diff --git a/.changeset/three-bats-provide.md b/.changeset/three-bats-provide.md
new file mode 100644
index 0000000000..efb44a1fc8
--- /dev/null
+++ b/.changeset/three-bats-provide.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': minor
+---
+
+Update provider subs to return full entity ref.
diff --git a/plugins/auth-backend/src/providers/github/provider.test.ts b/plugins/auth-backend/src/providers/github/provider.test.ts
index b11ac7f5a1..15eeccc07c 100644
--- a/plugins/auth-backend/src/providers/github/provider.test.ts
+++ b/plugins/auth-backend/src/providers/github/provider.test.ts
@@ -93,7 +93,7 @@ describe('GithubAuthProvider', () => {
       const expected = {
         backstageIdentity: {
           id: 'jimmymarkum',
-          token: 'token-for-jimmymarkum',
+          token: 'token-for-user:default/jimmymarkum',
         },
         providerInfo: {
           accessToken: '19xasczxcm9n7gacn9jdgm19me',
@@ -138,7 +138,7 @@ describe('GithubAuthProvider', () => {
       const expected = {
         backstageIdentity: {
           id: 'jimmymarkum',
-          token: 'token-for-jimmymarkum',
+          token: 'token-for-user:default/jimmymarkum',
         },
         providerInfo: {
           accessToken: '19xasczxcm9n7gacn9jdgm19me',
@@ -181,7 +181,7 @@ describe('GithubAuthProvider', () => {
       const expected = {
         backstageIdentity: {
           id: 'jimmymarkum',
-          token: 'token-for-jimmymarkum',
+          token: 'token-for-user:default/jimmymarkum',
         },
         providerInfo: {
           accessToken: '19xasczxcm9n7gacn9jdgm19me',
@@ -224,7 +224,7 @@ describe('GithubAuthProvider', () => {
       const expected = {
         backstageIdentity: {
           id: 'daveboyle',
-          token: 'token-for-daveboyle',
+          token: 'token-for-user:default/daveboyle',
         },
         providerInfo: {
           accessToken:
@@ -268,7 +268,7 @@ describe('GithubAuthProvider', () => {
         response: {
           backstageIdentity: {
             id: 'ipd12039',
-            token: 'token-for-ipd12039',
+            token: 'token-for-user:default/ipd12039',
           },
           providerInfo: {
             accessToken: 'a.b.c',
@@ -322,7 +322,7 @@ describe('GithubAuthProvider', () => {
         response: {
           backstageIdentity: {
             id: 'mockuser',
-            token: 'token-for-mockuser',
+            token: 'token-for-user:default/mockuser',
           },
           profile: {
             displayName: 'Mocked User',
diff --git a/plugins/auth-backend/src/providers/github/provider.ts b/plugins/auth-backend/src/providers/github/provider.ts
index c5ccdb2d59..220ec4fcce 100644
--- a/plugins/auth-backend/src/providers/github/provider.ts
+++ b/plugins/auth-backend/src/providers/github/provider.ts
@@ -191,7 +191,10 @@ export const githubDefaultSignInResolver: SignInResolver<GithubOAuthResult> =
     const userId = fullProfile.username || fullProfile.id;
 
     const token = await ctx.tokenIssuer.issueToken({
-      claims: { sub: userId, ent: [`user:default/${userId}`] },
+      claims: {
+        sub: `user:default/${userId}`,
+        ent: [`user:default/${userId}`],
+      },
     });
 
     return { id: userId, token };
diff --git a/plugins/auth-backend/src/providers/gitlab/provider.ts b/plugins/auth-backend/src/providers/gitlab/provider.ts
index 28deb458d9..5454065847 100644
--- a/plugins/auth-backend/src/providers/gitlab/provider.ts
+++ b/plugins/auth-backend/src/providers/gitlab/provider.ts
@@ -72,7 +72,7 @@ export const gitlabDefaultSignInResolver: SignInResolver<OAuthResult> = async (
   }
 
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: id, ent: [`user:default/${id}`] },
+    claims: { sub: `user:default/${id}`, ent: [`user:default/${id}`] },
   });
 
   return { id, token };
diff --git a/plugins/auth-backend/src/providers/microsoft/provider.ts b/plugins/auth-backend/src/providers/microsoft/provider.ts
index c45e152581..2d4a53b076 100644
--- a/plugins/auth-backend/src/providers/microsoft/provider.ts
+++ b/plugins/auth-backend/src/providers/microsoft/provider.ts
@@ -231,7 +231,10 @@ export const microsoftDefaultSignInResolver: SignInResolver<OAuthResult> =
     const userId = profile.email.split('@')[0];
 
     const token = await ctx.tokenIssuer.issueToken({
-      claims: { sub: userId, ent: [`user:default/${userId}`] },
+      claims: {
+        sub: `user:default/${userId}`,
+        ent: [`user:default/${userId}`],
+      },
     });
 
     return { id: userId, token };
diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts
index 550b88b004..ec777c231b 100644
--- a/plugins/auth-backend/src/providers/oauth2/provider.ts
+++ b/plugins/auth-backend/src/providers/oauth2/provider.ts
@@ -211,7 +211,7 @@ export const oAuth2DefaultSignInResolver: SignInResolver<OAuthResult> = async (
   const userId = profile.email.split('@')[0];
 
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] },
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] },
   });
 
   return { id: userId, token };
diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts
index a5c663ae68..30dd295d12 100644
--- a/plugins/auth-backend/src/providers/okta/provider.ts
+++ b/plugins/auth-backend/src/providers/okta/provider.ts
@@ -236,7 +236,7 @@ export const oktaDefaultSignInResolver: SignInResolver<OAuthResult> = async (
   const userId = profile.email.split('@')[0];
 
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] },
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] },
   });
 
   return { id: userId, token };