Head-to-head · updated 13 September 2026
DataShield vs Microsoft Entra Agent ID: who the agent is, or what it was allowed to do?
If your agents live in a Microsoft tenant, Entra Agent ID is the correct place to put their identity. Directory-native agent objects, Conditional Access with device and risk signals, a mandatory human sponsor on every agent, lifecycle workflows that transfer ownership when someone leaves. We don't compete with any of that, and we'd tell you to keep it.
What it doesn't do is prove that a given tool call was allowed and that the record of it wasn't edited afterwards. Entra tells you who the agent is. DataShield proves what it did was allowed. Most of the teams we talk to run both, so the useful question isn't which vendor wins, it's which layer the obligation lands in.
The short version
Pick DataShield when
- You need to prove a six-month agent log wasn't altered. Microsoft's own forensic guidance is to hash and export logs into immutable storage yourself. That do-it-yourself step is our product. Run the verifier.
- Agents run outside the tenant too: LangChain, Bedrock, a self-hosted stack. Agent 365 onboards third-party agents through manual SDK work, and Conditional Access and Purview DLP don't reach off-platform.
- You want to pull an agent's authority mid-session and have the very next governed tool call fail, rather than waiting on token lifetime or a Conditional Access re-evaluation.
- Security wants the tokenization vault, the policy plane, and the evidence inside your own VPC, with detokenization and signing keys you hold. See the architecture.
Pick Entra Agent ID when
- Your agents are Copilot and Copilot Studio agents. They inherit directory identity and Purview logging with zero integration work, and nothing we sell replaces that.
- You want Conditional Access for agents: device compliance, risk signals, the same policy grammar your admins already know. Only the directory owner can do this, and Microsoft owns the directory.
- Sponsor accountability matters to you. Lifecycle Workflows put a named human behind every agent and reassign it when they leave.
- The budget conversation is easiest when the answer is a licence you already hold. As last published, Agent 365 is $15 per user per month on top of an E5 or Business Premium prerequisite, or bundled into M365 E7.
Bottom line: there's no versus here. Entra is the identity of record, we federate to it over SAML or OIDC, and we add the four things it doesn't have: verifiable audit, reversible tokenization, agent break-glass, and crypto-shred erasure. If your estate is pure Copilot and nothing regulated leaves the tenant, Entra alone is a defensible answer.
Feature by feature
Competitor cells describe what Microsoft's public material said as of the date above. Two of Microsoft's own product pages were unreachable when we last checked, so pricing and packaging rows are marked "as last published" rather than re-verified. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | Entra Agent ID | Edge |
|---|---|---|---|
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion, or truncation. Public verifier. | Purview and Defender extended to agent activity. Retention defaults to 180 days, 365 on E5, and Microsoft's guidance is to hash and export to immutable storage yourself for tamper evidence. | ◆ |
| Agent identity | Consumes Entra or any IdP via SAML and OIDC. Issues RFC 9068 JWTs and MCP tool tokens downstream, with JWKS rotation. We are not an identity of record. | Directory-native. Blueprint to per-instance agent object IDs, inside the tenant your admins already run. This is their home turf. | ◇ |
| Agent authorization | Every governed tool call passes a scope ceiling, a declared authority tier, and a revocation re-check before dispatch. | Conditional Access policies with device and risk signals, evaluated at token issue and re-evaluation. | ◆ |
| Mid-session revocation | Revocation lands on the next governed tool call, and the downgrade is sealed into the chain. | Token lifetime and Conditional Access re-evaluation. We couldn't find a documented per-call re-check. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents that auto-revokes and can't be quietly deleted from the log. | Entra PIM covers privileged human access. No agent break-glass equivalent in their public docs. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities are HMAC-committed, so the chain still verifies after erasure. | Purview retention and deletion policies. Retention isn't erasure, and the effect on agent audit history isn't described. | ◆ |
