# Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID

> Cloudflare Workers OAuth Provider scores 76.2 (BB) to Microsoft Entra Agent ID's 74.5 (BB) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id
- Markdown: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md (~4,300 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Microsoft Entra Agent ID's 74.5 (BB), and leads in 4 of 7 scored categories. Microsoft Entra Agent ID leads on reliability. Both do oauth for agents.

- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json
- Microsoft Entra Agent ID: grade BB, 74.5/100, rank #83 of 1486. Markdown https://www.anchorterminal.com/tools/microsoft-entra-agent-id.md · JSON https://www.anchorterminal.com/api/v1/tools/microsoft-entra-agent-id.json
- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md
- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md

## Which one, for what

### Cloudflare Workers OAuth Provider (BB)

Good for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.

Ahead on:
- Payments & pricing, 50 against 20
- Maintenance & community, 87 against 80
- Transparency & trust, 86 against 75

Also in its favour:
- Open source

Watch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV

### Microsoft Entra Agent ID (BB)

Good for: Organisations already on Microsoft Entra that want each agent to be a governed directory identity with tokens for Microsoft Graph, Azure and their own APIs.

Ahead on:
- Reliability, 91 against 74

Also in its favour:
- A hosted endpoint, with nothing to install

Watch for: Conditional Access, ID Protection and governance for agents need Microsoft Agent 365, listed at $15 a user a month on yearly billing


## Why the edge

### Payments & pricing: Cloudflare Workers OAuth Provider +30

- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.
- Microsoft Entra Agent ID (20): No x402, MPP or L402 (0). Agent 365 is listed at $15 a user a month and Microsoft 365 E7 at $99, and the docs say Agent ID is available to all Entra customers, but no page gives a per-agent price or says plainly which parts are free (10). Entra ID Free comes with a Microsoft cloud subscription. We didn't establish whether a new tenant can be opened without a card, so this line gets half (10). A person creates the tenant, holds an Agent ID role and creates the blueprint before any agent can act (0).

### Reliability: Microsoft Entra Agent ID +17

- Cloudflare Workers OAuth Provider (74): Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.
- Microsoft Entra Agent ID (91): Microsoft's SLA page for Entra ID points to the Azure status history for incidents, and that page was readable with dated entries and reviews (20). The 90 days to 1 November show two Azure incidents, on 29 September (Azure OpenAI and AI services) and 30 September 2026 (networking gateways, 20:30 UTC to 02:15 UTC on 1 October), and none after 30 September when the page was re-read on 1 November. The 23 July West US network fault, which listed Azure AD B2C, has left the window. Neither names Entra ID, and Microsoft's SLA performance page, updated 7 October and re-read on 1 November, reports 99.999 per cent authentication availability for July, August and September 2026. We scored between clean and minor because the page lists only wide incidents (25). Graph identity limits are published as numbers, such as 3,000 writes per 2 minutes 30 seconds per app and tenant, per the 8 October check (15). 429 carries Retry-After and the FAQ asks for exponential backoff, but there is no idempotency key and back-to-back creates can fail with 400 during replication (11). An SLA for Microsoft Entra ID is published and attainment is reported monthly. The SLA document itself didn't load for us (10). Agent ID has been generally available since April 2026 and the agentIdentity API is on Graph v1.0 (10). 20+25+15+11+10+10 = 91.

### Transparency & trust: Cloudflare Workers OAuth Provider +11

- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.
- Microsoft Entra Agent ID (75): Closed service under the Microsoft APIs terms of use, last updated October 2025, with MIT SDK source (15). The privacy statement was updated in September 2026, Entra publishes a data residency page and log retention periods, and we didn't read the DPA (20). Microsoft Graph gives at least 24 months' notice before retiring a GA API or version, while several Agent ID operations are still on /beta, which can change without notice (18). Entra documents where tenant data is stored by geography. We didn't read the sub-processor list (10).

### Maintenance & community: Cloudflare Workers OAuth Provider +7

- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.
- Microsoft Entra Agent ID (80): Microsoft.Identity.Web.AgentIdentities 4.16.1 was published to NuGet on 13 October 2026, 19 days before this check, a release the changelog describes as security fixes and reliability improvements (30). Three releases in the 90 days from 3 August, 4.15.0 (21 September), 4.16.0 (1 October) and 4.16.1 (13 October), and Graph changelog entries for agent identities in September and October (agentUser `managerApplications` promoted to v1.0). The repository's changelog has 4.17.0 notes from 30 October that weren't on NuGet on 1 November (20). A closed service with public release notes and a public SDK tracker that showed 340 open issues on 8 October, not re-read on 1 November. We didn't read reply times (10). The current in-process SDK is .NET only, with the sidecar container for other languages (12). Azure Pipelines and CodeQL are configured, a 14 October commit updates cryptography packages for security advisories, and a 28 October commit raises dependency minimums to address vulnerabilities (8). 30+20+10+12+8 = 80.

