Two of these three products can mint an agent a credential. The third cannot, and treating them as interchangeable line items is the most expensive misunderstanding in enterprise identity right now. Microsoft Entra Agent ID and Okta for AI Agents are issuers — they create an identity for an agent and hand it a token. SailPoint Agentic Fabric is a governor — it discovers, owns, certifies and kills agent identities that something else created. You will probably end up with one issuer and one governor. You should not run a bake-off between them.
| Microsoft Entra Agent ID | Okta for AI Agents | SailPoint Agentic Fabric | |
|---|---|---|---|
| What it is | Identity provider that mints agent identities | Identity provider plus a runtime credential broker | Governance layer over identities it does not mint |
| Issues the credential? | Yes | Yes | No — governs what others issued |
| Agent gets identity how | Auto-provisioned by Copilot Studio, Foundry, Teams, App Service | Registered in Universal Directory; discovered via OAuth consent monitoring | Aggregated from AWS, Azure, GCP, Salesforce, Copilot Studio |
| Reaches third-party SaaS | Weakly — Microsoft-tenant native | Yes, via Cross App Access / ID-JAG | Read and govern only |
| Published price | $15/user/month (Agent 365) | Quote only | Quote only |
| Price unit | Per human seat | Per seat, agent tier undisclosed | Per identity, humans and machines |
| Buy it if | Your agents live in M365, Copilot Studio or Foundry | Your agents cross SaaS vendor boundaries over MCP | You already run SailPoint for humans |
| Skip it if | Your agents must reach non-Microsoft SaaS | Everything you run is inside one Microsoft tenant | You do not already run SailPoint |
The short version: your issuer has already been chosen for you by where your agents run, and the thing that actually reduces standing privilege is a protocol, not a SKU. Verify your identity provider issues an ID-JAG assertion before you sign anything. If it does not, you are still on API keys with a nicer dashboard.
Two of These Issue Credentials. One Does Not.
The category error is easy to make because all three vendors use the same words. Read the product pages side by side and every one of them promises discovery, lifecycle, least privilege and audit.
Then look at what happens at 3am when an agent needs a token.
Entra Agent ID answers that question. Microsoft's documentation defines agent identities as "identity accounts within Microsoft Entra ID that provide unique identification and authentication capabilities for AI agents," and an agent using one "can request access tokens from Microsoft Entra, and use those tokens to access web services," per Microsoft's own concept documentation. Okta answers it too: Okta for AI Agents replaces "hardcoded credentials and standing access with scoped, short-lived tokens," according to its general-availability announcement.
SailPoint does not answer it. The Agentic Fabric product page describes discovery, an identity graph, ownership mapping, lifecycle governance and runtime allow/deny at the tool-call decision point. It does not describe minting an agent a credential, because that is not what it does. Its own Agent Identity Security page is explicit about the mechanism: agents are "automatically onboarded" through platform connections to AWS, Azure, GCP, Salesforce and Copilot Studio. Aggregation, not issuance.
This is not a criticism. Governance is a real job and most enterprises are worse at it than they are at token minting. But if you write "agent identity platform" on a requirements document and hand it to three vendors, all three will say yes, and only two of them will be able to give an agent a credential on Monday.
How Each Product Gives an Agent Its Own Identity
The must-answer question for an IAM architect is how an agent gets an identity distinct from the human who owns it. All three take different routes, and the differences matter more than the marketing.
Microsoft builds four object types, not one. Entra introduces the agent identity blueprint, the blueprint principal, the agent identity, and the agent user — per the Entra ID Governance overview. The blueprint is the template; each agent identity is minted from it and inherits its OAuth delegated scopes. The agent user is the odd one out: a special Entra user account with a one-to-one relationship to an agent identity, created only when a downstream system insists on talking to something shaped like a person.
That last object is the sharp edge. An agent user is a user. It can be added to Entra groups, including dynamic groups, and inherits whatever access those groups carry. If your dynamic group rule is loose, you have just granted an agent human-shaped access by accident.
