Copilot Studio · Entra Agent ID · OpenID Federation
Every Copilot Studio agent, named in the token.
The Entra bridge gives each Microsoft Copilot Studio agent its own verifiable identity outside Azure. The token your APIs receive names the customer in sub and the specific agent in act.sub.
// delegated token issued by PingFederate { "iss": "<PingFederate issuer>", "aud": "https://api.northwind.example/bank", "sub": "<the customer>", "act": { "sub": "https://<bridge>/agents/<slug>" }, "client_id": "https://<bridge>/agents/<slug>" }
One token. Your audit log gets the customer and the agent on every call.
The problem
To your APIs, every Copilot Studio agent in the tenant is the same caller
Every Copilot Studio agent in a tenant authenticates through one Microsoft-owned agent blueprint. No token exists that proves which agent is calling, for the maker or for the tenant administrator. Microsoft's custom connector runtime does not pass agent context to an external resource.
One shared blueprint
Nobody, a tenant administrator included, can mint a token as an individual Copilot Studio agent.
No agent context at your API
In the path we tested, a custom connector called from a Copilot Studio agent, the external API received no verifiable agent identifier.
No answer in the audit log
If an agent moves money, the log records that an agent did it. You cannot write policy for one agent, and you cannot revoke one.
What the bridge does
Four steps from "some agent called" to "this agent called, and here is the proof"
The bridge gives each registered agent its own Entra identity, the mirror identity. It is created once, at onboarding, under a blueprint you control and not Microsoft's.
The gateway names the caller
Each agent's Copilot Studio connection holds its own secret. The gateway checks the secret's SHA-256 fingerprint in constant time and resolves the call to exactly one registered agent. This is the single shared-secret step in the chain.
The gateway collects real Entra evidence
It acquires a tenant-signed token as that agent's mirror identity, through the same Federated Identity Credential chain Entra Agent ID uses. Every step after this one is a signature.
An isolated service verifies the evidence at source
The attestation service accepts calls only on internal ingress. It verifies the raw mirror token against the tenant's own keys, then signs a client attestation naming the agent.
PingFederate issues the delegated token
An RFC 8693 token exchange, authenticated by the attestation and a single-use proof of possession. PingFederate resolves the attester's key through an OpenID Federation trust chain sent with the request.
The picture
Three services, three custody scopes
The gateway can obtain evidence but cannot sign. The attestation service can sign but cannot obtain evidence. The bridge holds only the keys that sign federation statements. No single service can produce a usable credential.
flowchart TD
CS["Copilot Studio agent"]
GW["gateway-agent<br/>checks the connection key, obtains an Entra token<br/>as this agent's mirror identity<br/>holds no keys, signs nothing"]
BR["bridge<br/>builds the agent's OpenID Federation trust chain<br/>holds federation keys only"]
AT["attestation-service<br/>verifies the mirror token against the tenant keys,<br/>signs the attestation and a fresh proof of possession"]
PF["PingFederate<br/>RFC 8693 token exchange<br/>attester key resolved from the trust chain"]
TA["task agents, then PEP, AuthZEN,<br/>PingAuthorize and the bank API"]
CS -- "user token, agent id, connection key" --> GW
GW -- "user token + mirror token" --> BR
BR -- "POST /attest" --> AT
AT -- "attestation + PoP" --> BR
BR -- "token exchange" --> PF
PF -- "delegated token" --> BR
BR -- "A2A call" --> TA
sub = the customer and act.sub = https://<bridge>/agents/<slug>.You onboard agents without touching PingFederate's keys
Each agent is an OpenID Federation leaf under the bridge. PingFederate learns the agent's attestation key from the trust chain, so no per-agent key is ever configured in the authorisation server.
Policy can read the trust level
Every attestation carries the verification tier of each hop. The demo requires the cryptographic tier before it permits higher-value operations. You set that bar where you need it.
Where it stands
Demonstrated end to end, reviewed, and honest about its limits
The chain was verified end to end in August 2026 with one Copilot Studio agent. A Microsoft identity specialist reviewed the design in October 2026. The design review tracks seven outcomes.
Demonstrated
One federation entity per agent. The right agent maps to the right entity.
Partial, with a stated gap
Microsoft-issued evidence per call, customer delegation, no long-lived secrets, split signing authority.
Proposed
Fully automated onboarding that touches Entra and not PingFederate's key configuration.
The one weak link, in writing. The binding between a Copilot Studio agent and its mirror identity is a provisioned secret. Microsoft exposes nothing stronger today. The honest claim is: this request came from whoever holds this agent's connection secret. The attestation records that claim at its real strength, and policy can act on it. If Microsoft ships verifiable agent context later, the mirror layer is removed and nothing below it changes.
Explore
The work, section by section
Architecture
Components, one request end to end, the federation records, the attestation and the token exchange.
Read the mechanismSecurity
What each control defends against, the single-service compromise model, trust tiers and known limits.
Read the propertiesNetworking
Every hop from Copilot Studio to the bridge and on to AWS, with a target topology for an enterprise tenant.
Read the network designDesign review
The seven outcomes, the Microsoft specialist's feedback, our position on each point and the changes in order.
Read the reviewOnboarding
The steps to register a new agent, rotate its connection key and handle a step-up approval.
Read the runbookReference
The decision register, named risks, the terms used for each identity and the standards the design uses.
Read the reference