Get an audit

Head to head · Auth oauth · October 2026 research run

Amazon Bedrock AgentCore Identity vs Microsoft Entra Agent ID

Amazon Bedrock AgentCore Identity and Microsoft Entra Agent ID score within a point of each other on agent readiness, 74.8 (BB) and 74.4 (BB). Microsoft Entra Agent ID leads on reliability and maintenance & community. Both do auth oauth.

Amazon Bedrock AgentCore IdentityAmazon Web Services · HTTP API BB74.8/100#64 of 841 Microsoft Entra Agent IDMicrosoft · HTTP API BB74.4/100#71 of 841

Which one, for what

Amazon Bedrock AgentCore Identity BB

Good for Agents already built on AWS, above all those on AgentCore Runtime or Gateway, where token retrieval is automatic and free of extra charge.

Ahead on

  • Agent ergonomics, 76 against 71
  • Payments & pricing, 30 against 20

Watch for

No operation to revoke or delete one user's stored grant was found. forceAuthentication clears a refresh token, and AWS says it cannot detect a revocation made at the provider.

Microsoft Entra Agent ID BB

Good for Organisations already on Microsoft Entra that want each agent to be a governed directory identity with tokens for Microsoft Graph, Azure and their own APIs.

Ahead on

  • Reliability, 91 against 85
  • Maintenance & community, 80 against 70

Watch for

Conditional Access, ID Protection and governance for agents need Microsoft Agent 365, listed at $15 a user a month on yearly billing

Score by category

CategoryWeight this runAmazon Bedrock AgentCore IdentityMicrosoft Entra Agent IDEdge
Reliability16%208591Microsoft Entra Agent ID +6
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.28887Amazon Bedrock AgentCore Identity +1
Agent ergonomics13%16.27671Amazon Bedrock AgentCore Identity +5
Security & auth14%17.58483Amazon Bedrock AgentCore Identity +1
Payments & pricing10%12.53020Amazon Bedrock AgentCore Identity +10
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.87080Microsoft Entra Agent ID +10
Transparency & trust7%8.87574Amazon Bedrock AgentCore Identity +1
Negative events≤1500
Total74.8 · BB74.4 · BB

Facts side by side

FactAmazon Bedrock AgentCore IdentityMicrosoft Entra Agent ID
KindHTTP APIHTTP API
VendorAmazon Web ServicesMicrosoft
Hosted endpointhttps://bedrock-agentcore.us-east-1.amazonaws.comhttps://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity
TransportsHTTPHTTP
AuthOAuth or keyOAuth
PricingPay per useFreemium
Price for auth oauth$0.01 per 1,000 requestsnot published
x402nono
LicenceProprietary service under the AWS Customer Agreement and AWS Service Terms. The AgentCore SDKs for Python and TypeScript are Apache-2.0Proprietary service under Microsoft's terms. Microsoft.Identity.Web and the Auth SDK sidecar source are MIT
Read-only variant documentednono
llms.txtyesno
Last release2026-09-012026-09-30
Terms last updated2026-10-012025-10-01
Privacy policy last updated2026-05-182026-09-01
Customer content may train modelsyes, with an opt-outyes
Terms restrict automated accessyesyes
Terms restrict benchmarkingyesyes
Terms or service can change without noticeyesyes
Arbitration or class-action waivernot found in the textnot found in the text
Popularity335k npm/wk, 1.4M PyPI/wk787 stars

Verdicts

Amazon Bedrock AgentCore Identity

The service handles user-delegated, machine-to-machine and on-behalf-of token flows through one call, with IAM scoping, KMS encryption and published quotas. It only works inside an AWS account a person creates, the hosted consent portal needs an AgentCore Gateway, and no call to revoke one user's stored grant was found in the API reference.

Microsoft Entra Agent ID

Agent identities hold no credentials of their own, and Entra refuses high-privilege roles and Graph permissions for them. The token flow is a two-step exchange that Microsoft's own docs call complex and error-prone to implement by hand, and Conditional Access, risk detection and governance for agents need a paid Agent 365 licence.

Before you call either

Amazon Bedrock AgentCore Identity

  1. Get a workload access token first (GetWorkloadAccessTokenForJWT in production), then pass it as workloadIdentityToken to GetResourceOauth2Token or GetResourceApiKey.
  2. When GetResourceOauth2Token returns authorizationUrl instead of accessToken, send the URL to the user and call again with the same sessionUri after consent.
  3. For user-delegated flows, host an HTTPS callback, register it with UpdateWorkloadIdentity as an allowed return URL, and call CompleteResourceTokenAuth after checking the user's session.
  4. Ask for refresh tokens in the provider's own way, such as access_type=offline in customParameters for Google or the offline_access scope for Microsoft and Atlassian.
  5. Treat a returned token as possibly revoked. On a 401 from the resource server, retry with forceAuthentication set to true.

Microsoft Entra Agent ID

  1. Request tokens in two steps. The blueprint gets an exchange token with fmi_path set to the agent identity's client ID, then the agent identity trades it for a resource token
  2. Retry with exponential backoff when a create returns 400 Object with id not found straight after creating its parent object
  3. Send displayName, agentIdentityBlueprintId and a sponsor reference when creating an agent identity. All three are required
  4. Don't use the interactive /authorize flow. Agent identities are confidential clients and can't sign in to a page
  5. Keep the sidecar off any public network. Its /AuthorizationHeader endpoint hands out tokens to whoever can reach it

Questions

Which is better for AI agents, Amazon Bedrock AgentCore Identity or Microsoft Entra Agent ID?

Amazon Bedrock AgentCore Identity and Microsoft Entra Agent ID score within a point of each other on agent readiness, 74.8 (BB) and 74.4 (BB). Microsoft Entra Agent ID leads on reliability and maintenance & community.

Do Amazon Bedrock AgentCore Identity and Microsoft Entra Agent ID need an API key?

Amazon Bedrock AgentCore Identity takes an API key or an OAuth sign-in. Microsoft Entra Agent ID uses an OAuth sign-in.

Can an agent call Amazon Bedrock AgentCore Identity and Microsoft Entra Agent ID without installing anything?

Yes. Amazon Bedrock AgentCore Identity has a hosted endpoint at https://bedrock-agentcore.us-east-1.amazonaws.com and Microsoft Entra Agent ID at https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity.

Other comparisons with Amazon Bedrock AgentCore Identity or Microsoft Entra Agent ID

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report