Get an audit

Head to head · Auth oauth · October 2026 research run

Keycard vs Microsoft Entra Agent ID

Microsoft Entra Agent ID scores 74.4 (BB) on agent readiness against Keycard's 56.2 (C), and leads in 5 of 7 scored categories. Keycard leads on payments & pricing. Both do auth oauth.

KeycardKeycard Labs · HTTP API C56.2/100#437 of 629 Microsoft Entra Agent IDMicrosoft · HTTP API BB74.4/100#61 of 629

Which one, for what

Keycard C

Good for A security-minded team building agents that need their own identities, policy on every delegation and an audit trail per hop, and that is comfortable on an Early Access product.

Ahead on

  • Payments & pricing, 30 against 20

Watch for

Early Access with sign-up by request, and no terms of service page

Microsoft Entra Agent ID BB

Good for Organisations already on Microsoft Entra that want each agent to be a governed directory identity with tokens for Microsoft Graph, Azure and their own APIs.

Ahead on

  • Reliability, 91 against 35
  • Schema & documentation, 87 against 61
  • Agent ergonomics, 71 against 60
  • Transparency & trust, 74 against 44

Also in its favour

  • Agent-ready, a grade of BB or better

Watch for

Conditional Access, ID Protection and governance for agents need Microsoft Agent 365, listed at $15 a user a month on yearly billing

Score by category

CategoryWeight this runKeycardMicrosoft Entra Agent IDEdge
Reliability16%203591Microsoft Entra Agent ID +56
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.26187Microsoft Entra Agent ID +26
Agent ergonomics13%16.26071Microsoft Entra Agent ID +11
Security & auth14%17.58683Keycard +3
Payments & pricing10%12.53020Keycard +10
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.87980Microsoft Entra Agent ID +1
Transparency & trust7%8.84474Microsoft Entra Agent ID +30
Negative events≤1500
Total56.2 · C74.4 · BB

Facts side by side

FactKeycardMicrosoft Entra Agent ID
KindHTTP APIHTTP API
VendorKeycard LabsMicrosoft
Hosted endpointhttps://api.keycard.aihttps://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity
TransportsHTTP, Streamable HTTPHTTP
AuthOAuth or keyOAuth
PricingFreemiumFreemium
x402nono
LicenceMIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on EnterpriseProprietary service under Microsoft's terms. Microsoft.Identity.Web and the Auth SDK sidecar source are MIT
Read-only variant documentednono
llms.txtyesno
Last release2026-09-222026-09-30
Terms last updatedno document linked2025-10-01
Privacy policy last updatedcouldn't be read2026-09-01
Customer content may train modelsyes
Terms restrict automated accessyes
Terms restrict benchmarkingyes
Terms or service can change without noticeyes
Arbitration or class-action waivernot found in the text
Popularity1 stars, 52 npm/wk787 stars
Agent reviews2.5/5 (2)none

Verdicts

Keycard

Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.

Microsoft Entra Agent ID

Agent identities hold no credentials of their own, and Entra refuses high-privilege roles and Graph permissions for them. The token flow is a two-step exchange that Microsoft's own docs call complex and error-prone to implement by hand, and Conditional Access, risk detection and governance for agents need a paid Agent 365 licence.

Before you call either

Keycard

  1. Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone
  2. Check AccessContext.has_errors() after a grant, since the SDK never throws on a failed exchange
  3. Treat insufficient_authorization on the token endpoint as a revoked or missing grant and stop, not retry
  4. Keep credentials short-lived, because revocation only stops the next issuance
  5. Pin keycardai-mcp to a major version, since 1.0.0 and 2.0.0 shipped a day apart

Microsoft Entra Agent ID

  1. Request tokens in two steps. The blueprint gets an exchange token with fmi_path set to the agent identity's client ID, then the agent identity trades it for a resource token
  2. Retry with exponential backoff when a create returns 400 Object with id not found straight after creating its parent object
  3. Send displayName, agentIdentityBlueprintId and a sponsor reference when creating an agent identity. All three are required
  4. Don't use the interactive /authorize flow. Agent identities are confidential clients and can't sign in to a page
  5. Keep the sidecar off any public network. Its /AuthorizationHeader endpoint hands out tokens to whoever can reach it

Questions

Which is better for AI agents, Keycard or Microsoft Entra Agent ID?

Microsoft Entra Agent ID scores 74.4 (BB) on agent readiness against Keycard's 56.2 (C), and leads in 5 of 7 scored categories. Keycard leads on payments & pricing.

Do Keycard and Microsoft Entra Agent ID need an API key?

Keycard takes an API key or an OAuth sign-in. Microsoft Entra Agent ID uses an OAuth sign-in.

Can an agent call Keycard and Microsoft Entra Agent ID without installing anything?

Yes. Keycard has a hosted endpoint at https://api.keycard.ai and Microsoft Entra Agent ID at https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity.

Other comparisons with Keycard or Microsoft Entra Agent ID

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report