Okta, Entra Agent ID, SailPoint or CyberArk? Who actually does what for your AI agents

Your AI agents need logins of their own, and four vendors now sell a way to give them one. They don't do the same job, though. Most companies end up with an identity provider for the agent's tokens and something else to find, review and stop agents, so pick by the gap you have today.

An agent on a borrowed login holds everything that login holds. If a prompt it didn't expect tricks it, or the developer who built it leaves and nobody claims it, the audit log points at a person who did nothing wrong. OWASP's top 10 for agentic applications gives this its own entry, ASI03, Identity and Privilege Abuse.

The vendors moved quickly this year, and the names moved with them. Identity Security Cloud became Human Fabric, CyberArk's platform lives on inside Palo Alto's new Idira, and Entra's agent registry moved into Agent 365. A slide deck from the spring is probably out of date, so check every product name in a proposal against the vendor's docs.

For engineers, the plumbing underneath is mostly standard OAuth. When an MCP serverdefinitionSoftware that gives agents tools over the Model Context Protocol. If you switch on authorization, it treats agents like any other API client and checks their OAuth tokens. uses authorization, the spec treats it as an OAuth resource server. It has to publish protected resource metadata (RFC 9728) and must refuse any token that was issued for someone else, and clients have to send a resource indicator with every token request.

A Stack Overflow question asks whether each layer of a multi-agent system should fetch its own token or pass one down the chain. For MCP the answer is clear: servers must not accept or pass on tokens issued for someone else, so each hop needs its own. Delegation goes back to RFC 8693, where the act claim records which agent acted for which user. Cross App AccessdefinitionAn IETF draft that Okta's Agent SSO is built on. The agent trades a user's sign-in assertion for a token to another app, and nobody sees a consent screen., the IETF draft behind Okta's Agent SSO, lets an agent trade a user's single sign-on assertion for a token to another app without a consent screen.

We worked from each vendor's admin docs and release notes, because the launch posts and the docs don't always agree. Okta's product page promises every agent explicit human ownership, for example, while its admin guide marks the owner field optional. The table sticks to what the docs say.

Pick Okta if your people already sign in through it and most of your agents live outside Microsoft. It pulls in agents built on Bedrock, Foundry, Agentforce, ServiceNow, Snowflake and a few more. Put Claude Code, Codex or Cursor behind the Agent Gateway and one policy covers every MCP tool they reach. Agent SSO is free up to the cap, so the pilot doesn't wait on procurement.

Read the gateway's limits before you design around it. It only carries MCP tool calls, it only reaches remote servers that take OAuth bearer tokens, and it runs only in Okta's cloud. An MCP server sitting inside your private network is out of its reach.

Entra wins in a Microsoft 365 shop. Copilot Studio has created an Agent ID for every new agent since May, and you can't opt out, so you already have agent identities whether you planned for them or not. Sponsors are mandatory, a Lifecycle Workflow can pass sponsorship to the manager when someone leaves, and one Conditional Access policy can block every agent built from a blueprintdefinitionThe Entra template that holds an agent's credentials and permissions. Turn it off and every agent identity built from it stops signing in, which is handy when you're not sure which one misbehaved..

The catch is licensing and reach. Agent ID itself is free, but Conditional Access for agents needs E7, or Agent 365 on top of Entra P1, and the agent governance features need Agent 365 or E7. Conditional Access only sees tokens Entra issues, so an agent calling an API with a static key walks straight past it.

SailPoint wins if you already run access reviews there and your agents are spread over several clouds. Its ownership model goes furthest. Each agent gets a primary owner and up to ten backups, and when the owner leaves, the next person on the list takes over. Reviews cover the tools an agent can reach, too, which is what auditors tend to ask about first.

It won't replace your identity provider. SailPoint doesn't issue tokens, its deactivate action only reaches five source types today, and deleting an agent in SailPoint leaves it running at the source. For IdentityIQ customers, SailPoint documents agent governance only in Agentic Fabric, its SaaS product; the 9.0 integration pushes people data one way into it.

Idira earns its place where an agent could do real damage. Think production databases, cloud consoles and any MCP server that writes. New MCP servers stay disabled until someone in security approves them, access lasts for a single task, and a rogue agent gets its next call refused.

It only controls what passes through it. An agent that calls an API directly, outside the broker or the Prisma AIRS gateway, isn't covered. Several pieces are still listed as coming soon, among them removing standing privileges on cloud providers and native SPIFFE identities in AWS.

Every product documents a hole somewhere, usually a long way from the launch blog. These are the ones that change a design.

• Okta's kill switch blocks new sessions only. Its own gateway docs say revoked tokens stay valid until they expire, and revoking live tokens at the gateway is only planned for Q4.
• In Entra, a Conditional Access policy aimed at an agent doesn't cover the agent acting for a user. In that flow the user is the token's subject, so the user's policies apply, and ID Protection pins the risk on the user as well.
• Every risk detection Entra runs on agents is offline today. That's useful for the investigation, but it won't catch an agent in the act.
• Entra has no dynamic client registration. One developer on Hacker News describes building a shim that hands every client the same pre-registered client ID, because many MCP clients assume it exists.
• SailPoint's scheduled dataset aggregation runs every 12 hours. Unless someone triggers a manual run, a shadow agent can run for up to half a day before it shows up in the register.
• Okta marks agent owners optional, and its docs don't say what happens to an agent when its owner leaves. Build that check yourself with the agent event hooks in Okta Workflows.

Few teams pick just one. The usual pattern is an identity provider for tokens with SailPoint or Idira on top, and SailPoint's onboarding asks you to pick Entra ID or Okta as the identity provider. Moving agents between identity providers is the expensive part, because each agent's credentials, app links and policies get rebuilt by hand.

Some Okta settings can't be changed later at all. An OIDC app link is permanent, and so is the registration method once you choose a client ID metadata document, so settle those before the first production agent.

We usually start with an inventory: which agents you run and whose logins they borrow. After that it's about making the tools you own do more, and only then looking at buying. Our identity engineers work across Okta, Microsoft Entra, SailPoint and CyberArk. Read about our AI agent identity practice, bring in an identity engineer, or book an assessment to map your agents first.