Microsoft's Entra Agent ID documentation, first published April 14 and updated as recently as June 24, has crystallized a shift enterprises have been circling for months: agents shouldn't run on borrowed service-account credentials, they need their own principal. The design details matter more than the announcement itself. Entra Agent ID mints individual agent identities from templates — what Microsoft calls "agent identity blueprints" — with tracked parent-child relationships, so a single policy can govern every instance spawned from the same template. That's a real answer to a problem enterprise security teams have been stuck on: when an agent framework spins up dozens of ephemeral sub-agents for a task, treating each as an unmanaged service account with a static API key creates exactly the credential sprawl that's already burned organizations deploying agents without dedicated identity, authorization, or accountability controls. The system speaks OAuth 2.0, MCP, and A2A natively, and it doesn't stop at Microsoft's own stack. Third-party agents built on non-Microsoft platforms — Microsoft specifically names AWS Bedrock and n8n — can be pulled under the same governance umbrella through an auth SDK sidecar or standard workload identity federation. That's notable because it signals Microsoft treating agent identity as a federation problem rather than a walled-garden one, at least at the technical layer, even as licensing keeps premium features behind Microsoft 365 E7 or an E5 add-on. This sits inside a broader convergence happening right now: Google Cloud's Agent Identity ties every agent to a SPIFFE ID with mTLS and DPoP token binding, CrowdStrike shipped Continuous Identity for AI agents in June, and NIST's CAISI is coordinating an AI Agent Interoperability Profile targeted for Q4 2026 that treats agent authentication as one of its three core pillars. The common thread across all of it is the same: short-lived, workload-scoped, cryptographically attested credentials instead of a shared secret an agent happens to hold. What's different about the Entra Agent ID update is that it's not a framework or a standards proposal — it's documentation for something enterprises can deploy against today, with parent-child credential inheritance as the concrete mechanism for managing agent sprawl at scale. The open question the industry hasn't settled is portability: whether an identity minted under one vendor's blueprint model will be recognized, without a sidecar or federation bridge, by a completely independent agent runtime. That's the interoperability test the NIST profile and OpenID Foundation's parallel agentic identity work are both aimed at, and neither has shipped yet.