Microsoft blocks the worst outcomes at the platform level, which is genuinely good design. Global Administrator, Privileged Role Administrator and User Administrator cannot be assigned to an agent identity, and a set of high-risk Graph permissions including Application.ReadWrite.All, RoleManagement.ReadWrite.All and Directory.AccessAsUser.All is hard-blocked and cannot be consented to at all, according to the Agent ID FAQ. Agents also cannot sign in through OIDC or SAML — no SSO for robots.
Okta registers rather than provisions. Agents land in Universal Directory from Salesforce Agentforce, Amazon Bedrock and ServiceNow, and Okta additionally hunts for shadow agents by monitoring OAuth consent grants in managed browsers. It then brokers access across authorization servers, secrets managers, service accounts, applications and MCP servers. In July 2026 Okta added Agent Gateway, Agent-to-Agent Connections and Resource Access Certifications for AI Agents — the gateway sits between an agent and enterprise tools, validates both agent identity and user context, and brokers short-lived credentials at runtime without the agent ever holding the downstream secret.
SailPoint attaches humans to agents. Its model designates "one or multiple human owners for each AI agent" with built-in succession planning when an owner changes role. Microsoft calls this a sponsor and does the same thing — if a sponsor leaves, sponsorship transfers automatically to their manager. Both are answering the same audit question: who gets the call when the agent does something stupid.
The Protocol Is the Product: ID-JAG and Cross App Access
Here is the part that should change your procurement, and it is not a vendor feature at all.
The credential problem for agents is cross-domain. An agent authenticated to your identity provider needs to call an API at a vendor whose authorization server has never heard of it. For three years the industry answered that with static API keys and per-user OAuth consent screens that no administrator ever saw.
The replacement is the Identity Assertion JWT Authorization Grant — ID-JAG. An agent takes its ID token from your identity provider, exchanges it via RFC 8693 token exchange, as the ID-JAG draft profiles it, for a short-lived assertion scoped to a specific downstream resource, then redeems that assertion at the resource's own authorization server under RFC 7523. The identity provider brokers; the resource server keeps independent control of its own tokens. The IETF draft reached revision 04 on 21 May 2026 and is an active OAuth working group Internet-Draft on the standards track. It is not a ratified RFC yet. Buy accordingly.
Okta's Cross App Access is the branded implementation. It was announced with 25-plus early adopters on 23 June 2026 — Anthropic, Cursor, VS Code and Docker on the requesting side; Asana, Atlassian, Figma, Linear, Slack and Supabase as resource apps — with Okta Workforce availability from August 2026 and Auth0 early access from end of July 2026.
More importantly, the same mechanism became an official Model Context Protocol extension. Enterprise-Managed Authorization went stable on 18 June 2026: an admin enables an MCP server for the org once, users get it automatically scoped to the groups and roles they already have, and nobody sees a per-server consent screen.
That matters because it makes the capability portable. Keycloak shipped preview support for the JWT authorization grant in 26.5 in January 2026, as the project documented — though only the consumption half; Keycloak cannot yet act as the broker that issues assertions. And the demand is coming from practitioners, not vendors: an open request on the agentgateway project asks for ID-JAG specifically so the gateway can stop storing long-lived per-user refresh tokens and leave the audit trail at the identity provider.
The buying implication: ask each vendor for its ID-JAG conformance status in writing, with a date. A product that brokers agent access without it is brokering API keys.
Short-Lived Credentials, and What Each Vendor Means by It
"Short-lived" is the most abused phrase in this category. Three different things are being sold under it.
Okta means it most literally. Agent Gateway "isolates downstream credentials within Okta" and brokers per-call short-lived credentials, so a compromised agent process does not yield a reusable secret. Agent-to-Agent Connections, generally available since July 2026, issues temporary runtime tokens for multi-agent handoffs and enforces which agents may invoke which others.
