Practice Checkpoint 2: Setting Agent Identity Permissions

A hands-on checkpoint walking through Entra ID's three agent authentication flows (autonomous, OBO, agent-user), decoding tokens to show how claims map to blueprints, identities and permissions.

Chapter four of the Semperis guide dissects Agent ID design: how blueprints, agent identities and agent users map to the Microsoft Graph data model, and how permission types stack up.

Three OAuth techniques attackers use in Azure, and how Entra ID sign-in logs and JWT claims expose them; includes Wiz telemetry on prevalence and ready-to-use KQL detection queries.

Chapter six of Semperis' Entra ID agent-identity guide covers common misconfigurations: agent IDs without owners or sponsors, blueprints relying on client secrets, and over-privileged agents.

Chapter five of the Semperis guide explains Microsoft's Agent Registry as the inventory and governance plane for agents, distinct from Entra Agent ID, and how agents authenticate in three flows.

Semperis' first practice checkpoint builds a real Entra ID Agent ID object set — blueprint, blueprint principal, credentials, agent identity and agent user — using Microsoft Graph and PowerShell.