Head-to-head · updated 13 September 2026

DataShield vs Microsoft Entra Agent ID: who the agent is, or what it was allowed to do?

If your agents live in a Microsoft tenant, put their identity in Entra Agent ID. You get agent objects tied to the directory. You get Conditional Access with device and risk signals. Every agent gets a human sponsor. Lifecycle Workflows hand it over when that person leaves. We don't compete with any of that. We'd tell you to keep it.

Entra doesn't prove a tool call was allowed. It doesn't prove no one edited the record later. Entra tells you who the agent is. DataShield proves the agent's action was allowed. Most teams we talk to run both tools. So the real question isn't which vendor wins. It's which layer holds the duty.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

You need to prove a six-month log wasn't altered. Microsoft's own guidance says to hash your logs. Then export them to locked storage yourself. That do-it-yourself step is our product. Run the verifier.
Agents run outside the tenant too. Think LangChain, Bedrock, a self-hosted stack. Agent 365 onboards outside agents by hand, through SDK work. Conditional Access and Purview DLP don't reach off-platform.
You want to pull an agent's access mid-session. You want the very next checked call to fail. Not wait on token lifetime. Not wait on a Conditional Access recheck.
Security wants the tokenization vault, the policy plane, and the proof on your own system. You hold the keys that reverse tokens and sign records. See the architecture.

Pick Entra Agent ID when

Your agents are Copilot and Copilot Studio agents. They inherit directory identity and Purview logs with no wiring. Nothing we sell replaces that.
You want Conditional Access for agents. Think device checks, risk signals, the same rules your admins know. Only the directory owner can do this. Microsoft owns the directory.
You want a named human on the hook. Lifecycle Workflows put one behind every agent. The agent moves on when that person leaves.
Budget talk is easy when the answer is a licence you already hold. As last published, Agent 365 costs $15 per user per month. You also need E5 or Business Premium. Or you get it bundled into M365 E7.

Bottom line: there's no versus here. Entra is the identity of record, and we federate to it over SAML or OIDC. We add the four things it doesn't have: verifiable audit, reversible tokenization, agent break-glass, and crypto-shred erasure. If your estate is pure Copilot, and nothing regulated leaves the tenant, Entra alone is a fair answer.

Feature by feature

Cells on their side quote Microsoft's own public pages, as of the date above. Two of Microsoft's product pages were dead when we last checked. So we mark pricing and packaging rows "as last published." We did not re-check them. Got one wrong? Email support@myorg.ai. We'll fix it, and credit you.

