azure-identity-for-agents

You bind agents to Entra identities by configuring managed identities for workload access and on-behalf-of flows for user-private data, enforcing strict RBAC boundaries and credential-free SDK operation.

On-behalf-of access preserves user permissions during private data and API calls. You need it when an agent must act on behalf of a specific user to maintain tenant-scoped boundaries and prevent data leakage.

You configure policy-managed tool connections by binding agent access to Entra identities, replacing stored credentials with managed identities or service principals to enforce strict permission boundaries.

Yes, Entra identity governance supports both scenarios by using managed identities for workload access to shared resources and on-behalf-of flows to preserve user permissions in tenant-scoped operations.

You need RBAC boundaries to prevent data leakage across tenant-scoped operations, ensuring agents only access permitted grounding sources and shared resources based on their Entra identity mode.

Yes, you can use service principals where appropriate, alongside managed identities and on-behalf-of flows, to define explicit identity modes and enforce strict RBAC boundaries for tool calls.