Microsoft means delegated OAuth with an expiry. Agent identities support autonomous access using rights granted directly to the agent, and delegated access where the agent acts on behalf of a human "using access rights given to the user," with the user controlling what is delegated. Access itself is time-boxed through entitlement management: an access package assignment carries an expiry date, the sponsor is notified as it approaches, and if the sponsor does nothing the assignment expires and the agent loses access. That is a genuinely good default — expiry by inaction rather than expiry by ticket.
SailPoint means neither, because it does not hold the credential. What it offers instead is a centralized kill switch to disable rogue agents, plus endpoint and browser sensors that surface hidden agents and credentials, announced with Agentic Fabric's general availability on 4 August 2026 alongside new Agentic Business and Agentic Business Plus suites.
Assess this honestly against your actual threat. If your worry is a leaked long-lived key in a repo, Okta's broker model is the direct answer. If your worry is an agent that quietly keeps access to a finance system nine months after the pilot ended, Microsoft's expiring access packages and SailPoint's certification campaigns are both closer to the mark.
Revocation Is Where Microsoft's Own Documentation Warns You
This is the section a vendor deck will not write, so read the FAQ instead.
Microsoft states plainly that when an agent identity blueprint or agent identity is deleted, "any associated agents' user accounts remain in the tenant. They aren't shown as disabled or deleted, though they can't authenticate. Delete orphaned agents' user accounts manually using Microsoft Graph API or Microsoft Entra PowerShell." That is an orphaned user object per retired agent, invisible to the admin center, cleaned up only by script.
The same FAQ documents several more sharp edges worth pricing into your project plan:
- Deletion is irreversible after 30 days. Soft-deleted objects restore inside the retention window; after that, permanent deletion is automatic and cannot be undone.
- You cannot delete or restore agent identity objects in the admin center at all — Graph or PowerShell only.
- You cannot free blueprint quota early. Permanent deletion of a blueprint principal is blocked; you wait out the 30 days.
- There is a 250-agent cap per blueprint for non-Microsoft management platforms using app-only permissions. Microsoft's own platforms — Foundry, Copilot Studio — are exempt.
- Rapid creation fails intermittently. Creating a blueprint then immediately creating a principal, or an identity then immediately its user account, can return
400 Bad Request: Object with id {id} not found. Microsoft's advice is retry with exponential backoff. - Blueprint approval is silent. There is no notification when a tenant admin approves your blueprint; you poll Graph.
None of this makes Entra Agent ID a bad choice, and none of it means the product is unfinished. Entra Agent ID is generally available, as are Conditional Access and Identity Protection for agents. What the FAQ describes is a shipped product whose lifecycle plumbing is thinner than its security surface: orphan cleanup by script, object management outside the admin center, and a hard cap Microsoft's own platforms are exempt from. Only the admin-center wizard for creating blueprints and identities is still in preview. Put that gap in your risk register rather than in a footnote — and do not wait for a GA milestone to sweep it away, because GA has already happened.
Okta's revocation story is cleaner in shape: deactivating an agent acts as an immediate kill switch, Agent Gateway can revoke a rogue agent's access at the broker, and Resource Access Certifications automatically revoke stale connections. It is also newer — certifications for agents are early access, and Agent Gateway is a research release, which in Okta's vocabulary means it is not something to build a compliance control on this quarter.
The Audit Trail You Think You Are Buying
Every one of these products promises per-action attribution. Only one of them tells you, in its own documentation, where the seams are.
Microsoft's FAQ is blunt: "Audit logs don't distinguish agent identities from other Microsoft Entra identity types by default." Operations on agent identities land in the ApplicationManagement category, operations on agent user accounts land in User Management, actions initiated by agent identities "appear as service principals," and actions by agent users "appear as users." Graph activity logs are the same story — agent requests are logged as applications with the agent in the appID column. To reconstruct what an agent did, you take object IDs out of the logs and query Graph to work out what kind of entity they were, or join on the sign-in correlation ID.