What matters	DataShield	Entra Agent ID	Edge
Audit evidence	A SHA-256 hash chain, with Ed25519-signed checkpoints. The checkpoints chain too. A check names what broke: a change, an insert, a delete, or a cut tail. Try the verifier.	Purview and Defender now cover agent activity. They keep logs 180 days by default, 365 on E5. For tamper proof, Microsoft says to hash your logs. Then export them to locked storage yourself.	◆
Agent identity	We take Entra, or any IdP, over SAML and OIDC. RFC 9068 JWTs get issued, and MCP tool tokens downstream too, with JWKS rotation. We are not an identity of record.	Tied to the directory. Blueprint to per-instance agent object IDs. It lives inside the tenant your admins already run. This is their home turf.	◇
Agent authorization	Every checked tool call passes three gates first. A scope ceiling. A declared access tier. A check for revoke.	Conditional Access rules use device and risk signals. They get judged at token issue. They get judged again on recheck.	◆
Mid-session revocation	A revoke lands on the next checked tool call. The chain seals in the downgrade.	Token lifetime, plus a Conditional Access recheck. We found no documented per-call check.	◆
Break-glass	Scoped, time-boxed emergency access for agents. It auto-revokes. No one can quietly delete it from the log.	Entra PIM covers special human access. We found no agent break-glass in their public docs.	◆
GDPR erasure	We crypto-shred the keys for that subject. We issue an ISO 27560 consent receipt. Actor names stay HMAC-committed. So the chain still checks out after erase.	Purview offers rules to keep or delete data. Keeping data isn't erasing it. What it does to agent audit history isn't described.	◆
Data handling	We tokenize datasets at ingest. Agents query the tokenized data over MCP. Reversing a token is a special, audited step. Quasi-identifier generalization cuts dates to year, decade, or age band. It cuts ZIP codes to 3 or 4 digits. It trims phones, SSNs, and emails too. Each column gets a measured score for that cut.	Purview classification, labelling and DLP work across Microsoft surfaces. It tags data and blocks it. It won't give back a token you can reverse.	◆
MCP and agents	Native MCP endpoints on Auth, Ontology and Lighthouse. Auth issues MCP tool tokens with scope ceilings. We meter every call. We pin every call to the agent.	OAuth 2.0, MCP and A2A support. Plus a Tooling Gateway for admin-approved MCP servers. An approved server is approved whole. You can't switch off one tool inside it.	◆
Non-Microsoft agents	Neutral by design. Any IdP over SAML or OIDC. Any MCP surface. Any hosting.	Outside agents onboard through the SDK by hand. There is no auto-discovery. Conditional Access and Purview DLP don't reach off-platform.	◆
Lifecycle governance	Org, app and instance setup, with checks on config changes. You propose a change. You approve it, or roll it back, against set security floors.	Lifecycle Workflows put a human sponsor behind each agent. The agent moves on by itself when that person leaves. That's genuinely good. We don't have the org-chart hooks to match it.	◇
Deployment	Self-hosted, or dedicated single-tenant. You hold the keys that reverse tokens and sign records, on your own instance.	Microsoft cloud tenant only.	◆
Maturity signals	Auth, Guardian and Lighthouse are live in production. Guardian and Lighthouse have run since April 2026. SOC 2 is not yet certified. We say so.	Microsoft. Entra Agent ID reached GA on 1 May 2026. Agent 365 shipped as the commercial wrapper the same month.	◇
Pricing	Published model, scoped instant quote, no sales wall.	As last published: $15 per user per month on its own. You also need E5 or Business Premium. Or get it bundled in M365 E7 at $99. Agent runtime and use charges were unpublished.	◆

◆ DataShield leads◇ Entra Agent ID leads◈ comparable

Entra Agent ID and Agent 365 claims come from Microsoft's product and Learn pages. We captured them on 18 July 2026. On 13 September 2026 both pages returned 404, likely moved after GA. So we did not re-check pricing and GA facts this pass. We flagged those rows instead. We won't pass off stale figures as current. Links below.

Three things you get here that you won't get from a directory

Evidence Microsoft tells you to build yourself

The forensic advice for Purview logs: export them, hash them, then move them to locked storage yourself. That's a project. It needs an owner and a backlog. Ours ships as the mechanism instead: a hash chain with signed, chained checkpoints. A check says what went wrong. Not just that something did. Run it before you build it.

The token that's still valid at 16:05

You offboard an analyst at 16:00. Their agent is halfway through a long job. Entra stops handing out new tokens. The one already in hand keeps working until it runs out. We recheck access on every checked tool call. So the next call fails closed. How Auth does it.

PHI the model never sees in the clear

Purview can tag a record and block it. It can't hand the agent a token it can reverse. We tokenize datasets at ingest. Agents query the tokenized data over MCP. Reversing a token is a special, audited step. The EDPB names pseudonymization as a fix for exactly this. See the data layer.

Where Entra Agent ID is genuinely stronger

Everything about identity, and we're not being polite about it. Agents in Entra are real directory objects. Each gets its own instance ID. They fall under the same Conditional Access your admins already write. They carry device checks and risk signals only the directory owner can see. Copilot and Copilot Studio agents get identity and Purview logs for free. No third party can match that reach inside the tenant. Sponsor-based lifecycle rules are the quiet good idea in this release. Every agent has a named human. When that human leaves, ownership moves. It doesn't rot. If your estate is Microsoft end to end, make Entra your identity anchor. We'll federate to it.

