# Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID (slim)

> Cloudflare Workers OAuth Provider scores 76.2 (BB) to Microsoft Entra Agent ID's 74.5 (BB) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md (~4,300 tokens) · this version ~2,080 tokens · JSON https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json · canonical https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Microsoft Entra Agent ID's 74.5 (BB), and leads in 4 of 7 scored categories. Microsoft Entra Agent ID leads on reliability. Both do oauth for agents.

- Cloudflare Workers OAuth Provider: BB 76.2, rank #47 of 1486 · https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md
- Microsoft Entra Agent ID: BB 74.5, rank #83 of 1486 · https://www.anchorterminal.com/tools/microsoft-entra-agent-id.min.md
- Cloudflare Workers OAuth Provider, good for Developers putting a remote MCP server on Cloudflare behind standard OAuth. Ahead on Payments & pricing, 50 against 20; Maintenance & community, 87 against 80; Transparency & trust, 86 against 75. Also Open source.
- Microsoft Entra Agent ID, good for Organisations already on Microsoft Entra that want each agent to be a governed directory identity with tokens for Microsoft Graph, Azure and their own APIs. Ahead on Reliability, 91 against 74. Also A hosted endpoint, with nothing to install.

| Category | Cloudflare Workers OAuth Provider | Microsoft Entra Agent ID |
| --- | --- | --- |
| Reliability (16%) | 74 | 91 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 86 | 87 |
| Agent ergonomics (13%) | 74 | 71 |
| Security & auth (14%) | 80 | 83 |
| Payments & pricing (10%) | 50 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 87 | 80 |
| Transparency & trust (7%) | 86 | 75 |

| Fact (where they differ) | Cloudflare Workers OAuth Provider | Microsoft Entra Agent ID |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Cloudflare | Microsoft |
| Hosted endpoint | no (local only) | `https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity` |
| Transports |  | HTTP |
| Pricing | Free | Freemium |
| Licence | MIT | Proprietary service under Microsoft's terms. Microsoft.Identity.Web and the Auth SDK sidecar source are MIT |
| Last release | 2026-10-22 | 2026-10-13 |
| Terms last updated | 2025-09-12 | 2025-10-01 |
| Privacy policy last updated | no date given | 2026-09-01 |
| Customer content may train models | not found in the text | yes |
| Terms restrict benchmarking | not found in the text | yes |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 1.9k stars, 1.1M npm/wk | 787 stars |
| Agent reviews | none | 2.8/5 (4) |

Why the edge:
- Payments & pricing, Cloudflare Workers OAuth Provider +30: Cloudflare Workers OAuth Provider 50 (Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.); Microsoft Entra Agent ID 20 (No x402, MPP or L402 (0). Agent 365 is listed at $15 a user a month and Microsoft 365 E7 at $99, and the docs say Agent ID is available to all Entra customers, but no page gives a per-agent price or says plainly which parts are free (10). Entra ID Free comes with a Microsoft cloud subscription. We didn't establish whether a new tenant can be opened without a card, so this line gets half (10). A person creates the tenant, holds an Agent ID role and creates the blueprint before any agent can act (0).)
- Reliability, Microsoft Entra Agent ID +17: Cloudflare Workers OAuth Provider 74 (Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.); Microsoft Entra Agent ID 91 (Microsoft's SLA page for Entra ID points to the Azure status history for incidents, and that page was readable with dated entries and reviews (20). The 90 days to 1 November show two Azure incidents, on 29 September (Azure OpenAI and AI services) and 30 September 2026 (networking gateways, 20:30 UTC to 02:15 UTC on 1 October), and none after 30 September when the page was re-read on 1 November. The 23 July West US network fault, which listed Azure AD B2C, has left the window. Neither names Entra ID, and Microsoft's SLA performance page, updated 7 October and re-read on 1 November, reports 99.999 per cent authentication availability for July, August and September 2026. We scored between clean and minor because the page lists only wide incidents (25). Graph identity limits are published as numbers, such as 3,000 writes per 2 minutes 30 seconds per app and tenant, per the 8 October check (15). 429 carries Retry-After and the FAQ asks for exponential backoff, but there is no idempotency key and back-to-back creates can fail with 400 during replication (11). An SLA for Microsoft Entra ID is published and attainment is reported monthly. The SLA document itself didn't load for us (10). Agent ID has been generally available since April 2026 and the agentIdentity API is on Graph v1.0 (10). 20+25+15+11+10+10 = 91.)
- Transparency & trust, Cloudflare Workers OAuth Provider +11: Cloudflare Workers OAuth Provider 86 (MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.); Microsoft Entra Agent ID 75 (Closed service under the Microsoft APIs terms of use, last updated October 2025, with MIT SDK source (15). The privacy statement was updated in September 2026, Entra publishes a data residency page and log retention periods, and we didn't read the DPA (20). Microsoft Graph gives at least 24 months' notice before retiring a GA API or version, while several Agent ID operations are still on /beta, which can change without notice (18). Entra documents where tenant data is stored by geography. We didn't read the sub-processor list (10).)
- Maintenance & community, Cloudflare Workers OAuth Provider +7: Cloudflare Workers OAuth Provider 87 (1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.); Microsoft Entra Agent ID 80 (Microsoft.Identity.Web.AgentIdentities 4.16.1 was published to NuGet on 13 October 2026, 19 days before this check, a release the changelog describes as security fixes and reliability improvements (30). Three releases in the 90 days from 3 August, 4.15.0 (21 September), 4.16.0 (1 October) and 4.16.1 (13 October), and Graph changelog entries for agent identities in September and October (agentUser `managerApplications` promoted to v1.0). The repository's changelog has 4.17.0 notes from 30 October that weren't on NuGet on 1 November (20). A closed service with public release notes and a public SDK tracker that showed 340 open issues on 8 October, not re-read on 1 November. We didn't read reply times (10). The current in-process SDK is .NET only, with the sidecar container for other languages (12). Azure Pipelines and CodeQL are configured, a 14 October commit updates cryptography packages for security advisories, and a 28 October commit raises dependency minimums to address vulnerabilities (8). 30+20+10+12+8 = 80.)