{ "data": { "a": { "slug": "aembit", "name": "Aembit", "vendor": "Aembit, Inc.", "vendorUrl": "https://aembit.io", "kind": "http-api", "category": "agent-auth", "summary": "Aembit is a hosted identity and access platform for workloads and AI agents. Its MCP Identity Gateway and MCP Authorisation Server apply access policies and inject credentials, with a Cloud API, an Edge API, a CLI and an Edge SDK.", "url": "https://www.anchorterminal.com/tools/aembit", "markdownUrl": "https://www.anchorterminal.com/tools/aembit.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/aembit.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/aembit.json", "repo": "https://github.com/Aembit/edge-sdks", "license": "Proprietary service under Aembit's terms of service. The Edge SDKs on GitHub are Apache-2.0", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "npm", "name": "@aembit/edge-sdk" } ], "auth": "mixed", "authNotes": "Every API takes a short-lived Bearer token. For the Cloud API at https://\u003ctenant\u003e.aembit.io/api/v1, a person copies an API token from the tenant's Profile page (1 hour by default), or a workload obtains an Aembit Access Token through an Access Policy and a role. The Edge API exchanges platform attestation for an access token at /edge/v1/auth. MCP clients reach the MCP Identity Gateway and MCP Authorisation Server by OAuth 2.1 with PKCE and dynamic client registration or a Client ID Metadata Document, after the user signs in through the company's identity provider. Access is self-serve for a free tenant. The managed gateway endpoint is requested through an Aembit representative.", "pricing": "freemium", "pricingNotes": "Starter is free with 3 AI agents, one MCP Identity Gateway and 5 MCP authorisation policies, or 10 workloads and 10 Access Policies, with 24 hours of event log retention. The pricing FAQ says no payment information is required. Teams is $20 per AI agent a month (to 500 agents) or $20 per workload a month, with a Contact Us button. Enterprise is custom. An agent can start on the free tenant without a contract (https://aembit.io/pricing/, checked 2026-10-08).", "priceSummary": "$20 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI files or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 27, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.aembit.io", "llmsTxt": "https://docs.aembit.io/llms.txt", "openapi": "https://docs.aembit.io/cloud.yaml", "capabilities": [ "auth.oauth", "auth.agent-identity", "auth.tokens", "auth.consent", "auth.audit" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "mcp", "openapi", "llms-txt", "typescript", "cli", "terraform", "status-page", "soc2", "iso27001", "enterprise", "self-hosted" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 70.5, "grade": "BB", "agentReady": true, "rank": 134, "ranked": true, "rankOf": 722, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 80, "payments": 40, "reliability": 65, "schema": 85, "security": 84, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": 0, "verdict": "Agents and workloads get short-lived credentials by attestation, and MCP clients sign in through OAuth 2.1 with policy checked on every request. Both APIs have public OpenAPI files. No rate limit figures or SLA are published, the managed gateway endpoint is requested through an Aembit representative, and no DPA or sub-processor list was found.", "bestFor": "A security team that wants one policy and audit point between AI agents or workloads and the services they call, with credentials kept away from the agent.", "strengths": [ "Public OpenAPI 3.1.1 files for the Cloud API (171 operations) and Edge API (2), plus llms.txt, per-page Markdown and a cloneable docs bundle", "No long-lived API credentials. Aembit API tokens last 1 hour by default and Edge API access tokens expire in 1 hour", "MCP clients authenticate by OAuth 2.1 with PKCE, dynamic client registration or a Client ID Metadata Document", "Audit logs, access authorisation events and workload events, exported by Log Streams to S3, Google Cloud Storage, Splunk or CrowdStrike", "Dated changelog with RSS. MCP Identity Gateway shipped four versions between 7 August and 7 October 2026" ], "weaknesses": [ "No rate limit figures in the reviewed documentation. The Edge API lists 429 responses without limits or Retry-After guidance", "No SLA is published. The docs send SLA questions to Aembit support", "The managed MCP Identity Gateway endpoint is requested through an Aembit representative, and MCP Tool Access Control is enabled by support", "The Python Edge SDK is in the repository at 0.1.0 but pypi.org/project/aembit-edge-sdk returned 404 on 8 October 2026", "No DPA, sub-processor list or security.txt found on aembit.io. The trust centre returned 403 to our reader" ], "agentNotes": [ "Read the API Base URL and token from the tenant's Profile page. Tokens last 1 hour by default, so plan to refresh", "Send `X-Aembit-ResourceSet` on Cloud API, Edge API and MCP calls outside the default Resource Set, or the request runs against the default set", "Cache the Edge API access token from `/edge/v1/auth` until near expiry before calling `/edge/v1/credentials`. Both endpoints can answer 429", "Point MCP clients at `https://\u003cgateway-host\u003e/mcp`. The `/me` path is deprecated", "Expect tool names prefixed with the Server Workload name behind the MCP Identity Gateway, and keep `perPage` at 100 or less on the Aembit MCP Server" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.5 } ], "editorialScores": { "ergonomics": 72, "maintenance": 80, "payments": 40, "reliability": 65, "schema": 85, "security": 84, "transparency": 42 }, "provenanceScore": 78 }, "connect": { "install": "npm install @aembit/edge-sdk", "http": "curl -X GET -L 'https://tenant.aembit.io/api/v1/server-workloads' -H 'Authorization: Bearer \u003cTOKEN\u003e'" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/aembit" }, "area": "agent-runtime", "unitPrices": [ { "item": "Teams, each AI agent", "unit": "month", "usd": 20, "note": "Priced per agent a month, up to 500 agents" }, { "item": "Teams, each workload", "unit": "month", "usd": 20, "note": "Priced per workload a month" } ], "provenance": { "legalEntity": "Aembit, Inc.", "domain": "aembit.io", "domainRegistered": "2021-03-14", "endpointOnVendorDomain": true, "terms": "https://aembit.io/terms-of-service/", "privacy": "https://aembit.io/privacy-policy/", "statusPage": "https://status.aembit.io", "changelog": "https://docs.aembit.io/changelog/", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms of service (last reviewed 14 July 2026) are between the customer and Aembit, Inc., define the Services as the website and the web-based and downloadable workload identity and access management services, and choose Delaware law.", "The privacy policy (last updated 5 May 2026) names Aembit, Inc. and covers the platform, websites and related services.", "aembit.io/.well-known/security.txt and docs.aembit.io/.well-known/security.txt both returned 404. The docs give security@aembit.io as the security contact.", "RDAP at Identity Digital gives a registration date of 2021-03-14 for aembit.io.", "Tenant APIs answer at https://\u003ctenant\u003e.aembit.io and the managed gateway at https://\u003ctenantId\u003e.mcpgateway.aembit.io, both on the vendor's domain.", "No DPA, sub-processor or SLA page was found at the obvious aembit.io paths, and trust.aembit.io returned 403 to our reader." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/aembit.json", "live": { "slug": "aembit", "vendorStatus": { "page": "https://status.aembit.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T20:22:18.582119143Z" }, "pages": [ { "url": "https://docs.aembit.io/changelog/", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:18:07.775115006Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "4e930f2cc1ec" }, { "url": "https://aembit.io/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:14:59.808222145Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "781c90a65067" }, { "url": "https://aembit.io/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:15:01.881687653Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "753e7b8821e4" }, { "url": "https://aembit.io/terms-of-service/", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:15:03.860763085Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ad42c0fa0432" } ], "updatedAt": "2026-10-08T20:22:18.582119143Z" } }, "answer": "Microsoft Entra Agent ID scores 74.4 (BB) on agent readiness against Aembit's 70.5 (BB), and leads in 3 of 7 scored categories. Aembit leads on payments \u0026 pricing.", "b": { "slug": "microsoft-entra-agent-id", "name": "Microsoft Entra Agent ID", "vendor": "Microsoft", "vendorUrl": "https://learn.microsoft.com/en-us/entra/agent-id/", "kind": "http-api", "category": "agent-auth", "summary": "Microsoft Entra Agent ID is an identity type for AI agents in Microsoft Entra ID. Agents get their own directory identity, request OAuth 2.0 tokens autonomously or on behalf of a user, and are managed through Microsoft Graph.", "url": "https://www.anchorterminal.com/tools/microsoft-entra-agent-id", "markdownUrl": "https://www.anchorterminal.com/tools/microsoft-entra-agent-id.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/microsoft-entra-agent-id.