Practice Checkpoint 4: Verifying Tokens and Claims in 3 Entra ID Authentication Flows

Semperis practice checkpoint two wires up the Entra ID agent permission model: direct app-only roles on the agent identity plus inheritable delegated permissions granted at the blueprint level.

Three OAuth techniques attackers use in Azure, and how Entra ID sign-in logs and JWT claims expose them; includes Wiz telemetry on prevalence and ready-to-use KQL detection queries.

Chapter four of the Semperis guide dissects Agent ID design: how blueprints, agent identities and agent users map to the Microsoft Graph data model, and how permission types stack up.

Chapter six of Semperis' Entra ID agent-identity guide covers common misconfigurations: agent IDs without owners or sponsors, blueprints relying on client secrets, and over-privileged agents.

Chapter five of the Semperis guide explains Microsoft's Agent Registry as the inventory and governance plane for agents, distinct from Entra Agent ID, and how agents authenticate in three flows.

Semperis' first practice checkpoint builds a real Entra ID Agent ID object set — blueprint, blueprint principal, credentials, agent identity and agent user — using Microsoft Graph and PowerShell.