The microsoft-agents-authentication-entra-auth-sidecar library integrates the Microsoft 365 Agents SDK with the Microsoft Entra ID Agent Container (the sidecar).
Instead of the agent process handling secrets, certificates, or keys directly via MSAL, the SDK delegates token acquisition to the sidecar's HTTP API. This provides:
- Credential-free agent code: All credential management (Managed Identity, Workload Identity, etc.) lives in the sidecar.
- Language-agnosticism: The sidecar provides a simple HTTP API used by all language SDKs.
- Consistent environments: The same container can run locally (Docker) and in production.
The sidecar handles the entire agentic identity chain (Blueprint → Instance → agentic User) internally and returns the final resource token in a single request.
from microsoft_agents.hosting.core import ConnectionManager
from microsoft_agents.authentication.entra_auth_sidecar import SidecarAuth
connection_manager = ConnectionManager(
provider_factory=SidecarAuth,
CONNECTIONS={
"SERVICE_CONNECTION": {
"SETTINGS": {
"AUTHTYPE": "EntraAuthSideCar",
"CLIENTID": "<blueprint-app-id>",
}
}
},
CONNECTIONSMAP=[{"SERVICEURL": "*", "CONNECTION": "SERVICE_CONNECTION"}],
)