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/microsoft-entra-agent-id.json", "repo": "https://github.com/AzureAD/microsoft-identity-web", "license": "Proprietary service under Microsoft's terms. Microsoft.Identity.Web and the Auth SDK sidecar source are MIT", "transports": [ "http" ], "remoteUrl": "https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity", "packages": [ { "registry": "nuget", "name": "Microsoft.Identity.Web.AgentIdentities" } ], "auth": "oauth", "authNotes": "Access starts with a Microsoft Entra tenant and a person holding the Agent ID Developer or Agent ID Administrator role, who creates an agent identity blueprint. The blueprint authenticates to login.microsoftonline.com with a managed identity, a certificate or a client secret (Microsoft advises against secrets in production) and exchanges for a token as one of its agent identities. Agent identities hold no credentials. Three flows exist, which are app-only, on behalf of a signed-in user, and as the agent's own user account. Interactive `/authorize` and public clients aren't supported. Management calls on Microsoft Graph need AgentIdentity.Create.All or AgentIdentity.ReadWrite.All.", "pricing": "freemium", "pricingNotes": "Microsoft's docs say Agent ID is available to all Microsoft Entra customers, and Entra ID Free comes with any Microsoft cloud subscription. No per-agent price is published. Conditional Access, ID Protection and governance for agents need Microsoft Agent 365, listed at $15.00 a user a month on yearly billing, or Microsoft 365 E7 at $99.00. Conditional Access for agents also needs Entra P1 or Microsoft 365 E3 alongside Agent 365. No sandbox was found in the Agent ID docs (https://www.microsoft.com/en-us/microsoft-agent-365, checked 2026-10-08).", "priceSummary": "$15 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Agent ID docs, the Graph reference or the pricing pages (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 787, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://learn.microsoft.com/en-us/entra/agent-id/", "openapi": "https://raw.githubusercontent.com/microsoftgraph/msgraph-metadata/master/openapi/v1.0/openapi.yaml", "capabilities": [ "auth.oauth", "auth.agent-identity", "auth.consent", "auth.audit" ], "tags": [ "hosted", "enterprise", "oauth", "openapi", "dotnet", "sidecar", "microsoft-graph", "mcp", "freemium", "sla" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 74.4, "grade": "BB", "agentReady": true, "rank": 63, "ranked": true, "rankOf": 722, "categoryRank": 2, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 80, "payments": 20, "reliability": 91, "schema": 87, "security": 83, "transparency": 74 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": 0, "verdict": "Agent identities hold no credentials of their own, and Entra refuses high-privilege roles and Graph permissions for them. The token flow is a two-step exchange that Microsoft's own docs call complex and error-prone to implement by hand, and Conditional Access, risk detection and governance for agents need a paid Agent 365 licence.", "bestFor": "Organisations already on Microsoft Entra that want each agent to be a governed directory identity with tokens for Microsoft Graph, Azure and their own APIs.", "strengths": [ "Agent identities can't hold credentials. The blueprint authenticates with a managed identity, certificate or secret and exchanges for the agent's token", "Global Administrator and similar roles, and Graph permissions such as Application.ReadWrite.All, are refused for agent identities", "Create, list, update, delete and restore are on Microsoft Graph v1.0, with agentIdentity in the public OpenAPI file", "Audit and sign-in logs carry an agentType and blueprintId for agent activity", "Microsoft.Identity.Web 4.16.0 shipped on 30 September 2026, the eighth tagged release since 9 July" ], "weaknesses": [ "Conditional Access, ID Protection and governance for agents need Microsoft Agent 365, listed at $15 a user a month on yearly billing", "Microsoft's docs call hand-written token exchange complex and error-prone and steer developers to a .NET library or a sidecar container", "Creating a blueprint, a principal and an identity in quick succession can fail with 400 until the directory replicates", "Audit and sign-in logs are kept seven days on Entra ID Free and 30 days on P1 or P2", "microsoft.com's security.txt passed its Expires date on 23 September 2026" ], "agentNotes": [ "Request tokens in two steps. The blueprint gets an exchange token with fmi_path set to the agent identity's client ID, then the agent identity trades it for a resource token", "Retry with exponential backoff when a create returns `400 Object with id not found` straight after creating its parent object", "Send displayName, agentIdentityBlueprintId and a sponsor reference when creating an agent identity. All three are required", "Don't use the interactive `/authorize` flow. Agent identities are confidential clients and can't sign in to a page", "Keep the sidecar off any public network. Its `/AuthorizationHeader` endpoint hands out tokens to whoever can reach it" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.4 } ], "editorialScores": { "ergonomics": 71, "maintenance": 80, "payments": 20, "reliability": 91, "schema": 87, "security": 83, "transparency": 63 }, "provenanceScore": 85 }, "connect": { "install": "dotnet add package Microsoft.Identity.Web.AgentIdentities", "http": "curl -X POST https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity \\\n -H \"Authorization: Bearer $BLUEPRINT_TOKEN\" -H \"Content-Type: application/json\" \\\n -d '{\"displayName\": \"My Agent Identity\", \"agentIdentityBlueprintId\": \"\u003cblueprint-app-id\u003e\", \"sponsors@odata.bind\": [\"https://graph.microsoft.com/v1.0/users/\u003cid\u003e\"]}'" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/microsoft-entra-agent-id" }, "sameCompany": [ "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-execution-containers", "azure-key-vault", "azure-devops-mcp", "microsoft-learn-mcp", "playwright-mcp", "azure-mcp", "azure-maps", "azure-translator", "microsoft-graph-calendar", "microsoft-teams", "dynamics-365-sales", "power-automate", "microsoft-advertising-api", "microsoft-excel-graph", "outlook-mail-graph" ], "area": "agent-runtime", "unitPrices": [ { "item": "Microsoft Agent 365", "unit": "seat-month", "usd": 15, "note": "billed yearly, needed for Conditional Access, ID Protection and governance for agents" }, { "item": "Microsoft 365 E7 (includes Agent 365)", "unit": "seat-month", "usd": 99, "note": "billed yearly" } ], "provenance": { "legalEntity": "Microsoft Corporation", "domain": "microsoft.com", "domainRegistered": "1991-05-02", "endpointOnVendorDomain": true, "terms": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "privacy": "https://www.microsoft.com/en-us/privacy/privacystatement", "statusPage": "https://azure.status.microsoft/en-us/status/history/", "changelog": "https://learn.microsoft.com/en-us/graph/whats-new-overview", "securityTxt": "expired", "checked": "2026-10-08", "notes": [ "www.microsoft.com/.well-known/security.txt carries Expires 2026-09-23T16:00:00.000Z when read on 2026-10-08.", "The Microsoft APIs terms of use cover the Microsoft Graph API and other APIs that reach directory data, and were last updated in October 2025. Tenant use of Entra also falls under the customer's Microsoft licensing agreement and the Product Terms, which we didn't read.", "The Microsoft privacy statement was last updated in September 2026.", "Tokens come from login.microsoftonline.com and management calls go to graph.microsoft.com, both Microsoft domains.", "Entra's SLA page sends readers to the Azure status history for incidents that affect Entra ID.", "RDAP for microsoft.com gives a registration date of 1991-05-02." ], "score": 85 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/microsoft-entra-agent-id.json", "live": { "slug": "microsoft-entra-agent-id", "probe": { "target": "https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity", "method": "get", "lastAt": "2026-10-08T20:21:20.147544694Z", "lastOk": true, "lastStatus": 401, "lastMs": 57, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 32, "p95ms24h": 172, "samples24h": 32, "samples30d": 32, "days": [ { "date": "2026-10-08", "probes": 32, "ok": 32 } ] }, "vendorStatus": { "page": "https://azure.status.microsoft/en-us/status/history", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-08T19:38:47.070808325Z" }, "pages": [ { "url": "https://learn.microsoft.com/en-us/graph/whats-new-overview", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:21:36.290153566Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "bca4f93493d4" }, { "url": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "kind": "terms", "status": 304, "checkedAt": "2026-10-08T18:21:38.182590643Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1a1ee1c20d9a" } ], "updatedAt": "2026-10-08T20:21:20.147544694Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Aembit, Inc.", "b": "Microsoft", "name": "Vendor" }, { "a": "no (local only)", "b": "https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service under Aembit's terms of service. The Edge SDKs on GitHub are Apache-2.0", "b": "Proprietary service under Microsoft's terms. Microsoft.Identity.Web and the Auth SDK sidecar source are MIT", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-10-07", "b": "2026-09-30", "name": "Last release" }, { "a": "2026-07-14", "b": "2025-10-01", "name": "Terms last updated" }, { "a": "2026-05-05", "b": "2026-09-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "yes", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict automated access" }, { "a": "yes", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "27 npm/wk", "b": "787 stars", "name": "Popularity" } ], "faq": [ { "answer": "Microsoft Entra Agent ID scores 74.4 (BB) on agent readiness against Aembit's 70.5 (BB), and leads in 3 of 7 scored categories. Aembit leads on payments \u0026 pricing.", "question": "Which is better for AI agents, Aembit or Microsoft Entra Agent ID?" }, { "answer": "Aembit takes an API key or an OAuth sign-in. Microsoft Entra Agent ID uses an OAuth sign-in.", "question": "Do Aembit and Microsoft Entra Agent ID need an API key?" }, { "answer": "No hosted endpoint is listed for Aembit. Microsoft Entra Agent ID has a hosted endpoint at https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity.", "question": "Can an agent call Aembit and Microsoft Entra Agent ID without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 40 against 20" ], "also": null, "goodFor": "A security team that wants one policy and audit point between AI agents or workloads and the services they call, with credentials kept away from the agent.", "slug": "aembit", "watchFor": "No rate limit figures in the reviewed documentation. The Edge API lists 429 responses without limits or Retry-After guidance" }, { "aheadOn": [ "Reliability, 91 against 65", "Transparency \u0026 trust, 74 against 60" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Organisations already on Microsoft Entra that want each agent to be a governed directory identity with tokens for Microsoft Graph, Azure and their own APIs.", "slug": "microsoft-entra-agent-id", "watchFor": "Conditional Access, ID Protection and governance for agents need Microsoft Agent 365, listed at $15 a user a month on yearly billing" } ], "job": { "capability": "auth.oauth", "name": "Auth oauth" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-arcade.json", "title": "Aembit vs Arcade.dev", "url": "https://www.anchorterminal.com/compare/aembit-vs-arcade" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents.json", "title": "Aembit vs Auth0 for AI Agents (Token Vault)", "url": "https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity.json", "title": "Aembit vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-keycard.json", "title": "Aembit vs Keycard", "url": "https://www.anchorterminal.com/compare/aembit-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-nango.json", "title": "Aembit vs Nango", "url": "https://www.anchorterminal.com/compare/aembit-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit.json", "title": "Aembit vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps.json", "title": "Aembit vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-workos-pipes.json", "title": "Aembit vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/aembit-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id.json", "title": "Arcade.dev vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id.json", "title": "Auth0 for AI Agents (Token Vault) vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id.json", "title": "Descope Agentic Identity Hub vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id.json", "title": "Keycard vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-nango.json", "title": "Microsoft Entra Agent ID vs Nango", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit.json", "title": "Microsoft Entra Agent ID vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-stytch-connected-apps.json", "title": "Microsoft Entra Agent ID vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-workos-pipes.json", "title": "Microsoft Entra Agent ID vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-workos-pipes" } ], "scores": [ { "aembit": 65, "by": 26, "edge": "microsoft-entra-agent-id", "key": "reliability", "microsoft-entra-agent-id": 91, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "aembit": 85, "by": 2, "edge": "microsoft-entra-agent-id", "key": "schema", "microsoft-entra-agent-id": 87, "name": "Schema \u0026 documentation", "weight": 13 }, { "aembit": 72, "by": 1, "edge": "aembit", "key": "ergonomics", "microsoft-entra-agent-id": 71, "name": "Agent ergonomics", "weight": 13 }, { "aembit": 84, "by": 1, "edge": "aembit", "key": "security", "microsoft-entra-agent-id": 83, "name": "Security \u0026 auth", "weight": 14 }, { "aembit": 40, "by": 20, "edge": "aembit", "key": "payments", "microsoft-entra-agent-id": 20, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "aembit": 80, "by": 0, "edge": "", "key": "maintenance", "microsoft-entra-agent-id": 80, "name": "Maintenance \u0026 community", "weight": 7 }, { "aembit": 60, "by": 14, "edge": "microsoft-entra-agent-id", "key": "transparency", "microsoft-entra-agent-id": 74, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Microsoft Entra Agent ID scores 74.4 (BB) on agent readiness against Aembit's 70.5 (BB), and leads in 3 of 7 scored categories. Aembit leads on payments \u0026 pricing. Both do auth oauth.", "verdicts": { "aembit": "Agents and workloads get short-lived credentials by attestation, and MCP clients sign in through OAuth 2.1 with policy checked on every request. Both APIs have public OpenAPI files. No rate limit figures or SLA are published, the managed gateway endpoint is requested through an Aembit representative, and no DPA or sub-processor list was found.", "microsoft-entra-agent-id": "Agent identities hold no credentials of their own, and Entra refuses high-privilege roles and Graph permissions for them. The token flow is a two-step exchange that Microsoft's own docs call complex and error-prone to implement by hand, and Conditional Access, risk detection and governance for agents need a paid Agent 365 licence." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id", "json": "https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.md", "slim": "https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.min.md" }, "markdown": "Microsoft Entra Agent ID scores 74.4 (BB) on agent readiness against Aembit's 70.5 (BB), and leads in 3 of 7 scored categories. Aembit leads on payments \u0026 pricing. Both do auth oauth.\n\n- Aembit: grade BB, 70.5/100, rank #134 of 722. Markdown https://www.anchorterminal.com/tools/aembit.md · JSON https://www.anchorterminal.com/api/v1/tools/aembit.json\n- Microsoft Entra Agent ID: grade BB, 74.4/100, rank #63 of 722. Markdown https://www.anchorterminal.com/tools/microsoft-entra-agent-id.md · JSON https://www.anchorterminal.com/api/v1/tools/microsoft-entra-agent-id.json\n\n## Which one, for what\n\n### Aembit (BB)\n\nGood for: A security team that wants one policy and audit point between AI agents or workloads and the services they call, with credentials kept away from the agent.\n\nAhead on:\n- Payments \u0026 pricing, 40 against 20\n\nWatch for: No rate limit figures in the reviewed documentation. The Edge API lists 429 responses without limits or Retry-After guidance\n\n### Microsoft Entra Agent ID (BB)\n\nGood for: Organisations already on Microsoft Entra that want each agent to be a governed directory identity with tokens for Microsoft Graph, Azure and their own APIs.\n\nAhead on:\n- Reliability, 91 against 65\n- Transparency \u0026 trust, 74 against 60\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: Conditional Access, ID Protection and governance for agents need Microsoft Agent 365, listed at $15 a user a month on yearly billing\n\n\n## Score by category\n\n| Category | Weight | Aembit | Microsoft Entra Agent ID | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 65 | 91 | Microsoft Entra Agent ID +26 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 87 | Microsoft Entra Agent ID +2 |\n| Agent ergonomics | 13% (16.2 this run) | 72 | 71 | Aembit +1 |\n| Security \u0026 auth | 14% (17.5 this run) | 84 | 83 | Aembit +1 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 20 | Aembit +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 80 | 80 | even |\n| Transparency \u0026 trust | 7% (8.8 this run) | 60 | 74 | Microsoft Entra Agent ID +14 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **70.5 · BB** | **74.4 · BB** | |\n\n## Facts side by side\n\n| Fact | Aembit | Microsoft Entra Agent ID |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Aembit, Inc. | Microsoft |\n| Hosted endpoint | no (local only) | `https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity` |\n| Transports | HTTP, Streamable HTTP | HTTP |\n| Auth | OAuth or key | OAuth |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service under Aembit's terms of service. The Edge SDKs on GitHub are Apache-2.0 | Proprietary service under Microsoft's terms. Microsoft.Identity.Web and the Auth SDK sidecar source are MIT |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| Last release | 2026-10-07 | 2026-09-30 |\n| Terms last updated | 2026-07-14 | 2025-10-01 |\n| Privacy policy last updated | 2026-05-05 | 2026-09-01 |\n| Customer content may train models | not found in the text | yes |\n| Terms restrict automated access | not found in the text | yes |\n| Terms restrict benchmarking | yes | yes |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 27 npm/wk | 787 stars |\n\n## Verdicts\n\n**Aembit.** Agents and workloads get short-lived credentials by attestation, and MCP clients sign in through OAuth 2.1 with policy checked on every request. Both APIs have public OpenAPI files. No rate limit figures or SLA are published, the managed gateway endpoint is requested through an Aembit representative, and no DPA or sub-processor list was found.\n\n**Microsoft Entra Agent ID.** Agent identities hold no credentials of their own, and Entra refuses high-privilege roles and Graph permissions for them. The token flow is a two-step exchange that Microsoft's own docs call complex and error-prone to implement by hand, and Conditional Access, risk detection and governance for agents need a paid Agent 365 licence.\n\n## Before you call either\n\n### Aembit\n\n1. Read the API Base URL and token from the tenant's Profile page. Tokens last 1 hour by default, so plan to refresh\n2. Send `X-Aembit-ResourceSet` on Cloud API, Edge API and MCP calls outside the default Resource Set, or the request runs against the default set\n3. Cache the Edge API access token from `/edge/v1/auth` until near expiry before calling `/edge/v1/credentials`. Both endpoints can answer 429\n4. Point MCP clients at `https://\u003cgateway-host\u003e/mcp`. The `/me` path is deprecated\n5. Expect tool names prefixed with the Server Workload name behind the MCP Identity Gateway, and keep `perPage` at 100 or less on the Aembit MCP Server\n\n### Microsoft Entra Agent ID\n\n1. Request tokens in two steps. The blueprint gets an exchange token with fmi_path set to the agent identity's client ID, then the agent identity trades it for a resource token\n2. Retry with exponential backoff when a create returns `400 Object with id not found` straight after creating its parent object\n3. Send displayName, agentIdentityBlueprintId and a sponsor reference when creating an agent identity. All three are required\n4. Don't use the interactive `/authorize` flow. Agent identities are confidential clients and can't sign in to a page\n5. Keep the sidecar off any public network. Its `/AuthorizationHeader` endpoint hands out tokens to whoever can reach it\n\n## Questions\n\n### Which is better for AI agents, Aembit or Microsoft Entra Agent ID?\n\nMicrosoft Entra Agent ID scores 74.4 (BB) on agent readiness against Aembit's 70.5 (BB), and leads in 3 of 7 scored categories. Aembit leads on payments \u0026 pricing.\n\n### Do Aembit and Microsoft Entra Agent ID need an API key?\n\nAembit takes an API key or an OAuth sign-in. Microsoft Entra Agent ID uses an OAuth sign-in.\n\n### Can an agent call Aembit and Microsoft Entra Agent ID without installing anything?\n\nNo hosted endpoint is listed for Aembit. Microsoft Entra Agent ID has a hosted endpoint at https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.json, and with the fewest tokens: https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"aembit\", \"b\": \"microsoft-entra-agent-id\"}`. From a terminal: `anchor compare aembit microsoft-entra-agent-id`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/aembit.json and https://www.anchorterminal.com/api/v1/tools/microsoft-entra-agent-id.json\n\n## Other comparisons with Aembit or Microsoft Entra Agent ID\n\n- [Aembit vs Arcade.dev](https://www.anchorterminal.com/compare/aembit-vs-arcade.md)\n- [Aembit vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents.md)\n- [Aembit vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity.md)\n- [Aembit vs Keycard](https://www.anchorterminal.com/compare/aembit-vs-keycard.md)\n- [Aembit vs Nango](https://www.anchorterminal.com/compare/aembit-vs-nango.md)\n- [Aembit vs Scalekit AgentKit](https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit.md)\n- [Aembit vs Stytch Connected Apps](https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps.md)\n- [Aembit vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/aembit-vs-workos-pipes.md)\n- [Arcade.dev vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id.md)\n- [Auth0 for AI Agents (Token Vault) vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id.md)\n- [Descope Agentic Identity Hub vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id.md)\n- [Keycard vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id.md)\n- [Microsoft Entra Agent ID vs Nango](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-nango.md)\n- [Microsoft Entra Agent ID vs Scalekit AgentKit](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit.md)\n- [Microsoft Entra Agent ID vs Stytch Connected Apps](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-stytch-connected-apps.md)\n- [Microsoft Entra Agent ID vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Aembit vs Microsoft Entra Agent ID", "url": "" } ], "description": "Microsoft Entra Agent ID scores 74.4 (BB) on agent readiness against Aembit's 70.5 (BB), and leads in 3 of 7 scored categories. Aembit leads on payments \u0026 pricing. Both do auth oauth. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Aembit BB 70.5", "Microsoft Entra Agent ID BB 74.4", "scores" ], "h1": "Aembit vs Microsoft Entra Agent ID", "image": "https://www.anchorterminal.com/assets/og/compare-aembit-vs-microsoft-entra-agent-id.png", "path": "/compare/aembit-vs-microsoft-entra-agent-id", "published": "2026-10-01", "section": "tools", "title": "Aembit vs Microsoft Entra Agent ID for AI agents, BB 70.5 vs BB 74.4", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id" }, "tokens": { "markdown": 2400, "slim": 680 }, "version": 1 }