diff --git a/packages/core-app-api/api-report.md b/packages/core-app-api/api-report.md
index e69ee4f325..252531f7ad 100644
--- a/packages/core-app-api/api-report.md
+++ b/packages/core-app-api/api-report.md
@@ -39,6 +39,7 @@ import { FeatureFlagsSaveOptions } from '@backstage/core-plugin-api';
 import { gitlabAuthApiRef } from '@backstage/core-plugin-api';
 import { googleAuthApiRef } from '@backstage/core-plugin-api';
 import { IconComponent } from '@backstage/core-plugin-api';
+import { IdentityApi } from '@backstage/core-plugin-api';
 import { microsoftAuthApiRef } from '@backstage/core-plugin-api';
 import { OAuthApi } from '@backstage/core-plugin-api';
 import { OAuthRequestApi } from '@backstage/core-plugin-api';
@@ -635,10 +636,10 @@ export type SamlSession = {
 
 // @public
 export type SignInPageProps = {
-  onResult(result: SignInResult): void;
+  onSignInSuccess(identityApi: IdentityApi): void;
 };
 
-// @public
+// @public @deprecated
 export type SignInResult = {
   userId: string;
   profile: ProfileInfo;
diff --git a/packages/core-app-api/src/app/types.ts b/packages/core-app-api/src/app/types.ts
index 0921bd2e17..a538ccd366 100644
--- a/packages/core-app-api/src/app/types.ts
+++ b/packages/core-app-api/src/app/types.ts
@@ -43,7 +43,7 @@ export type BootErrorPageProps = {
  * The outcome of signing in on the sign-in page.
  *
  * @public
- * @deprecated replaced by passing the {@link IdentityApi} to the {@link SignInPageProps.onSignInSuccess} instead.
+ * @deprecated replaced by passing the {@link @backstage/core-plugin-api#IdentityApi} to the {@link SignInPageProps.onSignInSuccess} instead.
  */
 export type SignInResult = {
   /**
diff --git a/packages/core-plugin-api/api-report.md b/packages/core-plugin-api/api-report.md
index 560071e1fa..9245f039df 100644
--- a/packages/core-plugin-api/api-report.md
+++ b/packages/core-plugin-api/api-report.md
@@ -10,6 +10,7 @@ import { BackstageTheme } from '@backstage/theme';
 import { ComponentType } from 'react';
 import { Config } from '@backstage/config';
 import { IconComponent as IconComponent_2 } from '@backstage/core-plugin-api';
+import { IdentityApi as IdentityApi_2 } from '@backstage/core-plugin-api';
 import { Observable as Observable_2 } from '@backstage/types';
 import { Observer as Observer_2 } from '@backstage/types';
 import { ProfileInfo as ProfileInfo_2 } from '@backstage/core-plugin-api';
@@ -236,18 +237,21 @@ export type AuthRequestOptions = {
   instantPopup?: boolean;
 };
 
-// @public
-export type BackstageIdentity = {
-  id: string;
-  idToken: string;
-  token: string;
-};
+// @public @deprecated (undocumented)
+export type BackstageIdentity = BackstageIdentityResponse;
 
 // @public
 export type BackstageIdentityApi = {
   getBackstageIdentity(
     options?: AuthRequestOptions,
-  ): Promise<BackstageIdentity | undefined>;
+  ): Promise<BackstageIdentityResponse | undefined>;
+};
+
+// @public
+export type BackstageIdentityResponse = {
+  id: string;
+  token: string;
+  identity: BackstageUserIdentity;
 };
 
 // @public
@@ -264,6 +268,13 @@ export type BackstagePlugin<
   externalRoutes: ExternalRoutes;
 };
 
+// @public
+export type BackstageUserIdentity = {
+  type: 'user';
+  userEntityRef: string;
+  ownershipEntityRefs: string[];
+};
+
 // @public
 export const bitbucketAuthApiRef: ApiRef<
   OAuthApi & ProfileInfoApi & BackstageIdentityApi & SessionApi
@@ -531,8 +542,13 @@ export type IconComponent = ComponentType<{
 // @public
 export type IdentityApi = {
   getUserId(): string;
-  getProfile(): ProfileInfo;
   getIdToken(): Promise<string | undefined>;
+  getProfile(): ProfileInfo;
+  getProfileInfo(): Promise<ProfileInfo>;
+  getBackstageIdentity(): Promise<BackstageUserIdentity>;
+  getCredentials(): Promise<{
+    token?: string;
+  }>;
   signOut(): Promise<void>;
 };
 
@@ -745,10 +761,10 @@ export enum SessionState {
 
 // @public
 export type SignInPageProps = {
-  onResult(result: SignInResult): void;
+  onSignInSuccess(identityApi: IdentityApi_2): void;
 };
 
-// @public
+// @public @deprecated
 export type SignInResult = {
   userId: string;
   profile: ProfileInfo_2;
diff --git a/packages/core-plugin-api/src/apis/definitions/IdentityApi.ts b/packages/core-plugin-api/src/apis/definitions/IdentityApi.ts
index 36d43f93ff..fe4de89106 100644
--- a/packages/core-plugin-api/src/apis/definitions/IdentityApi.ts
+++ b/packages/core-plugin-api/src/apis/definitions/IdentityApi.ts
@@ -26,7 +26,7 @@ export type IdentityApi = {
    * The ID of the signed in user. This ID is not meant to be presented to the user, but used
    * as an opaque string to pass on to backends or use in frontend logic.
    *
-   * @deprecated use {@link IdentityApi.getIdentity} instead.
+   * @deprecated use {@link IdentityApi.getBackstageIdentity} instead.
    */
   getUserId(): string;
 
diff --git a/plugins/auth-backend/api-report.md b/plugins/auth-backend/api-report.md
index 46d8b03cbb..2004490261 100644
--- a/plugins/auth-backend/api-report.md
+++ b/plugins/auth-backend/api-report.md
@@ -103,7 +103,7 @@ export interface AuthProviderRouteHandlers {
 export type AuthResponse<ProviderInfo> = {
   providerInfo: ProviderInfo;
   profile: ProfileInfo;
-  backstageIdentity?: BackstageIdentity;
+  backstageIdentity?: BackstageIdentityResponse;
 };
 
 // Warning: (ae-missing-release-tag) "AwsAlbProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -116,14 +116,19 @@ export type AwsAlbProviderOptions = {
   };
 };
 
-// Warning: (ae-missing-release-tag) "BackstageIdentity" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type BackstageIdentity = {
+// @public
+export type BackstageIdentityResponse = {
   id: string;
-  idToken?: string;
-  token?: string;
   entity?: Entity;
+  token: string;
+  identity?: BackstageUserIdentity;
+};
+
+// @public
+export type BackstageUserIdentity = {
+  type: 'user';
+  userEntityRef: string;
+  ownershipEntityRefs: string[];
 };
 
 // Warning: (ae-missing-release-tag) "BitbucketOAuthResult" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -361,7 +366,7 @@ export type GoogleProviderOptions = {
 // @public
 export class IdentityClient {
   constructor(options: { discovery: PluginEndpointDiscovery; issuer: string });
-  authenticate(token: string | undefined): Promise<BackstageIdentity>;
+  authenticate(token: string | undefined): Promise<BackstageIdentityResponse>;
   static getBearerToken(
     authorizationHeader: string | undefined,
   ): string | undefined;
@@ -551,8 +556,6 @@ export const postMessageResponse: (
   response: WebMessageResponse,
 ) => void;
 
-// Warning: (ae-missing-release-tag) "ProfileInfo" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public
 export type ProfileInfo = {
   email?: string;
@@ -637,5 +640,4 @@ export type WebMessageResponse =
 // src/providers/github/provider.d.ts:71:68 - (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
 // src/providers/github/provider.d.ts:78:5 - (ae-forgotten-export) The symbol "StateEncoder" needs to be exported by the entry point index.d.ts
 // src/providers/types.d.ts:100:5 - (ae-forgotten-export) The symbol "AuthProviderConfig" needs to be exported by the entry point index.d.ts
-// src/providers/types.d.ts:122:8 - (tsdoc-missing-deprecation-message) The @deprecated block must include a deprecation message, e.g. describing the recommended alternative
 ```
diff --git a/plugins/auth-backend/src/providers/index.ts b/plugins/auth-backend/src/providers/index.ts
index 5ad0b84074..5b4fbc6338 100644
--- a/plugins/auth-backend/src/providers/index.ts
+++ b/plugins/auth-backend/src/providers/index.ts
@@ -38,4 +38,9 @@ export type {
 
 // These types are needed for a postMessage from the login pop-up
 // to the frontend
-export type { AuthResponse, BackstageUserIdentity, ProfileInfo } from './types';
+export type {
+  AuthResponse,
+  BackstageUserIdentity,
+  BackstageIdentityResponse,
+  ProfileInfo,
+} from './types';
diff --git a/plugins/auth-backend/src/providers/types.ts b/plugins/auth-backend/src/providers/types.ts
index 17f7002d41..1d2c6f5134 100644
--- a/plugins/auth-backend/src/providers/types.ts
+++ b/plugins/auth-backend/src/providers/types.ts
@@ -165,6 +165,7 @@ export type BackstageUserIdentity = {
 };
 
 /**
+ * Response object containing the {@link BackstageUserIdentity} and the token from the authentication provider.
  * @public
  */
 export type BackstageIdentityResponse = {
diff --git a/plugins/permission-backend/src/service/router.ts b/plugins/permission-backend/src/service/router.ts
index b85e7feb85..41791b8fc8 100644
--- a/plugins/permission-backend/src/service/router.ts
+++ b/plugins/permission-backend/src/service/router.ts
@@ -23,7 +23,7 @@ import {
   PluginEndpointDiscovery,
 } from '@backstage/backend-common';
 import {
-  BackstageIdentity,
+  BackstageIdentityResponse,
   IdentityClient,
 } from '@backstage/plugin-auth-backend';
 import {
@@ -71,7 +71,7 @@ export interface RouterOptions {
 
 const handleRequest = async (
   { id, resourceRef, ...request }: Identified<AuthorizeRequest>,
-  user: BackstageIdentity | undefined,
+  user: BackstageIdentityResponse | undefined,
   policy: PermissionPolicy,
   permissionIntegrationClient: PermissionIntegrationClient,
   authHeader?: string,
diff --git a/plugins/permission-node/src/policy/types.ts b/plugins/permission-node/src/policy/types.ts
index 3548d051f6..d122ad8d8d 100644
--- a/plugins/permission-node/src/policy/types.ts
+++ b/plugins/permission-node/src/policy/types.ts
@@ -20,7 +20,7 @@ import {
   PermissionCondition,
   PermissionCriteria,
 } from '@backstage/plugin-permission-common';
-import { BackstageIdentity } from '@backstage/plugin-auth-backend';
+import { BackstageIdentityResponse } from '@backstage/plugin-auth-backend';
 
 /**
  * An authorization request to be evaluated by the {@link PermissionPolicy}.
@@ -83,6 +83,6 @@ export type PolicyDecision =
 export interface PermissionPolicy {
   handle(
     request: PolicyAuthorizeRequest,
-    user?: BackstageIdentity,
+    user?: BackstageIdentityResponse,
   ): Promise<PolicyDecision>;
 }