AIM vs Microsoft Entra Agent ID
Microsoft Entra Agent ID extends Microsoft Entra ID, Microsoft's cloud identity service, to AI agents. Each agent gets an agent identity created from a blueprint, requests OAuth tokens from Entra on its own behalf or on behalf of a user, and can be covered by Conditional Access, ID Protection and the Entra logs. AIM (Agent Identity Management) is an open source platform for AI agent identity. It keeps a registry of agents: each agent has an Ed25519 key, a trust score and a list of capabilities checked through an SDK, and MCP servers are attested by the agents that use them.
The two cover different layers. The open source build of AIM has no built-in integration with Microsoft Entra or any other identity provider, and it does not replace one. The hosted AIM Cloud adds Google sign-in.
Checked on against Microsoft Learn and AIM at commit 3ab8285e, opens in a new tab. Microsoft Entra is a cloud service with no version number, so each Microsoft source names, in UTC, the date its page shows as last updated. Learn writes that date in the reader's own time zone, so it can read a day earlier or later. To report a line that is wrong, use the contact page.
Capability by capability
Signing people in
Microsoft Entra Agent ID
Documented. Microsoft Entra ID is "a cloud-based identity and access management service that provides authentication, policy enforcement, and protection for users, devices, apps, and resources."
Source: What is Microsoft Entra, updated 2026-06-18, opens in a new tab
AIM
The dashboard has local email and password sign-in. No single sign-on, OpenID Connect or SAML login is wired in the open source build: the repository contains Google, Microsoft and Okta provider code, but no login route calls it.
Agent identities
Microsoft Entra Agent ID
Documented. "An agent identity is a special service principal in Microsoft Entra ID." Each is created from an agent identity blueprint, can record a sponsor (the person or group accountable for the agent), and can be paired with an agent's user account for systems that require a user account. Microsoft documents integrating agents built outside Microsoft, from platforms such as AWS Bedrock and n8n, through the Microsoft Entra ID Auth SDK (sidecar) or workload identity federation.
Source: Overview of agent identities, updated 2026-05-01, opens in a new tab, What is Microsoft Entra Agent ID, updated 2026-06-24, opens in a new tab
AIM
Each agent is registered with its own Ed25519 public key. The token endpoint accepts one grant: a JWT-bearer assertion signed with that key, in exchange for a bearer token for AIM's own agent API. AIM does not implement the client credentials grant: the token endpoint refuses it.
Source: agent_service.go, opens in a new tab, oauth_token_handler.go, opens in a new tab
Credentials
Microsoft Entra Agent ID
"Agent identities don't have credentials of their own." The agent identity blueprint holds them and requests tokens on the agent identity's behalf: federated identity credentials, certificates or cryptographic keys, and client secrets. Managed identities are documented as "the preferred credential type", and client secrets "shouldn't be used as client credentials in production environments".
Source: Overview of agent identities, updated 2026-05-01, opens in a new tab, Authentication protocols in agents, updated 2026-06-11, opens in a new tab
AIM
An agent can sign each request with its Ed25519 key. On routes behind the request-signature check, the server verifies the signature over the method, path, timestamp and body, and rejects a timestamp more than 30 seconds from its own clock. The action-check request is signed over the action's fields (agent, capability, resource, context and timestamp) and verified against the agent's registered key. Agent routes also accept an API key or a bearer token in place of a signature.
OAuth flows and delegation
Microsoft Entra Agent ID
Agent identities use the client credentials grant for autonomous work and the JWT-bearer grant for the on-behalf-of flow, in which the token's subject is the user and its actor is the agent identity. Refresh tokens carry user context through long-running work. Interactive (/authorize) flows are not supported for agents, and every agent is a confidential client.
Source: Authentication protocols in agents, updated 2026-06-11, opens in a new tab, Overview of agent identities, updated 2026-05-01, opens in a new tab
AIM
OAuth token exchange (RFC 8693) is not implemented: the agent token endpoint accepts the JWT-bearer grant only. Delegation exists outside OAuth, in the TypeScript SDK, which creates and verifies Ed25519-signed delegation chains between keys. The AIM server does not issue or check them.
Source: oauth_token_handler.go, opens in a new tab, delegation.ts, opens in a new tab
Permissions
Microsoft Entra Agent ID
Access rights given directly to an agent identity "can include Microsoft Graph permissions, Azure RBAC roles, Microsoft Entra directory roles, Microsoft Entra app roles, and more." A blueprint declares the permissions its agents need for administrators to review, and permissions granted on a blueprint from a resource it marks as inheritable reach every agent identity created from it.
Source: What are agent identities, updated 2026-06-15, opens in a new tab, Agent identity blueprints, updated 2026-05-01, opens in a new tab
AIM
Each agent has a list of granted capabilities. The SDK, running inside the agent process, sends each wrapped action to the server, which compares the capability name with that list. In the default mode (monitoring) a capability outside the list is allowed and, under the default policy, raises an alert. The Python SDK's decorator also registers a capability on first use, and in this mode the server grants it automatically. In strict mode a capability outside the list is denied under the default policy, and the SDK blocks the call.
