[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-microsoft-entra-agent-id":3,"mdc-9rtw8w-key":41,"related-org-microsoft-entra-agent-id":3089,"related-repo-microsoft-entra-agent-id":3281},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":29,"repoUrl":30,"updatedAt":31,"license":32,"forks":33,"topics":34,"repo":36,"sourceUrl":39,"mdContent":40},"entra-agent-id","provision and configure Microsoft Entra agent identities","Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"microsoft","Microsoft","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fmicrosoft.png",[12,16,19,20,23,26],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Azure","azure",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Access Control","access-control",{"name":24,"slug":25,"type":15},"OAuth","oauth",{"name":27,"slug":28,"type":15},"Entra ID","entra-id",1324,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills","2026-07-31T05:56:10.076594","MIT",220,[35],"agent-skills",{"repoUrl":30,"stars":29,"forks":33,"topics":37,"description":38},[35],"Official agent plugin providing skills and MCP server configurations for Azure scenarios.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fentra-agent-id","---\nname: entra-agent-id\ndescription: \"Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).\"\nlicense: MIT\nmetadata:\n  author: Microsoft\n  version: \"1.1.1\"\n---\n\n# Microsoft Entra Agent ID\n\nCreate and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.\n\n## Quick Reference\n\n| Property | Value |\n|----------|-------|\n| Service | Microsoft Entra Agent ID |\n| API | Microsoft Graph (`https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`) |\n| Required role | Agent Identity Developer, Agent Identity Administrator, or Application Administrator |\n| Object model | Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) |\n| Runtime exchange | Two-step `fmi_path` exchange (autonomous and OBO) |\n| .NET helper | `Microsoft.Identity.Web.AgentIdentities` |\n| Polyglot helper | Microsoft Entra SDK for AgentID (sidecar container) |\n\n## When to Use This Skill\n\n- Provisioning a new Agent Identity Blueprint and BlueprintPrincipal\n- Creating per-instance Agent Identities under a Blueprint\n- Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint\n- Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO)\n- Cross-tenant agent token flows\n- Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)\n- Granting per-Agent-Identity application (`appRoleAssignments`) or delegated (`oauth2PermissionGrants`) permissions\n- Diagnosing Agent ID errors such as `AADSTS82001`, `AADSTS700211`, or `PropertyNotCompatibleWithAgentIdentity`\n\n## MCP Tools\n\n| Tool | Use |\n|------|-----|\n| `mcp_azure_mcp_documentation` | Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration |\n\nThere is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python `requests`). Use `mcp_azure_mcp_documentation` to verify request bodies and endpoints against current docs before running.\n\n## Before You Start\n\nUse the `mcp_azure_mcp_documentation` tool to search Microsoft Learn for current Agent ID documentation:\n- \"Microsoft Entra Agent ID setup instructions\"\n- \"Microsoft Entra SDK for AgentID\"\n\nVerify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.\n\n## Conceptual Model\n\n```\nAgent Identity Blueprint (application)         ← one per agent type\u002Fproject\n  └── BlueprintPrincipal (service principal)    ← MUST be created explicitly\n        ├── Agent Identity (SP): agent-1        ← one per agent instance\n        ├── Agent Identity (SP): agent-2\n        └── Agent Identity (SP): agent-3\n```\n\n| Concept | Description |\n|---------|-------------|\n| **Blueprint** | Application object that defines a type\u002Fclass of agent. Holds credentials (secret, certificate, federated identity). |\n| **BlueprintPrincipal** | Service principal for the Blueprint in the tenant. Not auto-created. |\n| **Agent Identity** | Service-principal-only identity for a single agent instance. Cannot hold its own credentials. |\n| **Sponsor** | A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation. |\n\n## Prerequisites\n\n### Required Entra Roles\n\nOne of: **Agent Identity Developer**, **Agent Identity Administrator**, or **Application Administrator**.\n\n### PowerShell (interactive setup)\n\n```powershell\n# PowerShell 7+\nInstall-Module Microsoft.Graph.Applications -Scope CurrentUser -Force\n```\n\n### Python (programmatic provisioning)\n\n```bash\npip install azure-identity requests\n```\n\n## Authentication\n\n> **`DefaultAzureCredential` is not supported.** Azure CLI tokens carry `Directory.AccessAsUser.All`, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with `client_credentials`, or `Connect-MgGraph` with explicit delegated scopes.\n\n### PowerShell (delegated)\n\n```powershell\nConnect-MgGraph -Scopes @(\n    \"AgentIdentityBlueprint.Create\",\n    \"AgentIdentityBlueprint.ReadWrite.All\",\n    \"AgentIdentityBlueprintPrincipal.Create\",\n    \"AgentIdentity.Create.All\",\n    \"User.Read\"\n)\n```\n\n### Python (application)\n\n```python\nimport os, requests\nfrom azure.identity import ClientSecretCredential\n\ncredential = ClientSecretCredential(\n    tenant_id=os.environ[\"AZURE_TENANT_ID\"],\n    client_id=os.environ[\"AZURE_CLIENT_ID\"],\n    client_secret=os.environ[\"AZURE_CLIENT_SECRET\"],\n)\ntoken = credential.get_token(\"https:\u002F\u002Fgraph.microsoft.com\u002F.default\")\n\nGRAPH = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\nheaders = {\n    \"Authorization\": f\"Bearer {token.token}\",\n    \"Content-Type\": \"application\u002Fjson\",\n    \"OData-Version\": \"4.0\",\n}\n```\n\n## Core Workflow\n\n### Step 1: Create Agent Identity Blueprint\n\nUse the typed endpoint. Sponsors must be **Users** at Blueprint creation. This snippet assumes the `requests` client and `headers` dict from the Python authentication block above.\n\n```python\nimport subprocess\nimport requests\n\nuser_id = subprocess.run(\n    [\"az\", \"ad\", \"signed-in-user\", \"show\", \"--query\", \"id\", \"-o\", \"tsv\"],\n    capture_output=True, text=True, check=True,\n).stdout.strip()\n\nblueprint_body = {\n    \"displayName\": \"My Agent Blueprint\",\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint\",\n    headers=headers, json=blueprint_body,\n)\nresp.raise_for_status()\n\nblueprint = resp.json()\napp_id = blueprint[\"appId\"]\nblueprint_obj_id = blueprint[\"id\"]\n```\n\n### Step 2: Create BlueprintPrincipal\n\n> Mandatory. Creating a Blueprint does NOT auto-create its service principal. Skipping this step produces:\n> `400: The Agent Blueprint Principal for the Agent Blueprint does not exist.`\n\n```python\nsp_body = {\"appId\": app_id}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal\",\n    headers=headers, json=sp_body,\n)\nresp.raise_for_status()\n```\n\nMake your provisioning scripts idempotent — always check for the BlueprintPrincipal even when the Blueprint already exists.\n\n### Step 3: Create Agent Identities\n\nSponsors for an Agent Identity may be **Users or Groups**.\n\n```python\nagent_body = {\n    \"displayName\": \"my-agent-instance-1\",\n    \"agentIdentityBlueprintId\": app_id,\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity\",\n    headers=headers, json=agent_body,\n)\nresp.raise_for_status()\nagent = resp.json()\nagent_sp_id = agent[\"id\"]\n```\n\n## Runtime Authentication\n\nAgents authenticate at runtime using credentials configured on the **Blueprint** (not on the Agent Identity — Agent Identities can't hold credentials).