Microsoft Entra Agent ID

Agent Token Claims

14 August 2026Updated+0 / −1 lines

In brief

The Agent ID token claims documentation no longer includes one `tid` claim table row.

What Entra admins need to know

No product behavior change is indicated. Administrators should use the updated documentation when referencing token claims.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

| sub | Subject (the user, service principal, or agent identity being authenticated) | | oid | Object ID of the subject. User object ID for user delegation scenarios. Agent ID service principal OID for app-only scenarios. Agent's user account OID for user impersonation scenarios. | | idtyp | Type of entity the subject is. Values are user, app. | | tid ~~| Tenant ID of the customer tenant where the agent identity is registered. | |~~ xms_idrel | Relationship between the subject and the resource tenant. Learn more. | | aud | Audience (the API that the agent is trying to access) | | azp or appid | Authorized party / actor. The application ID of the agent identity. Enables proper client attribution in audit logs. |

@@ -61,7 +61,6 @@ You'd notice that the token includes a few claims that aren't previously seen in | `sub`             | Subject (the user, service principal, or agent identity being authenticated)         | | `oid`             | Object ID of the subject. User object ID for user delegation scenarios. Agent ID service principal OID for app-only scenarios. Agent's user account OID for user impersonation scenarios.          | | `idtyp`           | Type of entity the subject is. Values are `user`, `app`.                               |-| `tid`             | Tenant ID of the customer tenant where the agent identity is registered.              | | `xms_idrel`       | Relationship between the subject and the resource tenant. Learn [more](#xms_idrel).   | | `aud`             | Audience (the API that the agent is trying to access)                                 | | `azp` or `appid`  | Authorized party / actor. The application ID of the agent identity. Enables proper client attribution in audit logs.     |