Source: agent_service.go, opens in a new tab, enforcement.py, opens in a new tab
Risk signals and access policy
Microsoft Entra Agent ID
Conditional Access for agents is evaluated "whenever Microsoft Entra ID issues or refreshes an access token". A policy can target agent identities, agents' user accounts or every agent identity created from a blueprint. ID Protection flags agents from offline detections such as unfamiliar resource access, sign-in spikes and failed access attempts, and an administrator who confirms an agent compromised sets its risk to high. Conditional Access does not apply when an agent reaches a resource with an API key instead of an Entra token.
Source: Conditional Access for agents, updated 2026-09-30, opens in a new tab, ID Protection for agents, updated 2026-06-17, opens in a new tab
AIM
Each agent has a trust score calculated from nine weighted factors; a factor with no data is left out of the weighted sum. It is recalculated on events such as registration, verification by an administrator, capability changes and capability reports from the SDK. A capability violation also lowers the stored score directly. Each action check reads the stored score.
MCP servers
Microsoft Entra Agent ID
Documented. Microsoft Learn has a guide to configuring Microsoft Entra ID "as the authorization server for your MCP server", with the MCP server as an OAuth 2.0 protected resource. When the MCP client is an agent, the guide says to use Agent ID "so the agent authenticates with its own identity instead of an embedded secret".
Source: Secure an MCP server with Microsoft Entra ID, updated 2026-09-03, opens in a new tab
AIM
AIM is not an OAuth authorization server for MCP. Agents submit signed attestations of the MCP servers they connect to, and the server checks each signature against the agent's registered key. A drift alert is raised when a capability detection run finds that a server's manifest has changed since the last run.
Source: mcp_attestation_service.go, opens in a new tab, mcp_manifest_service.go, opens in a new tab
Workload identity
Microsoft Entra Agent ID
Workload identity federation is one of the two documented ways to integrate an agent built outside Microsoft. A blueprint can authenticate with federated identity credentials, and managed identities are the documented preferred credential.
Source: What is Microsoft Entra Agent ID, updated 2026-06-24, opens in a new tab, Authentication protocols in agents, updated 2026-06-11, opens in a new tab
AIM
Not implemented for agents at this commit: AIM accepts no SPIFFE identity, Kubernetes service account token or external OpenID Connect issuer as an agent credential.
Source: oauth_token_handler.go, opens in a new tab, pqc_agent_auth.go, opens in a new tab
Audit
Microsoft Entra Agent ID
Agent activity is written to the Entra audit logs under the identity type it comes from, with an agentType property that marks agent involvement. Agent sign-ins have their own event type, agentSignIn, and the sign-in logs can be filtered by agent type.
Source: Microsoft Entra Agent ID logs, updated 2026-05-01, opens in a new tab
AIM
An action check that passes its signature check is written to the audit log as a row with the agent, the capability, the resource, the stored trust score and whether it was allowed. The write is best effort: if it fails, the check still returns its decision. The log is not append-only at the database layer and is not signed.
Source: verification_handler.go, opens in a new tab, audit_log_repository.go, opens in a new tab, SECURITY.md, opens in a new tab
License and hosting
Microsoft Entra Agent ID
A Microsoft cloud service. "Agent ID is available for all Microsoft Entra customers." Extending Entra security features to agents, Conditional Access among them, requires Microsoft Agent 365, which Microsoft lists as included with Microsoft 365 E7 and as an add-on to Microsoft E5, A5 and Business Premium.
Source: What is Microsoft Entra Agent ID, updated 2026-06-24, opens in a new tab, Conditional Access for agents, updated 2026-09-30, opens in a new tab, What is Microsoft Entra, updated 2026-06-18, opens in a new tab
AIM
The repository is Apache-2.0. Self-hosted with Docker Compose. Also offered as a hosted service, AIM Cloud, which is built from a private mirror of the repository with cloud-only additions.
Source: LICENSE, opens in a new tab, docs/DEPLOYMENT.md, opens in a new tab, docker-compose.quickstart.yml, opens in a new tab
Which layer each one covers
Microsoft Entra Agent ID
- Giving each agent an identity in the Entra tenant, created from a blueprint.
- Issuing OAuth tokens to agents, on their own behalf or on behalf of a user.
- Applying Conditional Access and risk detection to agents when tokens are issued.
- Acting as the authorization server in front of MCP servers.
AIM
- Keeping a registry of agents, each with its own key.
- Scoring each agent and recording the action checks it submits.
- Checking each action an agent submits against its granted capabilities.
- Recording which MCP servers agents attest to, and alerting when a detection run finds a server's manifest changed.
A team can run both: Entra Agent ID for agent identities, OAuth tokens and access policy in a Microsoft tenant, AIM for its registry of agents and their action checks. AIM has no integration with Microsoft Entra at this commit. Agents authenticate to AIM with their own keys or an AIM API key, and in the open source build people sign in to the AIM dashboard with a local account.
Registering an agent with AIM
In the Python SDK, secure() registers an agent and perform_action wraps the actions to be checked. secure() needs credentials first, from aim-sdk login or an SDK downloaded from the dashboard. For a self-hosted server, AIM's README at this commit says to create the agent in the dashboard first. The capability name on the decorator is what the server compares with the agent's grants. The resource is recorded with the check and is not compared.
from aim_sdk import secure
agent = secure("my-agent")
@agent.perform_action("db:read", resource="users_table")
def get_user_data(user_id):
...