Agents Should Never Hold Your Tokens: A PingFederate to Microsoft Graph Broker

Description and use

A PingFederate broker securely mediates agent access to Microsoft Graph, keeping Entra tokens on the backend and limiting agents to read‑only directory queries.

Problem

Background jobs and AI agents need to query Microsoft Entra ID data but handing them Microsoft tokens or giving them app‑wide permissions risks credential leakage and over‑privileged access.

Outcome

The broker architecture prevents agents from ever holding Microsoft tokens and limits them to specific read operations with scoped permissions, reducing credential leakage and over‑privileged access.

Workflow

• 1. User signs in via PingFederate and initiates a connection flow.
• 2. PingFederate authenticates the caller, performs OIDC login to Entra, and forwards the token response to the broker.
• 3. The broker stores encrypted delegated tokens, validates delegations, and exposes read‑only Graph endpoints.
• 4. The agent backend calls the broker with a PingFederate token and a delegation ID, never receiving a Microsoft token.
• 5. The broker performs the requested Graph call and returns the result to the agent.

Evidence

Background jobs and AI agents increasingly need to answer questions like "who is in this group?" or "find users starting with Nick".

Source

Hand the agent a Microsoft token. Now the agent (and its logs, prompts and tool outputs) can leak a credential that works against Graph.

Source

Give the agent app‑wide permissions. Now it can read the whole directory, not just what a given user is willing to share.

Source

This project takes a third path: a directory broker in front of Graph. Entra tokens stay on the backend. Agents receive directory data only.

Source

It is a runnable Go starter for PingFederate 13.1, delegated Microsoft Graph access and background agents.

Source

Only three read operations exist: directory.find_users, directory.find_groups, directory.list_group_members.

Source