Microsoft Entra Agent ID manages agent identities and Conditional Access. Willow governs employee AI tools with MCP discovery, approved capabilities, device policies, and runtime approvals.
A Microsoft 365 organization approves Claude Code and Copilot Studio for its engineers. Entra already holds every employee identity, and now it can hold agent identities too. Security still has to answer what those agents can touch: which MCP servers run on each laptop, which skills shape agent behavior, which tool calls need a person to sign off, and what happens when an agent authenticates with an API key instead of an Entra token.
Microsoft Entra Agent ID is Microsoft's answer to the identity half of that question. It extends Entra to AI agents with agent identities, identity blueprints, Conditional Access, risk detection and lifecycle management, and it supports OAuth 2.0, MCP and A2A for authentication. Agents built on Microsoft and non-Microsoft platforms can receive a governed identity.
Willow answers the access half. It discovers local MCP servers, skills and plugins, applies allow, warn and block rules on the device, and gives employees an approved catalog of servers, toolkits and skills through company groups. Publication checks review what the organization distributes, and approval before selected tool calls keeps consequential actions under human review. Willow uses Entra ID for SSO and SCIM, so the identities Entra manages become the people and groups Willow governs.
That is why this comparison is less a choice than a division of work. Entra Agent ID decides whether an agent may get a token. Willow decides which capabilities that agent and its user may install, receive and call, and records what happened.
The last row matters most. Microsoft states that Conditional Access only protects resources secured by Microsoft Entra ID, and that an agent using an API key bypasses the Entra token pipeline entirely. Some MCP servers and developer tools authenticate that way. Willow's gateway, Vault and device policy give security a control point for those paths too.
Agents on developer machines are shaped by more than their identity. An MCP server added to Cursor, a skill installed in Claude Code or a CLAUDE.md file with standing instructions all change what an agent does. Willow's Scan Agent inventories those capabilities, and teams on Microsoft endpoints can deploy it with Intune.
Findings become allow, warn and block rules scoped to everyone, specific groups, users or devices. A block rewrites the MCP entry to a local Willow endpoint or renames the skill file, and the agent restores the original when the rule is removed. Willow can also push approved agent configuration to Claude Code, Claude Desktop, Codex, Cursor and GitHub Copilot through the Scan Agent, currently in beta. Security sets the starting configuration, not only the exceptions.
An identity that can obtain a token still needs limits on what it does next. Willow supports tool-level availability and human approval before selected tools run. A team can keep read operations open, disable write tools, and require confirmation for a sensitive invocation. Approval applies to every call to a tool marked for it, and runtime guards inspect each call before it reaches the MCP server and each response before it returns.
Willow groups decide which MCP servers, toolkits and skills each employee can use, and SCIM from Entra keeps those groups current. Organizational skills can be synced from GitHub and bundled into plugins. Willow also offers governed connectors for the Microsoft estate, including a dedicated Microsoft Entra Admin connector for directory tasks such as blocking sign-in and revoking sessions, under the same guards and approvals as every other tool.
Willow's build-time guards check tool selections, embedded prompts, skill text and command definitions before a toolkit or plugin is published. If the content violates a configured policy, the publish is blocked. An agent identity can be perfectly governed and still run a harmful skill; publication review closes that gap.
Willow's Guard Hooks evaluate every user prompt and file-tool call in Claude Code, Cursor and Codex before the agent acts; they fail open on a timeout or outage. Prompt Guard applies the same guards to ChatGPT, Claude, Gemini, Microsoft 365 Copilot and DeepSeek in Chrome and Edge. The extension is in beta and an admin turns interception on.
Request logs record the user, agent, server, tool, outcome and guard decision for each request Willow handles, and Radar scores AI security risk across identity, shadow AI, data exposure, agents and monitoring. Machine users carry accountable human owners and group-scoped access. Willow deploys as SaaS, hybrid or full on-premises, with no runtime dependency on Willow SaaS in the on-premises model.
Entra Agent ID is the natural identity layer for organizations already standardized on Microsoft:
These are identity and Microsoft 365 controls. They are strongest where resources sit behind Entra tokens, and they pair well with a layer that governs the tools those identities call.
As of 28 October 2026, Willow lists a $0 Free plan and Enterprise pricing per human seat, billed annually, with volume tiers. Enterprise includes shadow AI discovery across the fleet, runtime guardrails, browser prompt guards and SCIM, and Willow can be purchased through AWS Marketplace. Willow deploys as SaaS, hybrid or full on-premises.
Microsoft states that Agent ID is available to all Entra customers, but extending Entra security features to agents requires Microsoft Agent 365. Agent 365 is included with Microsoft 365 E7 and available as an add-on to E5, A5 or Business Premium. Conditional Access for agents and ID Governance for agents require E7, or Agent 365 paired with at least Entra P1 or Microsoft 365 E3. Agent 365 has been generally available since 1 May 2026 and is licensed per user.
For most Microsoft-centered organizations, yes. Entra stays the system of record for every human and agent identity, and Willow inherits those identities through SSO and SCIM. Willow then governs the capabilities those identities reach: local MCP servers and skills, the approved catalog, publication review, tool-level availability and approval before sensitive calls.
The split is clean. Conditional Access decides whether a token is issued. Willow decides what happens after, including for tools that authenticate with API keys and never touch an Entra token.
Entra Agent ID gives Microsoft organizations a strong identity foundation for agents. Willow turns that foundation into governed AI adoption: what runs on each device, what employees receive, what needs review and what every call did. To see Willow working with your Entra tenant, book a demo or start on the Free plan.
Not primarily. Entra Agent ID manages agent identities and access tokens. Willow governs the AI tools, skills and actions those identities reach, and it uses Entra ID for single sign-on and SCIM provisioning.
Microsoft documents that Conditional Access is evaluated when Entra issues or refreshes a token and protects resources secured by Entra ID. An agent that uses an API key bypasses that pipeline. Willow's gateway and device policies govern tool calls and local capabilities regardless of how the tool authenticates.
Yes. Willow documents deploying the Scan Agent to managed Windows devices through Microsoft Intune. The agent discovers MCP configurations, skills, plugins and instruction files, and enforces policy rules on the device.
Agent ID is available to all Entra customers, but extending Entra security features to agents requires Microsoft Agent 365, included with Microsoft 365 E7 or available as an add-on. Conditional Access and ID Governance for agents require E7, or Agent 365 with at least Entra P1 or Microsoft 365 E3.
Yes. Beyond Entra SSO and SCIM, Willow offers governed connectors for Microsoft services, including a Microsoft Entra Admin connector for directory administration through Microsoft Graph. Each connector runs under Willow's tool availability, guards and approvals.
Yes. Full on-premises deployment runs every Willow component in the customer's Kubernetes cluster, with no dependency on Willow SaaS at runtime.
Give them a Basecamp. Go from AI chaos to AI work, in minutes.
