How to Configure ServiceNow On-Behalf-Of Token Exchange with Bedrock AgentCore Gateway
ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway
- Who
- AWS
- What
- explains how to configure AgentCore Gateway for on-behalf-of token exchange with Microsoft Entra ID and the ServiceNow REST API
- Quote
This post shows how to configure AgentCore Gateway , a capability of Amazon Bedrock AgentCore, for an on-behalf-of (OBO) token exchange with Microsoft Entra ID.
What happened
AWS explains how to configure Amazon Bedrock AgentCore Gateway to exchange Microsoft Entra ID tokens on behalf of a user, allowing an AI agent to call the ServiceNow REST API with that user's identity and permissions. The walkthrough covers the Entra and ServiceNow setup, gateway configuration, and a requirement to create the gateway with MCP version 2025-11-25 for native on-behalf-of support. The exchange is configured on the gateway target and runs on each request.
Why it matters
The walkthrough traces how AgentCore Gateway exchanges tokens through Microsoft Entra ID so ServiceNow can apply the calling user's permissions, including the configuration steps and required MCP version.
Read next
See the full storyAWS Details AgentCore Gateway Setup for ServiceNow On-Behalf-Of AccessThe story so far
AWS explains how to configure Amazon Bedrock AgentCore Gateway to exchange Microsoft Entra ID tokens on a user’s behalf, letting an AI agent call the ServiceNow REST API with that user’s identity and permissions. The exchange runs on each request and is configured on the gateway target. Native on-behalf-of support requires creating the gateway with MCP version 2025-11-25; AWS says gateways created with earlier MCP versions cannot enable it. The walkthrough covers the Entra ID and ServiceNow setup as well as the gateway configuration.
Keep up with AI, one email a day
Model releases, price changes and compute developments, with original sources. Free, confirmed by email, and easy to unsubscribe. Read a past issue · 2026-11-03