\n\n| Option | Use case | Credential on Blueprint |\n|--------|----------|------------------------|\n| **Managed Identity + WIF** | Production (Azure-hosted) | Federated Identity Credential |\n| **Client secret** | Local dev \u002F testing | Password credential |\n| **Microsoft Entra SDK for AgentID** | Polyglot \u002F 3P agents | Sidecar container acquires tokens over HTTP |\n\nFor the two-step `fmi_path` exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct `sub` claim and audit trail, see [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md).\n\nFor OBO (agent acting on behalf of a user), see [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md).\n\nFor the containerized polyglot auth sidecar (Python, Node, Go, Java — no SDK embedding), see [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md).\n\nFor MI+WIF and client-secret setup details, see [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md).\n\n### .NET quick path\n\nFor .NET services, use **`Microsoft.Identity.Web.AgentIdentities`** — it handles Federated Identity Credential management and the two-step exchange for you. See the package README at `github.com\u002FAzureAD\u002Fmicrosoft-identity-web` under `src\u002FMicrosoft.Identity.Web.AgentIdentities\u002F`.\n\n## Granting Permissions (Per Agent Identity)\n\nAgent Identities support both application permissions (autonomous) and delegated permissions (OBO). Grants are scoped **per Agent Identity**, not to the BlueprintPrincipal.\n\n### Application permissions (autonomous)\n\n```python\ngraph_sp = requests.get(\n    f\"{GRAPH}\u002FservicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'\",\n    headers=headers,\n).json()[\"value\"][0]\n\nuser_read_all = next(r for r in graph_sp[\"appRoles\"] if r[\"value\"] == \"User.Read.All\")\n\nrequests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002F{agent_sp_id}\u002FappRoleAssignments\",\n    headers=headers,\n    json={\n        \"principalId\": agent_sp_id,\n        \"resourceId\": graph_sp[\"id\"],\n        \"appRoleId\": user_read_all[\"id\"],\n    },\n).raise_for_status()\n```\n\n### Delegated permissions (OBO)\n\n```python\nfrom datetime import datetime, timedelta, timezone\n\nexpiry = (datetime.now(timezone.utc) + timedelta(days=3650)).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n\nrequests.post(\n    f\"{GRAPH}\u002Foauth2PermissionGrants\",\n    headers=headers,\n    json={\n        \"clientId\": agent_sp_id,\n        \"consentType\": \"AllPrincipals\",\n        \"resourceId\": graph_sp[\"id\"],\n        \"scope\": \"User.Read Tasks.ReadWrite Mail.Send\",\n        \"expiryTime\": expiry,\n    },\n).raise_for_status()\n```\n\nBrowser-based admin consent URLs do not work for Agent Identities — use `oauth2PermissionGrants` for programmatic delegated consent.\n\n## Cross-Tenant Agent Identities\n\nBlueprints can be multi-tenant (`signInAudience: AzureADMultipleOrgs`). When exchanging tokens cross-tenant:\n\n> **Step 1 of the parent token exchange MUST target the Agent Identity's home tenant**, not the Blueprint's. Wrong tenant → `AADSTS700211: No matching federated identity record found`.\n\nSee [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) for full cross-tenant examples.\n\n## API Reference\n\n| Operation | Method | Endpoint |\n|-----------|--------|----------|\n| Create Blueprint | `POST` | `\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint` |\n| Create BlueprintPrincipal | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal` |\n| Create Agent Identity | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Add FIC to Blueprint | `POST` | `\u002Fapplications\u002F{id}\u002Fmicrosoft.graph.agentIdentityBlueprint\u002FfederatedIdentityCredentials` |\n| List Agent Identities | `GET` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Grant app permission | `POST` | `\u002FservicePrincipals\u002F{id}\u002FappRoleAssignments` |\n| Grant delegated permission | `POST` | `\u002Foauth2PermissionGrants` |\n| Delete Agent Identity | `DELETE` | `\u002FservicePrincipals\u002F{id}` |\n| Delete Blueprint | `DELETE` | `\u002Fapplications\u002F{id}` |\n\nBase URL: `https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`.