| Data handling | Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Plus k-anonymity generalization of quasi-identifiers. | Purview classification, labelling, and DLP across Microsoft surfaces. Classification and blocking, not reversible pseudonymization. | ◆ |
| MCP and agents | Native MCP endpoints on Auth, Ontology, and Lighthouse. Auth-issued MCP tool tokens with scope ceilings, and per-call metering attributed to the agent. | OAuth 2.0, MCP, and A2A support, plus a Tooling Gateway for admin-approved MCP servers. An allowed server is allowed whole; individual tools within it can't be disabled. | ◆ |
| Non-Microsoft agents | Neutral by construction. Any IdP over SAML or OIDC, any MCP surface, any hosting. | Third-party agents onboard through the SDK by hand. No auto-discovery, and Conditional Access and Purview DLP don't enforce off-platform. | ◆ |
| Lifecycle governance | Org, app, and instance provisioning with config change governance: propose, approve, roll back, against security floors. | Lifecycle Workflows with a mandatory human sponsor per agent and automatic transfer on departure. Genuinely good, and we don't have the org-chart hooks to match it. | ◇ |
| Deployment | Self-hosted, in your VPC, or BYOC. Your KMS or HSM holds the detokenization and signing keys. | Microsoft cloud tenant only. | ◆ |
| Maturity signals | Auth v1.0 live. Guardian and Lighthouse v0.2, in production since April 2026. SOC 2 not yet certified, and we say so. | Microsoft. Entra Agent ID reached GA on 1 May 2026, with Agent 365 as the commercial wrapper the same month. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | As last published: $15 per user per month standalone with an E5 or Business Premium prerequisite, or bundled in M365 E7 at $99. Agent runtime and consumption charges were unpublished. | ◆ |
◆ DataShield leads◇ Entra Agent ID leads◈ comparable
Entra Agent ID and Agent 365 claims come from Microsoft's product and Learn pages as captured on 18 July 2026. On 13 September 2026 both pages returned 404, likely reorganised after GA, so pricing and GA facts were not re-verified this pass. We've flagged those rows rather than presenting stale figures as current. Links below.
Three things you get here that you won't get from a directory
Evidence Microsoft tells you to build yourself
The forensic advice for Purview logs is to export and hash them into immutable storage on your own. That's a project with an owner and a backlog. Ours ships as the mechanism: a hash chain with signed, chained checkpoints, where verification says what went wrong rather than just that something did. Run it before you build it.
The token that's still valid at 16:05
You offboard an analyst at 16:00. Their agent is halfway through a long-running job. Entra stops issuing tokens, but the one already in hand keeps working until it expires. We re-read authority on every governed tool call, so the next one fails closed. How Auth does it.
PHI the model never sees in the clear
Purview can classify a record and block it. It can't hand the agent a reversible pseudonym. We tokenize datasets at ingest, agents query the tokenized data over MCP, and detokenization is a privileged, audited operation. The EDPB names pseudonymization as a mitigation for exactly this. See the data layer.
Where Entra Agent ID is genuinely stronger
Everything about identity, and we're not being polite. Agents in Entra are real directory objects with per-instance IDs, subject to the same Conditional Access your admins already write, carrying device compliance and risk signals that only the directory owner can see. Copilot and Copilot Studio agents get identity and Purview logging for free, which is a level of coverage no third party can offer inside that tenant. Sponsor-based lifecycle governance is the quiet good idea in the release: every agent has a named human, and when that human leaves, ownership moves instead of rotting. If your estate is Microsoft end to end, Entra should be your identity anchor and we'll federate to it.
My one argument is with the word "included". It's doing three jobs at once. On price, the seat figure as last published sits on top of an E5 prerequisite, and agent runtime charges weren't published at all. On coverage, an agent running on Bedrock or on somebody's laptop gets onboarded by hand if it gets onboarded, and Conditional Access never reaches it. The third is the one that matters here: a retained log isn't a verifiable log, which is exactly why Microsoft's own guidance tells you to hash and export it yourself. Through 2028, Gartner expects most unauthorized agent transactions to be internal policy violations rather than attacks, and in a policy violation the log is the entire argument.
Questions worth asking both of us
Ask your Microsoft account team these, then ask us the same ones.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes, and this answer is most of the product. Records commit forward, checkpoints are Ed25519-signed and chained so a deleted checkpoint shows up too, and verification tells tampering, insertion, deletion and truncation apart. Sample chain at /verify. Microsoft: Purview retains agent activity, 180 days by default and 365 on E5, and their own forensic guidance is to export and hash logs into immutable storage yourself. Ask who on your team owns that pipeline today.
What happens to a revoked agent mid-session?
Authority is re-read on every governed tool call, so a revocation bites on the next one and the downgrade is written into the chain. Entra applies Conditional Access at token issue and re-evaluation, so the practical answer depends on token lifetime. Ask both of us the same thing: I revoke at 14:00, what's the last moment a tool call can still succeed?
How does GDPR erasure interact with the audit trail?
We destroy the per-subject key material, issue an ISO 27560 receipt, and leave the chain alone. Its actor identities are HMAC commitments, so it verifies before and after. Purview offers retention and deletion policies, which is a different thing: retention isn't erasure, and we couldn't find documentation of what erasing a subject does to agent audit history. Ask them.
We're already paying for E5. Why add anything?
Mostly you shouldn't rip anything out. Keep Entra as the identity spine, we federate to it. The gaps we fill are the ones Microsoft doesn't claim to fill: tamper-evident audit you can verify without trusting the vendor, reversible tokenization before data reaches an agent, break-glass for a malfunctioning agent, and erasure that survives an audit. If none of those are obligations you carry, the honest answer is that E5 is enough.
What about agents that don't live in the Microsoft tenant?
Agent 365 onboards non-Microsoft agents through the SDK, manually, with no auto-discovery in the docs we've seen, and Conditional Access and Purview DLP don't enforce off-platform. We're neutral: any IdP over SAML or OIDC, any MCP surface, self-hosted if you want it. If your estate is genuinely mixed, count how many of your agents a tenant-scoped control can actually see.
Does DataShield have SOC 2?
No. Set against Microsoft that's an uncomfortable row, and dressing it up would be worse. Auth is v1.0 with a published threat model and a verifier anyone can run, Guardian and Lighthouse are v0.2 and have been in production since April 2026, design-partner terms include source escrow, and self-hosting means the keys stay yours. Security page.
- Entra Agent ID reached general availability on 1 May 2026: directory-native agent identities, Conditional Access for agents, Lifecycle Workflows with mandatory human sponsors, OAuth 2.0, MCP and A2A support. — Microsoft Entra Agent ID product page, 18 Jul 2026
- Agent 365, as last published: $15 per user per month standalone with an E5 or Business Premium prerequisite, or bundled in Microsoft 365 E7 at $99. Agent runtime and consumption pricing unpublished. Not re-verified on 13 Sep 2026: the page returned 404. — Microsoft Entra Agent ID product page, 18 Jul 2026
- Purview retains agent and Copilot activity for 180 days by default, 365 on E5, and Microsoft's forensic guidance is to hash and export logs to immutable storage for tamper evidence. — Microsoft Entra agent identity documentation, 18 Jul 2026
- The Tooling Gateway approves MCP servers at the server level; individual tools within an approved server can't be disabled. — Microsoft Entra agent identity documentation, 18 Jul 2026
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. — Gartner, 2026
- EDPB names pseudonymization as a GDPR risk mitigation for AI models. — EDPB Opinion 28/2024
Other head-to-heads
DataShield vs Vanta
Compliance reporting versus the infrastructure the report describes.
ComplementDataShield vs Zenity
Agent posture and detection versus authorization and evidence.
ComplementDataShield vs AI gateways
Routing and rate limits are not an audit trail.
AllEvery comparison
Eleven vendors, one honest scorecard each.
Keep Entra as your identity spine. Then see the two mechanisms it doesn't have: break a live audit chain in your browser, and revoke an agent mid-session. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →