Identity and access overview for Foundry Agent Service

Identity and access decisions in Agent Service span three boundaries: management access to Foundry resources, caller access to the agent endpoint, and agent access to downstream tools or resources. Each boundary has its own authentication and authorization configuration.

Use this overview to understand those boundaries and find the detailed guidance for each access decision.

Identity boundaries in Agent Service

Authentication and authorization occur at three independent boundaries:

  • Developer or administrator to Foundry resources: A user or service identity must be allowed to create, configure, update, or delete projects, agents, and related resources.
  • Caller to agent endpoint: A user, application, service identity, or channel must be allowed to call the agent endpoint at runtime.
  • Agent to downstream tool or resource: When the agent calls a tool, the downstream request uses an authentication method supported by that tool. Depending on the configuration, the request can represent the agent, the project, or the signed-in user; use a connection-specific credential; or require no authentication. The downstream service then makes its own authorization decision.

Permissions don't carry across these boundaries. A principal with permission to manage an agent isn't automatically authorized to call it at runtime. A runtime caller isn't automatically authorized to access downstream resources through the agent, and an agent's access to a downstream resource doesn't grant callers access to the agent.

Find the right identity guidance

Start with the task you need to complete.

If you need to Start with
Control who can create, configure, or manage Foundry resources and agents Authentication and authorization in Microsoft Foundry and role-based access control in Foundry
Choose and configure how callers are authorized to interact with an agent at runtime Agent endpoint authorization, then configure agent endpoint authorization
Understand how Foundry represents and governs agents in Microsoft Entra ID Agent identity concepts
Configure authentication for a downstream tool Toolbox authentication and the documentation for the selected tool
Choose client user delegation for a downstream tool User delegation for tools
Configure client user delegation for a downstream tool Configure user delegation for tools
Understand Microsoft Entra consent, tenant policy, and consent failures for delegated access Microsoft Entra consent for delegated access
Configure authentication for a specific downstream tool MCP authentication, Work IQ, or the documentation for the selected tool

Support depends on the agent and tool

Authentication support differs by tool, connection type, protocol, and channel. Each integration defines its supported identity methods and any required consent, role assignments, or connection properties.

Check the detailed guidance for your protocol or channel and tool before selecting an identity model. Don't assume that every tool supports every authentication or delegated-access method.

Related content

  • Last updated on