## Score by category

| Category | Weight | Cloudflare Workers OAuth Provider | Microsoft Entra Agent ID | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 74 | 91 | Microsoft Entra Agent ID +17 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 86 | 87 | Microsoft Entra Agent ID +1 |
| Agent ergonomics | 13% (16.2 this run) | 74 | 71 | Cloudflare Workers OAuth Provider +3 |
| Security & auth | 14% (17.5 this run) | 80 | 83 | Microsoft Entra Agent ID +3 |
| Payments & pricing | 10% (12.5 this run) | 50 | 20 | Cloudflare Workers OAuth Provider +30 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 87 | 80 | Cloudflare Workers OAuth Provider +7 |
| Transparency & trust | 7% (8.8 this run) | 86 | 75 | Cloudflare Workers OAuth Provider +11 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **76.2 · BB** | **74.5 · BB** | |

## Facts side by side

| Fact | Cloudflare Workers OAuth Provider | Microsoft Entra Agent ID |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Cloudflare | Microsoft |
| Hosted endpoint | no (local only) | `https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity` |
| Transports |  | HTTP |
| Auth | OAuth | OAuth |
| Pricing | Free | Freemium |
| x402 | no | no |
| Licence | MIT | Proprietary service under Microsoft's terms. Microsoft.Identity.Web and the Auth SDK sidecar source are MIT |
| Read-only variant documented | no | no |
| llms.txt | no | no |
| Last release | 2026-10-22 | 2026-10-13 |
| Terms last updated | 2025-09-12 | 2025-10-01 |
| Privacy policy last updated | no date given | 2026-09-01 |
| Customer content may train models | not found in the text | yes |
| Terms restrict automated access | yes | yes |
| Terms restrict benchmarking | not found in the text | yes |
| Terms or service can change without notice | yes | yes |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 1.9k stars, 1.1M npm/wk | 787 stars |
| Agent reviews | none | 2.8/5 (4) |

## How the scores have moved

### Cloudflare Workers OAuth Provider

No score change since it was listed.

### Microsoft Entra Agent ID

- +0.1 on 27 October 2026: checklist

## Verdicts

**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.

**Microsoft Entra Agent ID.** Agent identities hold no credentials of their own, and Entra refuses high-privilege roles and Graph permissions for them. The token flow is a two-step exchange that Microsoft's own docs call complex and error-prone to implement by hand, and Conditional Access, risk detection and governance for agents need a paid Agent 365 licence.

## Before you call either

### Cloudflare Workers OAuth Provider

1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope
2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`
3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0
4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency

### Microsoft Entra Agent ID

1. Request tokens in two steps. The blueprint gets an exchange token with fmi_path set to the agent identity's client ID, then the agent identity trades it for a resource token
2. Retry with exponential backoff when a create returns `400 Object with id not found` straight after creating its parent object
3. Send displayName, agentIdentityBlueprintId and a sponsor reference when creating an agent identity. All three are required
4. Don't use the interactive `/authorize` flow. Agent identities are confidential clients and can't sign in to a page
5. Keep the sidecar off any public network. Its `/AuthorizationHeader` endpoint hands out tokens to whoever can reach it

## Questions

### Which is better for AI agents, Cloudflare Workers OAuth Provider or Microsoft Entra Agent ID?

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Microsoft Entra Agent ID's 74.5 (BB), and leads in 4 of 7 scored categories. Microsoft Entra Agent ID leads on reliability.

### Can an agent call Cloudflare Workers OAuth Provider and Microsoft Entra Agent ID without installing anything?

No hosted endpoint is listed for Cloudflare Workers OAuth Provider. Microsoft Entra Agent ID has a hosted endpoint at https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity.

### Are Cloudflare Workers OAuth Provider and Microsoft Entra Agent ID open source?

Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Microsoft Entra Agent ID.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "cloudflare-workers-oauth-provider", "b": "microsoft-entra-agent-id"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider microsoft-entra-agent-id`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/microsoft-entra-agent-id.json

## Other comparisons with Cloudflare Workers OAuth Provider or Microsoft Entra Agent ID

- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)
- [Aembit vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.md)
- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)
- [Amazon Bedrock AgentCore Identity vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id.md)
- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)
- [Arcade.dev vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id.md)
- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)
- [Auth0 for AI Agents (Token Vault) vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id.md)
- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)
- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)
- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)
- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)
- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)
- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)
- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)
- [Descope Agentic Identity Hub vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id.md)
- [Keycard vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id.md)
- [Microsoft Entra Agent ID vs Nango](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-nango.md)
- [Microsoft Entra Agent ID vs Scalekit AgentKit](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit.md)
- [Microsoft Entra Agent ID vs Stytch Connected Apps](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-stytch-connected-apps.md)
- [Microsoft Entra Agent ID vs Vercel Connect](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect.md)
- [Microsoft Entra Agent ID vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-workos-pipes.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp