and can only narrow it.
Not characterised on the Microsoft Entra Agent ID pages read for this comparison, which are product documentation rather than compliance material. Microsoft publishes its certifications and attestations separately, and their exact scope and date are worth asking Microsoft for in writing rather than reading off a comparison page.
None. No SOC 2, no ISO 27001, no ISO 42001 and no independent penetration test — stated first rather than on request, and a pre-purchase test is expressly permitted by the licence.
What each one costs
Their overview states that Agent ID is a product within Microsoft Entra providing the platform for creating and managing agent identities and agent identity blueprints, and that Agent ID is available for all Microsoft Entra customers.
No published price list. The product is self-hosted, and your model spend is billed by your providers directly against your own keys.
Their overview states that extending Microsoft Entra security features to agents requires Microsoft Agent 365, that Agent 365 is included with Microsoft 365 E7, and that it is available as an add-on to Microsoft E5, A5 or Business Premium, or to the Microsoft Defender Suite plus Microsoft Purview Suite.
Every governed capability is in the same self-hosted build; there is no security tier that gates the policy engine, budgets, approvals or the audit chain behind a second purchase.
Their Conditional Access page states that Conditional Access for agents requires Microsoft Entra ID P1 or P2 and a Microsoft Agent 365 licence for each user, that enforcement of Agent 365 licensing is coming soon, and that network controls for agents require Microsoft Entra Internet Access.
Not applicable in the same shape: there is no per-user licence, and the controls are configuration rather than entitlements.
Their governance page states that using Microsoft Entra ID Governance for agent identities requires either Microsoft 365 E7, which includes Agent 365 and Microsoft Entra Suite, or a Microsoft Agent 365 licence paired with at least Microsoft Entra P1 or Microsoft 365 E3.
Recertification, kill switches, evidence export and the audit chain are in the base build, and the constraint is what they do rather than what they cost: an overdue recertification never suspends the agent by itself.
The Agent 365 plans and pricing page lists Agent 365 at $15.00 user/month paid yearly, Microsoft 365 E7 at $99.00 user/month paid yearly, and Microsoft 365 E7 without Teams at $90.45 user/month paid yearly, each on an annual commitment.
None published. That is a real disadvantage in a procurement that starts from a price list, and it is stated here rather than discovered on a call.
Their unit is per user per month, not per agent, which is worth modelling against your own headcount rather than your agent count.
A token proves an identity was authorised. It does not price the call, redact the payload, or hold it for a named human
Microsoft’s model is precise and worth restating in their terms, because the precision is what makes the composition clean. An access token has exactly one subject and one audience. In the on-behalf-of flow the user is the subject, so Conditional Access policies target users and groups rather than agent identities. In the client-credentials flow the agent is the subject, so policy is scoped to the agent identity. Where the agent has its own user account, the token is issued to that account and policy is evaluated against it. Their documentation is equally clear about the seams: a policy targeting agent identities does not apply to the agent’s user account, a policy targeting all users does not include agents’ user accounts, and a policy targeting a blueprint covers only the agent identities derived from it. Those are the sort of distinctions that decide whether a control actually covers what an architecture diagram implies it covers, and Microsoft publishes them rather than leaving them to be discovered.
What follows from that model is not a criticism of it. Once a token exists, the decisions that remain are about the content of a particular request: whether this prompt carries a customer’s card number to a third-party model, whether this agent has spent £900 of its £1,000 monthly ceiling by Tuesday, whether the refund the model has just proposed should be executed at all or should stop and wait for a person. Token Observe takes those at step 6 of its request path, in one place, in a fixed order, and records the verdict against a trace id that was minted before the decision was taken — so a request that was refused leaves the same kind of evidence as one that succeeded. A directory record showing that a token was issued to a service principal and a trace showing what that token was then used to send are complementary halves of the same audit question, and neither answers the other half.
The approval difference is the sharpest of these, because both products use the word. In Microsoft’s entitlement management, an approver decides whether an agent identity should hold an access package, the assignment persists until it expires, and the sponsor is notified as expiry approaches with the option to request an extension that triggers a new approval cycle. In Token Observe, an approval authorises one payload: the hash covers the canonicalised action and the execution context, changing one argument makes the retry a mismatch rather than a near-enough, consumption is a compare-and-set so two concurrent retries cannot both execute, and the whole thing expires in an hour by default. The second is not better governance; it is governance of a different object, and an estate that wants both a periodic entitlement review and a per-refund gate needs both.
The boundary is published by Microsoft, and it is the whole integration argument
The Conditional Access for agents page carries a section called boundaries and limitations, and one line in it does more work than anything on this page: Conditional Access only protects resources secured by Microsoft Entra ID, and if an agent accesses resources using an API key it bypasses the Microsoft Entra ID authentication and token issuance pipeline entirely, so Conditional Access policies will not apply to it. Read that against a typical agent estate. A LangChain service calling the OpenAI API with a provider key, a coding assistant calling Anthropic, a scheduled job calling Gemini and a self-hosted model behind an OpenAI-compatible endpoint are all authenticated by a shared secret rather than by a token the directory issued. Nothing in that traffic reaches the pipeline the policy sits in front of.
Microsoft has an answer for part of that shape, and it is worth reading precisely rather than generously. Global Secure Access for agents provides network security controls for Microsoft Copilot Studio agents: you enable traffic forwarding in the Power Platform Admin Center on a per-environment or per-environment-group basis, the traffic types named are HTTP node traffic, custom connectors and the MCP Server Connector, and the service then evaluates that traffic against configured security policies including web content filtering, threat intelligence filtering and network file filtering, using the tenant-level baseline profile. That is a real inline control on a real class of agent traffic, and it requires Microsoft Entra Internet Access. What it is scoped to, in their own words, is Copilot Studio agents whose environment you have turned forwarding on for.
Microsoft covers a second part of the shape through Purview and the billing stack, and this page would be dishonest to leave it out. An Agent 365 agent instance can be named in a Microsoft Purview data loss prevention policy exactly as a user is, or picked up through a security group, with deep content inspection and contextual analysis behind it and block or audit over agent-to-human and human-to-agent interactions in Teams, OneDrive or SharePoint and email — Purview’s own caveat being that the agent instance is unaware of the block, so its owner has to watch the policy and understand what it does to the workflow downstream. Separately, the Microsoft 365 admin center’s Cost management dashboard puts monthly limits, per-user limits, alert thresholds and hard caps on Copilot Credit spend, scoped by Entra group and by chosen agent and service, and a user who hits the limit loses those agents until credits reset. Both are strong, and both are scoped to Microsoft’s own agent surfaces and Microsoft’s own billing unit — which is precisely the population the next paragraph sets aside.
So the honest shape of the estate is a boundary rather than a gap in a competitor. Agents built and run on Microsoft platforms, holding Entra-issued tokens for Entra-protected resources, are covered by controls you already own and should use. Agents that call model providers on API keys — which is most of the frameworks a platform team inherits rather than commissions — sit outside that pipeline by Microsoft’s own description. Token Observe’s claim is confined to that second population: point the agent at the gateway with one environment variable and the call becomes something with an identity, a budget, a permission set and a searchable record, whatever the upstream’s authentication scheme happens to be. It makes no claim to be the better place to hold the identity, and the same request path can carry the Entra principal alongside the agent so both records name the same person.
What federating Entra into Token Observe gets you today, and exactly where it stops
The federation is deliberately small, and describing it accurately is more useful than describing it warmly. Console sign-in federates an OIDC provider, so the people who read traces, approve actions and edit policy are the people your directory already knows, and console rank — admin, operator, auditor, viewer — is set only by an administrator, with the sign-in path reading no role, group or scope claim at all. That last detail is the safety property: no directory group can promote anyone in the console, because the console does not look at groups.
Where directory groups are used is the on-behalf-of mask on the agent path, and it is off by default. Switched to enforce, the roles that a named person’s Entra groups map to are appended as the final link of the delegation chain, and because that chain intersects at every hop, the mask can only ever narrow what the agent was already permitted to do. A person whose group maps to a role holding a bare wildcard is a no-op rather than an escalation. It runs after the verdict, so an already-blocked request gains nothing from a second reason, and before the approval branch, so nobody is asked to approve something the intersection forbids. Under shadow the intersection is computed and recorded as a decision saying what it would have refused, while the request proceeds; under off, nothing is read at all, and an install that has not reached enforce should not describe the intersection as a control it holds.
The limits are specific to Entra and are the sort of thing worth knowing before a pilot rather than during one. Group claims are a snapshot from the person’s last single sign-on rather than a live directory read: Token Observe holds no refresh token and requests no offline scope, so a revoked group keeps granting until they next sign in or the capture ages past its limit, 24 hours by default, after which the request is refused rather than decided on stale evidence. That residual risk is on the register and requires a named acceptance. And past roughly 200 groups, Entra ID stops emitting the group claim and sends a directory-API link instead; Token Observe will not follow it, because following it would mean a new credential to hold, a new egress host to allow, a directory-read permission and a network dependency inside a login, all wrong for something drafted to run air-gapped. Such a token captures no groups, and that person’s on-behalf-of requests are refused until an administrator narrows the group claim at the identity provider. Refusing beats authorising against a fragment of the truth.
- What the registry is, and is not
- A system of record for governed agents that the gateway resolves at step 2 of every request, not an estate-wide inventory. It does not discover agents; registering one is a deliberate act by a named person. Where an authoritative upstream inventory exists — Entra Agent ID among them — the intended shape is to attach authority and effect evidence to those assets rather than to keep a competing list.
- What agent credentials actually are
- Long-lived bearer tokens stored as a SHA-256 digest with a 16-character display prefix, shown exactly once at issue. That is an accepted decision rather than an overlooked one: workload identity in the SPIFFE sense cannot be presented by every framework the product has to support, so revocation, expiry and last-used tracking compensate. Entra’s model — an identity with no credentials of its own, drawing tokens from a blueprint that holds them — is the stronger design, and this page does not pretend otherwise.
- The integration that does not exist yet
- There is no Entra Agent ID connector in Token Observe today. Running both is a division of labour you would operate deliberately: the directory holds the identity, the sponsor and the lifecycle; the gateway holds the call, the ceiling and the evidence; and you decide which system owns which rule rather than inheriting an answer from a product.
Where each one is the right answer
Choose Microsoft Entra Agent ID when
- The requirement is agent identity itself — an account in the directory, a sponsor accountable for it, lifecycle and entitlement reviews — which is exactly what Entra Agent ID is built for and what Token Observe deliberately does not build.
- Your agents run on Microsoft platforms and reach Microsoft-protected resources, so adaptive access, risk detection and audit arrive through the tenant you already operate rather than through a second control plane.
- Procurement needs a published price, published product terms and a certification posture with a name on it; Microsoft publishes all three and Token Observe publishes none of them.
- You need policy to follow the identity everywhere it is used, including resources and services Token Observe is not in the path of at all.
- Copilot Studio is where your agents live, and forwarding their traffic through Global Secure Access for web content, threat intelligence and file filtering already covers the network controls you were shopping for.
- Your agents are Microsoft agents billed in Copilot Credits, so Purview can apply data loss prevention, retention and eDiscovery to their interactions and the Cost management dashboard can cap what they spend — two of the controls this page argues for, already inside a licence you hold.
Choose Token Observe when
- Your agents call model providers on API keys, which Microsoft’s own documentation places outside the Conditional Access pipeline entirely.
- You run more than one model provider and the same rule now has to bind identically on all of them, with the equivalence tested over every provider kind rather than asserted.
- The control you are missing has to bind on provider-key traffic that Microsoft’s own controls are not scoped to: a hard USD ceiling on the call against your own provider bill rather than a Copilot Credit limit, redaction that removes a value and lets the call continue rather than blocking the interaction, or an approval bound to one exact action rather than to a standing access grant.
- The record you need is per request — the prompt, the tool call, the policy that fired, the tokens spent — in a hash-chained log you can anchor off-box, rather than per sign-in and per directory operation.
- Self-hosting in your own network, including an air-gapped environment, is a requirement rather than a preference.
When you would run both
Running both is the normal answer, and Token Observe’s roadmap is written to make it the expected one: a replacement enterprise identity provider or credential vault is a named strategic non-goal, and the recorded instruction for Microsoft specifically is to federate Entra identities rather than rebuild Entra. In that arrangement Entra Agent ID stays authoritative for everything it is authoritative for now — the agent identity as a service principal with no credentials of its own, the blueprint that holds the credentials and applies one Conditional Access policy to a whole class of agents, the sponsor accountable for the agent with automatic transfer to their manager, entitlement management with expiring assignments and named approvers, ID Protection’s risk detections feeding risk-based Conditional Access, and the sign-in and audit logs where agentType and blueprintId make agent activity separable from everything else in the tenant. Token Observe takes the traffic that leaves that boundary: model and MCP calls authenticated with provider keys, decided inline against action-level permissions, hard USD ceilings and payload-bound approvals, redacted before egress, and recorded in a hash-chained log you can anchor to a sink outside your database administrator’s control. The join between them is the human. Console sign-in federates the same directory, and where on-behalf-of enforcement is switched on, the Entra groups of the named person intersect the agent’s authority so the gateway can only ever grant less than both records agree on. The honest caveat is that this is a division of labour rather than a shipped integration: there is no Entra Agent ID connector today, group claims are a sign-in snapshot with a 24-hour default staleness rather than a live directory read, and anyone running both is operating two policy sets and deciding which owns which rule.
