APIR + Microsoft Entra Agent IDIdentity is who.Verification is what.
Microsoft Entra Agent ID gives AI agents unique identities inside an organization’s directory: per Microsoft’s documentation, agents become identity accounts with scoped, short-lived tokens and logged tool invocations. APIR is the independent evidence record that complements it: Entra says who the agent is; APIR records what it did and when, signed and hash-chained so a third party can check the record for tampering.
APIR is not affiliated with, or endorsed by, Microsoft.
Microsoft put agents in the directory. Good.
The directory problem was real: agents multiplying under shared service accounts, standing credentials nobody rotated, actions no admin could attribute. Entra Agent ID solves it where it should be solved, in the directory. Microsoft’s VP of Core AI said publicly in July 2026 that a production agent needs its own identity as a first-class principal. This is that, shipped.
Agents become identity accounts
Per Microsoft’s documentation, AI agents get unique identities inside an organization’s Entra directory: first-class objects an admin can list, inspect, and govern like any other principal.
Automatic at creation
Agents built in Microsoft Copilot Studio and Azure AI Foundry receive their Entra identity automatically, per Microsoft Learn: no anonymous agents piling up under a shared service account.
Scoped, short-lived tokens
Access is granted through scoped, short-lived tokens rather than standing credentials: per Microsoft’s documentation, the same least-privilege machinery the rest of the directory runs on.
Logged tool invocations
Tool calls are logged against the agent’s identity, per Microsoft’s documentation: so inside the tenant, actions resolve to a named principal instead of a shrug.
A directory identity stops at your tenant wall.
An identity inside yourtenant means nothing to your counterparty. Your buyer can’t query your directory. Neither can your auditor, your insurer, or a regulator. The identity is real, but it’s only legible to the organization that issued it.
And the logs behind it are the operator’s own logs. When a dispute lands, and a vendor’s agent did something your agent says it didn’t, a customer challenges an action, a reviewer asks for the record, the vendor grading its own homework is not evidence. It’s testimony.
The moment the question crosses an org boundary, a buyer verifying a vendor’s agent before granting access, two companies reconstructing what an agent actually did: you need a verifier independent of both the operator andthe platform the agent runs on. That layer, by definition, can’t live inside anyone’s tenant.
The badge gets the agent through the door.
The record shows what it did inside.
Not competitors. Two different questions, answered at two different layers, and the second layer only counts if it’s held by someone who isn’t the agent’s operator.
Microsoft Entra Agent ID
Identity, inside the tenant, per Microsoft’s documentation
The layer
Identity
The artifact
A directory principal
The scope
Your tenant
The question
“Who is this agent, and what may it access?”
The mechanism
Access control: scoped, short-lived tokens
The record
Internal logs, held by the operator
APIR
Verification, across organizations, independent of the runtime
The layer
Verification
The artifact
A signed, portable credential
The scope
Cross-organizational
The question
“What did this agent record doing, under which mandate, and has the record changed since?”
The mechanism
The mandate on file: authority a human signed, beside the record of what was done
The record
Tamper-evident evidence, publicly verifiable
One agent, both layers, four steps.
The agent gets its Entra identity
Inside your tenant, the agent is a directory principal with scoped tokens and logged tool calls, per Microsoft’s documentation. The directory problem is solved where it should be: in the directory.
APIR issues it a Trust Passport
An Ed25519-signed credential with a public verify page. Anyone opens the URL: no account, no login, and the signature is checked against APIR’s published key. The credential travels with the agent, not with your tenant.
Its actions land on the Black Box
Every recorded action joins a hash-chained, tamper-evident record held outside the platform that runs the agent. Gaps and edits get detected, not papered over.
Its authority is a signed ARBITER mandate
The scope a human actually granted, written down and signed: so “did it stay inside its authority?” is a checkable question, not a debate between two sets of internal logs.
This isn’t a diagram, it’s running. Here is a live passport on a real agent. Open it, and your browser checks the Ed25519 signature against our published key. No account, no login, no tenant. Verify it yourself right now:
https://apir.ai/v/6d9e771a-091b-4409-981e-289a60ecbf4bYour agents already have identities. Give them a record.
Verification starts free. The passport is public the moment it’s signed.
Entra Agent ID + APIR, the FAQ
Does APIR replace Microsoft Entra Agent ID?
No. They are complementary layers. Entra Agent ID handles identity: who the agent is inside your directory, what it may access, with scoped short-lived tokens per Microsoft’s documentation. APIR handles the evidence record: an independent, signed, hash-chained record of what the agent did and the mandate on file when it did it, which parties outside your tenant can check for tampering. A record proves what was recorded and when; it does not prove a permission still held at the moment an action ran. You want both.
What is the difference between agent identity and agent verification?
Identity establishes who an agent is and what it is allowed to access: authentication and access control, enforced inside one organization’s directory. Verification checks the record of what an agent did: signed, hash-chained events and the mandate on file at the time, which a third party can check for tampering without trusting the agent’s operator or the platform it runs on. A record proves what was recorded and when. It does not prove the permission was still valid at the moment of execution. Identity says who. The record says what, and when.
Can someone outside my organization verify my AI agent?
Yes. Every APIR Trust Passport has a public verify page at apir.ai/v/, the Ed25519 signature is checked against APIR’s published JWKS key in the browser, with no account and no login. A buyer, auditor, insurer, or regulator verifies the credential directly; they never have to take your word for it, or ours.
Does APIR work with agents not built on Microsoft platforms?
Yes. APIR is platform-neutral by design. Any agent on any stack: Microsoft, Anthropic, OpenAI, open-source, or fully custom: can be registered, issued a signed Trust Passport, and record to a tamper-evident Black Box. Verification that only worked on one vendor’s platform would just be that vendor’s logs with extra steps.
Microsoft, Microsoft Entra, Copilot Studio, and Azure AI Foundry are trademarks of Microsoft Corporation. APIR is not affiliated with, or endorsed by, Microsoft.