English | EN 
Cross-cloud identity management is emerging as a key requirement for agent-based systems in multi-cloud environments. A user signs in through Microsoft Entra, but their AI agent needs to interact with a Google API. The difficulty lies in securely carrying that user identity across cloud boundaries, without storing credentials or compromising traceability.
This is the problem that Workforce Identity Federation (WIF) combined with the On-Behalf-Of (OBO) flow solves.
The flow can be understood in simple steps:
1. User authenticates, and the agent receives an Entra-issued JWT token.
2. The agent sends that token to Google’s Security Token Service (STS) endpoint (https://sts.googleapis.com/v1/token) using the standard RFC 8693 token exchange protocol.
3. Google validates the token using the Entra tenant’s JWKS endpoint. This trust is pre-configured using a Workload Identity Pool.
4. Google issues a short-lived federated access token.
5. The agent calls the Google API, where the downstream service recognizes the user’s identity rather than the agent’s identity.
This approach eliminates the need for credential storage, avoids service account key management, and preserves the user context across cloud environments.
Cross-cloud agentic workflows are becoming the norm. Ensuring proper identity propagation and validation across cloud boundaries is critical for building secure, auditable, and production-ready systems.