The category argument sits above this one: Token Observe and cloud-native controls covers what the whole category does and does not do, which is the better page to read if you have not yet shortlisted a product.
The others in the same slot
Amazon Bedrock AgentCore
AgentCore enforces Cedar at its own gateway boundary. Token Observe enforces one rule set across six providers from a process you run. The estate decides which you want.
Microsoft Agent 365
Agent 365 governs the agent as an identity in your tenant. Token Observe governs the payload that agent sends to a model provider.
ServiceNow AI Control Tower
AI Control Tower governs an AI asset through a lifecycle. Token Observe governs one request before it leaves your network.
Does Token Observe replace Microsoft Entra Agent ID?
No, and it is not built to. A replacement enterprise identity provider or credential vault is one of the product’s seven named strategic non-goals, and the recorded position on Microsoft is to federate Entra identities rather than rebuild Entra. Token Observe issues no directory identity, has no equivalent of an agent identity blueprint, no sponsor lifecycle, no entitlement management and no tenant-wide risk detection. Its identity surface is OIDC console sign-in, directory groups mapped to roles as an optional narrowing mask on the agent path, and bounded SCIM provisioning for viewer accounts. If the thing you are buying is agent identity, buy Entra Agent ID.
If Conditional Access can already block a risky agent, what does a gateway add?
It adds coverage of the traffic Conditional Access does not sit in front of, and Microsoft is the source for that boundary rather than this page. Their Conditional Access for agents documentation states that Conditional Access only protects resources secured by Microsoft Entra ID, and that an agent accessing resources using an API key bypasses the Microsoft Entra ID authentication and token issuance pipeline entirely so the policies will not apply. Most agent frameworks call OpenAI, Anthropic or Gemini on a provider key. It also adds a different kind of decision: Conditional Access decides whether a token is issued, and Token Observe decides one request — whether this payload may carry a customer’s card number, whether this call crosses a monthly USD ceiling, and whether this specific refund needs a named human first. Two caveats belong here rather than in the small print. Microsoft does publish payload and spend controls elsewhere in the estate — Purview data loss prevention over Agent 365 agent instances, and Copilot Credit spending policies with hard caps in the Microsoft 365 admin center — so if your agents are Microsoft agents you may already own the controls in question. What neither is scoped to is an agent calling a third-party provider on that provider’s API key and that provider’s bill.
Can Token Observe use our Entra groups to decide what an agent may do?
Yes, with two limits worth knowing before you rely on it. Switched to enforce, the roles a named person’s Entra groups map to are appended as the final link of the delegation chain, which intersects at every hop, so the mask can only narrow the agent’s authority and never grant. The first limit is staleness: the groups are a snapshot from that person’s last single sign-on, because Token Observe holds no refresh token and requests no offline scope, so a revoked group keeps granting until they sign in again or the capture ages past its window, 24 hours by default, after which the request is refused rather than decided on stale evidence. The second is Entra’s group overage: past roughly 200 groups the group claim is replaced by a directory-API link, Token Observe will not follow it, and that person’s on-behalf-of requests are refused until an administrator narrows the claim at the identity provider.
Which system should hold the agent inventory?
The directory, where you already have one. Token Observe’s registry is a system of record for governed agents rather than an estate-wide inventory: it does not discover agents, registration is a deliberate act by a named person, and a broad CMDB-style AI inventory competing with Microsoft is a stated non-goal. What the registry is for is enforcement — step 2 of the request path resolves that exact row and the decision point reads its status, team, tags, budget and rate limits, so the record cannot drift from what is actually running. Where an authoritative upstream inventory exists, the intended shape is to attach authority and effect evidence to those assets. Anything calling a model without a record is the shadow-AI radar’s problem rather than the registry’s, and the radar only sees what you feed it.
Are the claims about Entra Agent ID on this page tested?
No. Everything in the them column comes from Microsoft’s own published documentation, read on 2 September 2026, and has not been independently tested — the same caveat the product’s market benchmark states about its own competitive table. Microsoft’s agent identity documentation is moving quickly, several of the capabilities described carry their own preview and licensing-enforcement caveats in the source pages, and licensing in particular is stated differently on different pages depending on which security feature is being extended. Confirm current licensing, preview status and regional availability with Microsoft in writing during procurement rather than from a comparison page.
Prefer to ask a person? Write to us →
Tell us which one you are already running.
If Microsoft Entra Agent ID is already in your stack, the useful question is not which to buy but what each is for, and where the seam between them sits. Say what you have and you will get a straight answer — including when the answer is that you do not need a second thing.
no form · no qualification step · no sales desk · the other three ways in