My one argument is with the word "included". It does three jobs at once. On price, the seat figure as last published sits on top of an E5 need. Agent runtime charges weren't published at all. On coverage, an agent on Bedrock, or on somebody's laptop, gets onboarded by hand. If at all. Conditional Access never reaches it. The third job is the one that matters most. A kept log isn't a checked log. That's exactly why Microsoft's own guidance tells you to hash it. Then export it yourself. Through 2028, Gartner expects most unauthorized agent moves to be internal policy breaks, not attacks. In a policy break, the log is the whole argument.

Questions worth asking both of us

Ask your Microsoft account team these, then ask us the same ones.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. That answer is most of the product. Records commit forward. Checkpoints are Ed25519-signed and chained. So a deleted checkpoint shows up too. A check tells a change, an insert, a delete and a cut tail apart. Sample chain at /verify. Microsoft: Purview keeps agent activity for 180 days by default, 365 on E5. Their own guidance says to hash logs. Then export them to locked storage yourself. Ask who on your team owns that pipeline today.

What happens to a revoked agent mid-session?

We recheck access on every checked tool call. A revoke bites on the next call. The chain writes in the downgrade. Entra applies Conditional Access at token issue, and again on recheck. So the real answer there depends on token lifetime. Ask both of us the same thing. I revoke at 14:00. What's the last moment a tool call can still succeed?

How does GDPR erasure interact with the audit trail?

We destroy the keys for that subject, and issue an ISO 27560 receipt. We leave the chain alone. Its actor names are HMAC commitments. So it checks out before and after. Purview offers rules to keep or delete data. That's a different thing. Keeping data isn't erasing it. We found no doc on what erasing a subject does to agent audit history. Ask them.

We're already paying for E5. Why add anything?

Mostly, you shouldn't rip anything out. Keep Entra as the identity spine. We federate to it. We fill the gaps Microsoft doesn't claim to fill. Audit you can check without trusting the vendor. Tokenization you can reverse, before data reaches an agent. Break-glass for an agent gone wrong. Erasure that survives an audit. If none of those are duties you carry, E5 is honestly enough.

What about agents that don't live in the Microsoft tenant?

Agent 365 onboards non-Microsoft agents through the SDK, by hand. We saw no auto-discovery in the docs. Conditional Access and Purview DLP don't reach off-platform. We're neutral. Any IdP over SAML or OIDC. Any MCP surface. Self-hosted, if you want it. If your estate is truly mixed, count how many agents a tenant-scoped control can even see.

Does DataShield have SOC 2?

No. Set against Microsoft, that's an awkward row. Dressing it up would be worse. Auth is live, with a public threat model. Anyone can run our verifier. Guardian and Lighthouse have run in production since April 2026. Design-partner terms include source escrow. Self-hosting means the keys stay yours. Security page.

Entra Agent ID reached general availability on 1 May 2026. It ships agent identities tied to the directory. It ships Conditional Access for agents. It ships Lifecycle Workflows with human sponsors. It ships OAuth 2.0, MCP and A2A support too. - Microsoft Entra Agent ID product page, 18 Jul 2026
Agent 365, as last published. $15 per user per month on its own. You also need E5 or Business Premium. Or get it bundled in Microsoft 365 E7 at $99. Agent runtime and use pricing was unpublished. Not re-checked on 13 Sep 2026: the page returned 404. - Microsoft Entra Agent ID product page, 18 Jul 2026
Purview keeps agent and Copilot activity for 180 days by default, 365 on E5. For tamper proof, Microsoft's guidance says to hash logs. Then export them to locked storage. - Microsoft Entra agent identity documentation, 18 Jul 2026
The Tooling Gateway approves MCP servers at the server level. You can't switch off one tool inside an approved server. - Microsoft Entra agent identity documentation, 18 Jul 2026
Through 2028, at least 80% of unauthorized agent transactions will be internal policy breaches, not attacks. - Gartner, 2026
EDPB names pseudonymization as a GDPR risk mitigation for AI models. - EDPB Opinion 28/2024

Other head-to-heads

Complement

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →