Implementing Secure Identity Propagation for AI Agents Using Amazon Bedrock AgentCore and Microsoft Entra ID
The rapid integration of AI agents into enterprise workflows has introduced significant security challenges, particularly regarding the authentication of requests made to downstream services. When an AI agent accesses enterprise APIs—such as ServiceNow, Salesforce, or SAP—on behalf of a human user, the default behavior often involves the application authenticating as itself rather than the user. This practice creates a security blind spot, as downstream systems lose visibility into the individual performing the action. This decoupling of user identity from API requests effectively breaks audit trails, bypasses granular access controls, and violates the fundamental security principle of least privilege. To address this, organizations are increasingly turning to On-Behalf-Of (OBO) token exchange patterns. A significant advancement in this space is the integration of Amazon Bedrock AgentCore Gateway with Microsoft Entra ID, which facilitates seamless identity propagation without the overhead of custom, brittle middleware.
The Security Imperative for Identity Propagation
In a modern enterprise architecture, identity is the new perimeter. When an employee interacts with an AI agent, the agent operates within the context of that user’s permissions. However, if the agent merely presents its own service account credentials to a backend API, the backend service lacks the context required to verify if the user is authorized to perform the specific requested operation. This creates a risk profile where an AI agent with broad permissions could inadvertently execute unauthorized actions because the backend system cannot distinguish between a high-privilege user and a low-privilege one.
By implementing OBO token exchange, developers ensure that the identity of the human caller is preserved throughout the request chain. The downstream service receives a token that reflects the original user’s claims, allowing it to enforce row-level security, scope-based access, and comprehensive logging. This shift is not merely a technical preference but a regulatory necessity for firms operating under frameworks like GDPR, HIPAA, or SOC2, which mandate precise accountability for data access.
Chronology of the Identity Flow
The architecture of this solution relies on a sophisticated orchestration between AWS-based infrastructure and Microsoft’s identity platform. The process can be broken down into a four-stage chronological sequence:
- Initial Authentication: The user begins the process by authenticating via their enterprise identity provider (IdP), receiving a JSON Web Token (JWT) scoped to the AI agent’s application registration.
- Gateway Initiation: The agent sends this JWT to the Amazon Bedrock AgentCore Gateway. The gateway acts as an intelligent intermediary, configured to recognize the incoming request as requiring an identity swap.
- The Token Exchange: The gateway communicates directly with the Microsoft Entra token endpoint. It presents the agent’s client credentials and the user’s original token. Crucially, it includes the
requested_token_use: on_behalf_ofparameter. Entra validates the user’s previous consent to the delegation and issues a new token specifically scoped for the target API (e.g., ServiceNow). - API Execution: The final request is sent to the target API, which evaluates the token. Because the token contains the user’s identity in the
preferred_usernameclaim, the API enforces the specific permissions associated with that user’s profile.
Technical Context and Configuration Requirements
Achieving this seamless flow requires meticulous configuration across three distinct environments: Microsoft Entra ID, the target service (ServiceNow), and the Amazon Bedrock AgentCore Gateway.
Within Microsoft Entra, two application registrations are required. The first represents the ServiceNow API connector, which must be configured to expose a specific scope, such as user_impersonation. The second registration represents the AI agent itself. This agent must be granted explicit API permissions to interact with the connector. This two-tier application approach ensures that the agent cannot act outside of its defined scope, effectively sandboxing the AI’s capabilities within the identity framework.
In the ServiceNow administrative console, the integration is finalized by establishing an inbound OAuth integration. This step involves creating an OIDC provider configuration that points to the Entra tenant’s metadata. A critical consideration here is the mapping of identity claims. While preferred_username is standard for identifying users via email, security engineers are encouraged to map the uti (Unique Token Identifier) claim to a jti claim. This provides a mechanism for replay protection, ensuring that intercepted tokens cannot be reused maliciously.
Analysis of the AgentCore Gateway Role
The introduction of native OBO support within Amazon Bedrock AgentCore Gateway, specifically starting with the 2025-11-25 Management Control Plane (MCP) version, represents a pivotal change in developer experience. Previously, organizations were forced to deploy and maintain custom AWS Lambda functions to intercept requests, perform token exchanges, and rewrite headers. These custom "middleware" solutions were often the weakest link in the security chain, prone to update fatigue and configuration drift.
By moving this logic into the gateway layer, AWS has effectively abstracted the complexity. The gateway acts as a declarative policy engine. Developers define the target, the scope, and the authentication flow, and the platform manages the lifecycle of the exchange. This reduces the attack surface by eliminating the need for custom, user-written code that handles sensitive identity tokens. Furthermore, it allows for the integration of Amazon Bedrock Guardrails, which can inspect the input and output content of the agent, providing a defense-in-depth approach that balances productivity with security.
Broader Industry Implications
The trend toward identity-aware AI agents is part of a larger shift in enterprise software development. As businesses move away from monolithic architectures toward highly distributed, API-first environments, the ability to maintain context is paramount. Analysts suggest that this integration pattern is likely to become the standard for "Agentic Workflows" where AI is not just a chatbot, but an active participant in business processes.
However, the implementation of such systems is not without its challenges. Data governance experts warn that while identity propagation solves the authentication gap, it does not solve the underlying issue of AI data privacy. Even with proper identity checks, AI agents must still be governed by policies that prevent them from accessing sensitive PII (Personally Identifiable Information) unless strictly necessary. Therefore, the combination of identity propagation and content guardrails is seen by industry experts as the "minimum viable security posture" for enterprise-grade AI.
Future-Proofing Enterprise AI
As these agents gain the ability to perform complex tasks—such as creating incidents, updating customer records, or triggering financial workflows—the cost of a security failure rises exponentially. The use of managed services like Bedrock AgentCore Gateway allows organizations to scale these deployments rapidly without compromising their security posture.
For organizations currently relying on static API keys or shared service accounts for their AI agents, the transition to the OBO flow is strongly advised. The initial effort required to configure application registrations in Microsoft Entra and mapping them within AgentCore is offset by the long-term benefits of enhanced observability and granular control. As the ecosystem continues to mature, we can expect to see further native integrations, likely extending support to other identity providers and a broader array of SaaS applications, further cementing the role of identity-aware AI as a cornerstone of the modern digital enterprise.
By standardizing these practices, the industry is moving closer to a model where AI can be treated as a trusted employee, acting under the same constraints and accountability as a human user, yet with the speed and scale that only automated agents can provide. The integration between Amazon Bedrock and Microsoft Entra stands as a benchmark for this transition, providing a scalable, secure, and robust framework for the future of enterprise AI.