Read that as an engineering estimate, not a defect. Answering "what did agent 47 do at 14:32 and on whose behalf" requires a join you have to build, plus a Graph lookup per distinct actor. If your SIEM content pack does not do that today, someone on your team is writing it.
Okta claims the stronger position here — "every tool call, access attempt, and authorization decision is recorded," streamable to a SIEM, with Agent Gateway maintaining audit trails carrying agent identity, user context and transaction outcome. That is the right shape, because the gateway is inline on the call path and therefore actually sees the calls. Whether it holds up across the heterogeneous frameworks Okta claims to support — Claude Code, GitHub Copilot, Agentforce, Bedrock AgentCore — is a question for your proof of concept, not a spec sheet.
SailPoint produces governance evidence rather than call-level telemetry: who owns the agent, what access it holds, who certified it and when. Auditors want that too. It is not the same artifact.
What Breaks in the IGA You Already Own
Your existing identity governance program makes four assumptions. Agents break all four.
It assumes identities are stable enough to certify. Access reviews run quarterly because employees change roles quarterly. Microsoft's own framing is that agents "might exist for minutes during a specific task, or might be created and destroyed thousands of times per day as part of an automated workflow." A quarterly certification cannot see an identity with a lifespan of ninety seconds, and certifying the blueprint instead of the instance is the only coherent answer — which means your control object changes from the identity to the template.
It assumes a human owner exists. In a Cloud Security Alliance online survey of 383 security and IT professionals fielded in August and September 2025, 78% of organizations self-reported no documented policy for creating or removing AI identities and only 14% had fully automated that lifecycle, per the survey's January 2026 release. Over-permissioned access was a top pain point for 51%. Read those numbers with the sponsorship in view: CSA states the project was commissioned and financed by Oasis Security, which co-developed the questionnaire and sells non-human identity management — the survey is a reasonable directional signal, not an independent census.
It assumes joiner-mover-leaver. There is no "mover" for an agent. There is redeploy, and a redeployed agent with new scopes is a new risk with an old approval attached to it.
It assumes the identity provider sees the access. It does not, once the token is issued. This is the constraint the whole category shares, and the next section is about it.
The practical consequence: if you already run SailPoint for humans, extending it to agents is a configuration project, and SailPoint pitches the Navigators licensing model it introduced in December 2025 as flexible packaging that scales with your identity landscape rather than a fixed entitlement. If you do not already run SailPoint, buying it to govern agents means starting an IGA program, and IGA programs are measured in quarters. Entra's entitlement management — access packages, sponsor-based approval, automatic expiry — may cover enough of the ground while you decide.
Pricing: Ask What the 501st Agent Costs
Normalize to one workload or these numbers mean nothing. Assume 2,000 employees, 500 agents, 40 SaaS applications, twelve-month term, all prices checked on 25 August 2026.
| List price published? | Unit | Cost of 500 agents at this workload | Marginal cost of agent #501 | |
|---|---|---|---|---|
| Microsoft Agent 365 | Yes — $15/user/month | Per human user | $54,000/yr if 300 owners licensed; $360,000/yr if all 2,000 | $0 |
| Microsoft 365 E7 | Yes — $99/user/month | Per human user | Bundles Agent 365 + Entra Suite | $0 |
| Okta for AI Agents | No — "inquire for pricing" | Undisclosed for agents | Workforce Essentials alone is $17/user/mo = $408,000/yr for 2,000 seats | Unknown |
| SailPoint | No | Per identity, humans and machines | No list price; third-party marketplaces put comparable mid-market deployments in the low hundreds of thousands | One more identity unit |
Microsoft is the only vendor of the three that publishes a number, and the number has a structural consequence buyers keep missing. Microsoft's pricing page states that Agent 365 is $15 per user per month on an annual commitment, that Microsoft 365 E7 at $99 per user per month includes it, and — critically — that "Agent 365 is licensed per user. An Agent 365 license is recommended for all users who interact with, own, manage, or sponsor Agent 365–managed agents."
Microsoft charges by the human. Your agent count does not appear in the invoice. Going from 500 agents to 5,000 costs nothing extra in licence. That is the single strongest commercial argument for the Microsoft stack, and it points the wrong way from every "per-agent pricing is coming" prediction in the market.
The layering is where it gets expensive. Entra Agent ID itself "is available for all Microsoft Entra customers," but "extending Microsoft Entra security features to agents requires Microsoft Agent 365," and governing agents through Entra ID Governance requires either Microsoft 365 E7 or an Agent 365 licence paired with at least Entra P1 or Microsoft 365 E3. The free tier is identity creation. Everything you would actually put in a control document is licensed.
Okta publishes Workforce Identity pricing — Starter at $6 per user per month, Essentials at $17, a $1,500 annual contract minimum — and lists Okta for AI Agents under a separate agentic security category as inquire-only. Note the base numbers are per human seat too; the agent tier is the undisclosed part. SailPoint publishes nothing and quotes per identity, with machine identities counting.
So ask all three the same question and demand it in writing: what does the 501st agent cost? Microsoft's answer is zero. The other two will not put an answer on paper until you are inside a procurement cycle, which is exactly when your leverage is lowest.
One live variable: Okta's roughly $200 million acquisition of Permiso, reported by TechCrunch on 30 July 2026 and expected to close by the end of October within Okta's fiscal third quarter. Threat detection for agent identities is being folded into the platform, and how it lands in the price book is not yet public. If you are signing a multi-year Okta agreement this quarter, price-protect the agent modules now.
Who Should Not Buy Each of These
The most useful sentence in any comparison is the disqualifier.
Do not buy Microsoft Entra Agent ID if what your agents need to reach is non-Microsoft SaaS. Running outside Microsoft is no longer the disqualifier it was: Microsoft documents two supported patterns for third-party agents — an Auth SDK sidecar container for AWS Bedrock, local Ollama models and anything containerized, and Workload Identity Federation for AWS STS and GCP Workload Identity — so a Bedrock agent can hold an Entra agent identity and acquire Entra tokens, per Microsoft's third-party integration guide. Read what those tokens are for, though: every documented scenario is a third-party agent calling Microsoft Graph, Azure services or your own APIs. The direction is inbound. And the automatic provisioning that makes Entra pleasant still only happens in Copilot Studio, Foundry, Teams and App Service — everywhere else you are configuring federated credentials and running a second container. Also weigh whether your compliance function can absorb the lifecycle gaps: orphaned agent user accounts after deletion, PowerShell-only object management, and a 250-agent blueprint cap for third-party platforms are all documented, current, and yours to work around.
Do not buy Okta for AI Agents if your entire agent estate lives inside one Microsoft tenant. You would be paying a broker to solve a cross-domain problem you do not have, and Entra provisions those identities automatically. Also hesitate if you need a compliance control this quarter — Agent Gateway is a research release and agent certifications are early access, which is a different maturity conversation from generally available.
Do not buy SailPoint Agentic Fabric if you do not already run SailPoint for humans. And do not buy it as your credential issuer under any circumstances, because it is not one. Its correct use is governing an agent population that Entra, Okta, AWS and Salesforce are already minting.
Do not buy any of them if your actual requirement is stopping an agent from doing the wrong thing mid-run. See below.
The Blind Spot All Three Share
Every product here answers can this agent connect, and with which scopes. None answers should this specific action run, right now, against this specific record.
The Enterprise-Managed Authorization extension is honest about it: the identity provider's visibility ends at token issuance and it has no visibility into MCP traffic thereafter. One implementer's analysis puts the boundary crisply — EMA "answers can this user connect this client to this server, and which scopes? It never answers should this specific action run, right now, on this resource?", and closing that gap means putting a policy enforcement point in the data path.
Concretely: an agent with write scope on your repository was correctly authorized to connect. Nothing in the token stops it deleting a branch. Scopes are evaluated once at issuance, not per call, and revoking a token does not recall an action already in flight.
Okta's Agent Gateway is the closest thing here to an inline enforcement point among the three, which is precisely why it matters that it is a research release rather than a shipped control. SailPoint's runtime allow/deny at the tool-call boundary is aiming at the same target. Neither is a substitute today for the authorization layer you build yourself — OPA, Cedar, or an equivalent policy decision point sitting in the call path.
This is the honest framing for your board: buying an agent identity product moves you from unknown agents with permanent keys to known agents with expiring, scoped, attributable keys. That is a large, real improvement. It is not runtime control, and anyone selling it as such is selling you the wrong thing. Gartner's 2026 IAM predictions put human and machine identities at the centre of the enterprise attack surface — its 2026 Predicts note for IAM, published January 2026, is the paid reference — and the reason the registration-and-credential half is moving first is simply that it is the tractable half.
What to Do in the Next 30, 60 and 90 Days
This month:
- Count your agents and find their credentials. Not a survey — pull OAuth consent grants, service principal creations in the last 90 days, and long-lived API keys in your secret manager. Okta's shadow-agent discovery and SailPoint's endpoint sensors both exist because this number is always wrong.
- Ask your identity provider one question in writing: do you issue ID-JAG assertions today, and to which resource servers? Date the answer. This single question separates a real agent identity roadmap from a rebranded service account.
- Model the 501st agent. Take your current agent count, multiply by ten, and ask each vendor what the invoice looks like. Microsoft will say the price does not change. Make the others answer in the same units.
Next 60 days:
- Name a sponsor for every production agent, and test what happens when they leave. Entra transfers sponsorship to the manager automatically; verify yours does something rather than nothing.
- Run one revocation drill. Disable an agent identity and confirm, with logs, that the token stopped working, the downstream SaaS session ended, and no orphan user object was left behind. In Entra, check for the orphan explicitly — the documentation says it will be there.
Before the next audit:
- Build the audit join. If you are on Entra, write and test the query that turns an object ID in an audit log into "this was agent X, sponsored by person Y." Do not discover on the day of the audit that agent actions are indistinguishable from service principal actions.
- Move your control object from the agent to the blueprint. Ephemeral instances cannot be certified. Templates can. Rewrite the certification campaign accordingly.
The Bottom Line
The market is pricing this as a platform decision. It is not. Your issuer is determined by where your agents already authenticate, your governor is determined by what IGA you already run, and the only genuinely open question is whether the protocol underneath both is ID-JAG or a static key with better branding.
That makes the winner situational and the loser universal. Choose Entra Agent ID if your agents live in Microsoft's stack and accept a thin lifecycle layer in exchange for pricing that ignores your agent count entirely. Choose Okta if your agents cross vendor boundaries, and pay for a broker plus an undisclosed agent tier to get it. Choose SailPoint only as a second purchase, on top of an issuer, and only if it is already your governance platform.
The loser is the enterprise that runs a three-way bake-off, picks one, and believes it now controls what its agents do. It controls what they can connect to. The gap between those two sentences is where the incident will happen.
We spent a decade learning that a service account with a permanent key is a liability. Agents are service accounts that can reason about how to use theirs. Fix the credential first — then go build the thing that watches the call.
Continue Reading
- Okta Bought Permiso. Your Leverage Expires Oct 31.
- The 2026 Agentic AI Stack: 8 Layers, 3 You Can Skip
- One Agent Escalated Another. Every Call Was Authorized.
- 9 in 10 Enterprises Breached Through Identity No One Manages
- Your Supervisor Rewrote the Task. The 'Do Not' Fell Off.
- Copilot Memory Survives Your Password Reset. Go Purge It.
- Ping vs Okta vs Entra: Best AI Agent Identity in 2026?
- 88% Had AI Agent Breaches. 82% Think They're Protected.