IAgenticTokenProvider Interface
Definition
Important
Some information relates to prerelease product that may be substantially modified before it’s released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Provides access tokens for the agentic identity chain used by Agent 365 / Agent ID scenarios.
public interface IAgenticTokenProvidertype IAgenticTokenProvider = interfacePublic Interface IAgenticTokenProvider- Derived
Remarks
Agentic identity is a layered model in which each token in the chain is used to acquire the next:
- Application (blueprint) — a token-exchange credential bound to the agent application instance (the federated managed identity). Acquired via GetAgenticApplicationTokenAsync(String, String, CancellationToken).
- Instance — an autonomous-agent token, obtained by exchanging the application token. Acquired via GetAgenticInstanceTokenAsync(String, String, CancellationToken) or its scoped overload.
- Agentic user — a token that represents the agent acting on behalf of a specific agentic user. Acquired via GetAgenticUserTokenAsync(String, String, String, IList<String>, CancellationToken).
Implementations resolve this chain differently. The MSAL-based provider performs each exchange locally (using api://AzureAdTokenExchange/.default and federated managed identity / FMI paths), while the Entra Auth Sidecar provider delegates the full chain to an external sidecar process that owns the agent credential. A connection-level token provider exposes this interface when it supports agentic flows; callers typically obtain it through AgenticAuthorization.
Methods
| Name | Description |
|---|---|
| GetAgenticApplicationTokenAsync(String, String, CancellationToken) |
Acquires the agentic application (blueprint) token for the specified agent application instance. This is a token-exchange-scoped token bound to the agent instance via federated managed identity, and forms the root of the agentic identity chain. |
| GetAgenticInstanceTokenAsync(String, String, CancellationToken) |
Acquires the agentic instance (autonomous-agent) token for the specified agent application instance using the provider's default scope. |
| GetAgenticInstanceTokenAsync(String, String, IList<String>, CancellationToken) |
Acquires the agentic instance (autonomous-agent) token for the specified agent application instance and the requested scopes. |
| GetAgenticUserTokenAsync(String, String, String, IList<String>, CancellationToken) |
Acquires an agentic user token that represents the agent acting on behalf of a specific agentic user for the requested scopes. |