Microsoft Entra Agent ID
GeneralIntegrate Aws Bedrock Agent
In brief
The documentation now spells out “on-behalf-of” before introducing the OBO acronym in the OAuth 2.0 authentication description.
What Entra admins need to know
No product or configuration change is indicated; administrators may find the authentication guidance clearer.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- The Flask app sends the query to AWS Bedrock (Claude) via the LangGraph ReAct agent.
- When Claude decides it needs weather data, it calls the
get_weathertool. - The tool asks the sidecar for an authorization header by calling
GET /AuthorizationHeader?AgentIdentity={agentId}. - The sidecar authenticates to Microsoft Entra ID using OAuth 2.0 (client credentials or
OBOon-behalf-of (OBO) exchange). - Microsoft Entra ID returns the requested token (TR) to the sidecar.
- The agent calls the weather API with
Authorization: Bearer TR. - The weather API validates TR and returns the weather JSON response.
@@ -54,7 +54,7 @@ The request flows through these steps: 1. The Flask app sends the query to AWS Bedrock (Claude) via the LangGraph ReAct agent. 1. When Claude decides it needs weather data, it calls the `get_weather` tool. 1. The tool asks the sidecar for an authorization header by calling `GET /AuthorizationHeader?AgentIdentity={agentId}`.-1. The sidecar authenticates to Microsoft Entra ID using OAuth 2.0 (client credentials or OBO exchange).+1. The sidecar authenticates to Microsoft Entra ID using OAuth 2.0 (client credentials or on-behalf-of (OBO) exchange). 1. Microsoft Entra ID returns the requested token (TR) to the sidecar. 1. The agent calls the weather API with `Authorization: Bearer TR`. 1. The weather API validates TR and returns the weather JSON response.