\n\n## Required Graph Permissions\n\n| Permission | Purpose |\n|-----------|---------|\n| `AgentIdentityBlueprint.Create` | Create Blueprints |\n| `AgentIdentityBlueprint.ReadWrite.All` | Read\u002Fupdate Blueprints |\n| `AgentIdentityBlueprintPrincipal.Create` | Create BlueprintPrincipals |\n| `AgentIdentity.Create.All` | Create Agent Identities |\n| `AgentIdentity.ReadWrite.All` | Read\u002Fupdate Agent Identities |\n| `Application.ReadWrite.All` | Blueprint CRUD on application objects |\n| `AppRoleAssignment.ReadWrite.All` | Grant application permissions |\n| `DelegatedPermissionGrant.ReadWrite.All` | Grant delegated permissions |\n\nGrant admin consent (required for application permissions):\n\n```bash\naz ad app permission admin-consent --id \u003Cclient-id>\n```\n\nAfter admin consent, tokens may not include new claims for 30–120 seconds — retry with exponential backoff.\n\n## Best Practices\n\n1. **Always create BlueprintPrincipal after Blueprint** — not auto-created.\n2. **Use typed endpoints** (`\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint`) instead of raw `\u002Fapplications` with `@odata.type`.\n3. **Credentials live on the Blueprint** — Agent Identities can't hold secrets\u002Fcerts (`PropertyNotCompatibleWithAgentIdentity`).\n4. **Include `OData-Version: 4.0`** on every Graph request.\n5. **Use Workload Identity Federation for production** — client secrets only for local dev.\n6. **Set `identifierUris: [\"api:\u002F\u002F{appId}\"]` on the Blueprint** before OAuth2 scope resolution.\n7. **Never use Azure CLI tokens** for Agent Identity APIs — `Directory.AccessAsUser.All` causes hard 403.\n8. **Use `fmi_path`** with `client_credentials` — NOT RFC 8693 `urn:ietf:params:oauth:grant-type:token-exchange` (returns `AADSTS82001`).\n9. **Always use `\u002F.default` scope** in both steps of the exchange — individual scopes fail.\n10. **Step 1 targets the Agent Identity's home tenant** in cross-tenant flows.\n11. **Grant permissions per Agent Identity**, not to the BlueprintPrincipal.\n12. **Handle permission-propagation delays** — retry 403s with 30–120s backoff after admin consent.\n13. **Keep the Entra SDK for AgentID on localhost** — never expose via LoadBalancer or Ingress.\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n|-------|-------|-----|\n| `AADSTS82001` | Used RFC 8693 token-exchange grant | Use `client_credentials` with `fmi_path` |\n| `AADSTS700211` | Step 1 parent token targeted wrong tenant | Target Agent Identity's home tenant |\n| `AADSTS50013` | OBO user token targets Graph, not Blueprint | Use `api:\u002F\u002F{blueprint_app_id}\u002Faccess_as_user` |\n| `AADSTS65001` | Missing grant or used individual scopes | Use `\u002F.default` and verify `oauth2PermissionGrants` |\n| `403 Authorization_RequestDenied` | No grant on this Agent Identity | Add via `appRoleAssignments` or `oauth2PermissionGrants` |\n| `PropertyNotCompatibleWithAgentIdentity` | Tried to add credential to Agent Identity SP | Put credentials on the Blueprint |\n| `Agent Blueprint Principal does not exist` | BlueprintPrincipal not created | Step 2 of the Core Workflow |\n| `AADSTS650051` on admin consent | SP already exists from partial consent | Grant directly via `appRoleAssignments` |\n\n## References\n\n| File | Contents |\n|------|----------|\n| [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) | Two-step `fmi_path` exchange: autonomous + OBO, cross-tenant |\n| [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md) | MI + WIF (production) and client secret (local dev) |\n| [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md) | Configuring the Blueprint as an OAuth2 API for OBO |\n| [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md) | Microsoft Entra SDK for AgentID — architecture, configuration, endpoints |\n| [references\u002Fsdk-sidecar-deployment.md](references\u002Fsdk-sidecar-deployment.md) | SDK code patterns (Python\u002FTypeScript), Docker\u002FKubernetes manifests, security, troubleshooting |\n| [references\u002Fknown-limitations.md](references\u002Fknown-limitations.md) | Documented gaps organized by category |\n\n### External Links\n\n| Resource | URL |\n|----------|-----|\n| Agent ID Setup Guide | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-setup-instructions |\n| AI-Guided Setup | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-ai-guided-setup |\n| Microsoft Entra SDK for AgentID | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fmsidweb\u002Fagent-id-sdk\u002Foverview |\n| Microsoft.Identity.Web.AgentIdentities (.NET) | https:\u002F\u002Fgithub.com\u002FAzureAD\u002Fmicrosoft-identity-web\u002Fblob\u002Fmaster\u002Fsrc\u002FMicrosoft.Identity.Web.AgentIdentities\u002FREADME.AgentIdentities.md |\n",{"data":42,"body":45},{"name":4,"description":6,"license":32,"metadata":43},{"author":9,"version":44},"1.1.1",{"type":46,"children":47},"root",[48,57,63,70,209,215,305,311,350,370,376,388,401,406,412,424,511,517,524,548,554,583,589,623,629,672,678,746,752,897,903,909,936,1129,1135,1149,1201,1206,1212,1223,1335,1341,1352,1442,1469,1480,1491,1502,1508,1538,1544,1556,1562,1694,1700,1819,1831,1837,1850,1870,1881,1887,2141,2152,2158,2316,2321,2383,2388,2394,2610,2616,2861,2867,2987,2993,3083],{"type":49,"tag":50,"props":51,"children":53},"element","h1",{"id":52},"microsoft-entra-agent-id",[54],{"type":55,"value":56},"text","Microsoft Entra Agent ID",{"type":49,"tag":58,"props":59,"children":60},"p",{},[61],{"type":55,"value":62},"Create and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.",{"type":49,"tag":64,"props":65,"children":67},"h2",{"id":66},"quick-reference",[68],{"type":55,"value":69},"Quick Reference",{"type":49,"tag":71,"props":72,"children":73},"table",{},[74,93],{"type":49,"tag":75,"props":76,"children":77},"thead",{},[78],{"type":49,"tag":79,"props":80,"children":81},"tr",{},[82,88],{"type":49,"tag":83,"props":84,"children":85},"th",{},[86],{"type":55,"value":87},"Property",{"type":49,"tag":83,"props":89,"children":90},{},[91],{"type":55,"value":92},"Value",{"type":49,"tag":94,"props":95,"children":96},"tbody",{},[97,110,132,145,158,179,196],{"type":49,"tag":79,"props":98,"children":99},{},[100,106],{"type":49,"tag":101,"props":102,"children":103},"td",{},[104],{"type":55,"value":105},"Service",{"type":49,"tag":101,"props":107,"children":108},{},[109],{"type":55,"value":56},{"type":49,"tag":79,"props":111,"children":112},{},[113,118],{"type":49,"tag":101,"props":114,"children":115},{},[116],{"type":55,"value":117},"API",{"type":49,"tag":101,"props":119,"children":120},{},[121,123,130],{"type":55,"value":122},"Microsoft Graph (",{"type":49,"tag":124,"props":125,"children":127},"code",{"className":126},[],[128],{"type":55,"value":129},"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0",{"type":55,"value":131},")",{"type":49,"tag":79,"props":133,"children":134},{},[135,140],{"type":49,"tag":101,"props":136,"children":137},{},[138],{"type":55,"value":139},"Required role",{"type":49,"tag":101,"props":141,"children":142},{},[143],{"type":55,"value":144},"Agent Identity Developer, Agent Identity Administrator, or Application Administrator",{"type":49,"tag":79,"props":146,"children":147},{},[148,153],{"type":49,"tag":101,"props":149,"children":150},{},[151],{"type":55,"value":152},"Object model",{"type":49,"tag":101,"props":154,"children":155},{},[156],{"type":55,"value":157},"Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP)",{"type":49,"tag":79,"props":159,"children":160},{},[161,166],{"type":49,"tag":101,"props":162,"children":163},{},[164],{"type":55,"value":165},"Runtime exchange",{"type":49,"tag":101,"props":167,"children":168},{},[169,171,177],{"type":55,"value":170},"Two-step ",{"type":49,"tag":124,"props":172,"children":174},{"className":173},[],[175],{"type":55,"value":176},"fmi_path",{"type":55,"value":178}," exchange (autonomous and OBO)",{"type":49,"tag":79,"props":180,"children":181},{},[182,187],{"type":49,"tag":101,"props":183,"children":184},{},[185],{"type":55,"value":186},".NET helper",{"type":49,"tag":101,"props":188,"children":189},{},[190],{"type":49,"tag":124,"props":191,"children":193},{"className":192},[],[194],{"type":55,"value":195},"Microsoft.Identity.Web.AgentIdentities",{"type":49,"tag":79,"props":197,"children":198},{},[199,204],{"type":49,"tag":101,"props":200,"children":201},{},[202],{"type":55,"value":203},"Polyglot helper",{"type":49,"tag":101,"props":205,"children":206},{},[207],{"type":55,"value":208},"Microsoft Entra SDK for AgentID (sidecar container)",{"type":49,"tag":64,"props":210,"children":212},{"id":211},"when-to-use-this-skill",[213],{"type":55,"value":214},"When to Use This Skill",{"type":49,"tag":216,"props":217,"children":218},"ul",{},[219,225,230,235,247,252,257,278],{"type":49,"tag":220,"props":221,"children":222},"li",{},[223],{"type":55,"value":224},"Provisioning a new Agent Identity Blueprint and BlueprintPrincipal",{"type":49,"tag":220,"props":226,"children":227},{},[228],{"type":55,"value":229},"Creating per-instance Agent Identities under a Blueprint",{"type":49,"tag":220,"props":231,"children":232},{},[233],{"type":55,"value":234},"Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint",{"type":49,"tag":220,"props":236,"children":237},{},[238,240,245],{"type":55,"value":239},"Implementing the two-step ",{"type":49,"tag":124,"props":241,"children":243},{"className":242},[],[244],{"type":55,"value":176},{"type":55,"value":246}," runtime token exchange (autonomous or OBO)",{"type":49,"tag":220,"props":248,"children":249},{},[250],{"type":55,"value":251},"Cross-tenant agent token flows",{"type":49,"tag":220,"props":253,"children":254},{},[255],{"type":55,"value":256},"Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)",{"type":49,"tag":220,"props":258,"children":259},{},[260,262,268,270,276],{"type":55,"value":261},"Granting per-Agent-Identity application (",{"type":49,"tag":124,"props":263,"children":265},{"className":264},[],[266],{"type":55,"value":267},"appRoleAssignments",{"type":55,"value":269},") or delegated (",{"type":49,"tag":124,"props":271,"children":273},{"className":272},[],[274],{"type":55,"value":275},"oauth2PermissionGrants",{"type":55,"value":277},") permissions",{"type":49,"tag":220,"props":279,"children":280},{},[281,283,289,291,297,299],{"type":55,"value":282},"Diagnosing Agent ID errors such as ",{"type":49,"tag":124,"props":284,"children":286},{"className":285},[],[287],{"type":55,"value":288},"AADSTS82001",{"type":55,"value":290},", ",{"type":49,"tag":124,"props":292,"children":294},{"className":293},[],[295],{"type":55,"value":296},"AADSTS700211",{"type":55,"value":298},", or ",{"type":49,"tag":124,"props":300,"children":302},{"className":301},[],[303],{"type":55,"value":304},"PropertyNotCompatibleWithAgentIdentity",{"type":49,"tag":64,"props":306,"children":308},{"id":307},"mcp-tools",[309],{"type":55,"value":310},"MCP Tools",{"type":49,"tag":71,"props":312,"children":313},{},[314,330],{"type":49,"tag":75,"props":315,"children":316},{},[317],{"type":49,"tag":79,"props":318,"children":319},{},[320,325],{"type":49,"tag":83,"props":321,"children":322},{},[323],{"type":55,"value":324},"Tool",{"type":49,"tag":83,"props":326,"children":327},{},[328],{"type":55,"value":329},"Use",{"type":49,"tag":94,"props":331,"children":332},{},[333],{"type":49,"tag":79,"props":334,"children":335},{},[336,345],{"type":49,"tag":101,"props":337,"children":338},{},[339],{"type":49,"tag":124,"props":340,"children":342},{"className":341},[],[343],{"type":55,"value":344},"mcp_azure_mcp_documentation",{"type":49,"tag":101,"props":346,"children":347},{},[348],{"type":55,"value":349},"Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration",{"type":49,"tag":58,"props":351,"children":352},{},[353,355,361,363,368],{"type":55,"value":354},"There is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python ",{"type":49,"tag":124,"props":356,"children":358},{"className":357},[],[359],{"type":55,"value":360},"requests",{"type":55,"value":362},"). Use ",{"type":49,"tag":124,"props":364,"children":366},{"className":365},[],[367],{"type":55,"value":344},{"type":55,"value":369}," to verify request bodies and endpoints against current docs before running.",{"type":49,"tag":64,"props":371,"children":373},{"id":372},"before-you-start",[374],{"type":55,"value":375},"Before You Start",{"type":49,"tag":58,"props":377,"children":378},{},[379,381,386],{"type":55,"value":380},"Use the ",{"type":49,"tag":124,"props":382,"children":384},{"className":383},[],[385],{"type":55,"value":344},{"type":55,"value":387}," tool to search Microsoft Learn for current Agent ID documentation:",{"type":49,"tag":216,"props":389,"children":390},{},[391,396],{"type":49,"tag":220,"props":392,"children":393},{},[394],{"type":55,"value":395},"\"Microsoft Entra Agent ID setup instructions\"",{"type":49,"tag":220,"props":397,"children":398},{},[399],{"type":55,"value":400},"\"Microsoft Entra SDK for AgentID\"",{"type":49,"tag":58,"props":402,"children":403},{},[404],{"type":55,"value":405},"Verify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.",{"type":49,"tag":64,"props":407,"children":409},{"id":408},"conceptual-model",[410],{"type":55,"value":411},"Conceptual Model",{"type":49,"tag":413,"props":414,"children":418},"pre",{"className":415,"code":417,"language":55},[416],"language-text","Agent Identity Blueprint (application)         ← one per agent type\u002Fproject\n  └── BlueprintPrincipal (service principal)    ← MUST be created explicitly\n        ├── Agent Identity (SP): agent-1        ← one per agent instance\n        ├── Agent Identity (SP): agent-2\n        └── Agent Identity (SP): agent-3\n",[419],{"type":49,"tag":124,"props":420,"children":422},{"__ignoreMap":421},"",[423],{"type":55,"value":417},{"type":49,"tag":71,"props":425,"children":426},{},[427,443],{"type":49,"tag":75,"props":428,"children":429},{},[430],{"type":49,"tag":79,"props":431,"children":432},{},[433,438],{"type":49,"tag":83,"props":434,"children":435},{},[436],{"type":55,"value":437},"Concept",{"type":49,"tag":83,"props":439,"children":440},{},[441],{"type":55,"value":442},"Description",{"type":49,"tag":94,"props":444,"children":445},{},[446,463,479,495],{"type":49,"tag":79,"props":447,"children":448},{},[449,458],{"type":49,"tag":101,"props":450,"children":451},{},[452],{"type":49,"tag":453,"props":454,"children":455},"strong",{},[456],{"type":55,"value":457},"Blueprint",{"type":49,"tag":101,"props":459,"children":460},{},[461],{"type":55,"value":462},"Application object that defines a type\u002Fclass of agent. Holds credentials (secret, certificate, federated identity).",{"type":49,"tag":79,"props":464,"children":465},{},[466,474],{"type":49,"tag":101,"props":467,"children":468},{},[469],{"type":49,"tag":453,"props":470,"children":471},{},[472],{"type":55,"value":473},"BlueprintPrincipal",{"type":49,"tag":101,"props":475,"children":476},{},[477],{"type":55,"value":478},"Service principal for the Blueprint in the tenant. Not auto-created.",{"type":49,"tag":79,"props":480,"children":481},{},[482,490],{"type":49,"tag":101,"props":483,"children":484},{},[485],{"type":49,"tag":453,"props":486,"children":487},{},[488],{"type":55,"value":489},"Agent Identity",{"type":49,"tag":101,"props":491,"children":492},{},[493],{"type":55,"value":494},"Service-principal-only identity for a single agent instance. Cannot hold its own credentials.",{"type":49,"tag":79,"props":496,"children":497},{},[498,506],{"type":49,"tag":101,"props":499,"children":500},{},[501],{"type":49,"tag":453,"props":502,"children":503},{},[504],{"type":55,"value":505},"Sponsor",{"type":49,"tag":101,"props":507,"children":508},{},[509],{"type":55,"value":510},"A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation.",{"type":49,"tag":64,"props":512,"children":514},{"id":513},"prerequisites",[515],{"type":55,"value":516},"Prerequisites",{"type":49,"tag":518,"props":519,"children":521},"h3",{"id":520},"required-entra-roles",[522],{"type":55,"value":523},"Required Entra Roles",{"type":49,"tag":58,"props":525,"children":526},{},[527,529,534,535,540,541,546],{"type":55,"value":528},"One of: ",{"type":49,"tag":453,"props":530,"children":531},{},[532],{"type":55,"value":533},"Agent Identity Developer",{"type":55,"value":290},{"type":49,"tag":453,"props":536,"children":537},{},[538],{"type":55,"value":539},"Agent Identity Administrator",{"type":55,"value":298},{"type":49,"tag":453,"props":542,"children":543},{},[544],{"type":55,"value":545},"Application Administrator",{"type":55,"value":547},".",{"type":49,"tag":518,"props":549,"children":551},{"id":550},"powershell-interactive-setup",[552],{"type":55,"value":553},"PowerShell (interactive setup)",{"type":49,"tag":413,"props":555,"children":559},{"className":556,"code":557,"language":558,"meta":421,"style":421},"language-powershell shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# PowerShell 7+\nInstall-Module Microsoft.Graph.Applications -Scope CurrentUser -Force\n","powershell",[560],{"type":49,"tag":124,"props":561,"children":562},{"__ignoreMap":421},[563,574],{"type":49,"tag":564,"props":565,"children":568},"span",{"class":566,"line":567},"line",1,[569],{"type":49,"tag":564,"props":570,"children":571},{},[572],{"type":55,"value":573},"# PowerShell 7+\n",{"type":49,"tag":564,"props":575,"children":577},{"class":566,"line":576},2,[578],{"type":49,"tag":564,"props":579,"children":580},{},[581],{"type":55,"value":582},"Install-Module Microsoft.Graph.Applications -Scope CurrentUser -Force\n",{"type":49,"tag":518,"props":584,"children":586},{"id":585},"python-programmatic-provisioning",[587],{"type":55,"value":588},"Python (programmatic provisioning)",{"type":49,"tag":413,"props":590,"children":594},{"className":591,"code":592,"language":593,"meta":421,"style":421},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","pip install azure-identity requests\n","bash",[595],{"type":49,"tag":124,"props":596,"children":597},{"__ignoreMap":421},[598],{"type":49,"tag":564,"props":599,"children":600},{"class":566,"line":567},[601,607,613,618],{"type":49,"tag":564,"props":602,"children":604},{"style":603},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[605],{"type":55,"value":606},"pip",{"type":49,"tag":564,"props":608,"children":610},{"style":609},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[611],{"type":55,"value":612}," install",{"type":49,"tag":564,"props":614,"children":615},{"style":609},[616],{"type":55,"value":617}," azure-identity",{"type":49,"tag":564,"props":619,"children":620},{"style":609},[621],{"type":55,"value":622}," requests\n",{"type":49,"tag":64,"props":624,"children":626},{"id":625},"authentication",[627],{"type":55,"value":628},"Authentication",{"type":49,"tag":630,"props":631,"children":632},"blockquote",{},[633],{"type":49,"tag":58,"props":634,"children":635},{},[636,647,649,655,657,663,664,670],{"type":49,"tag":453,"props":637,"children":638},{},[639,645],{"type":49,"tag":124,"props":640,"children":642},{"className":641},[],[643],{"type":55,"value":644},"DefaultAzureCredential",{"type":55,"value":646}," is not supported.",{"type":55,"value":648}," Azure CLI tokens carry ",{"type":49,"tag":124,"props":650,"children":652},{"className":651},[],[653],{"type":55,"value":654},"Directory.AccessAsUser.All",{"type":55,"value":656},", which Agent Identity APIs hard-reject (403). Use a dedicated app registration with ",{"type":49,"tag":124,"props":658,"children":660},{"className":659},[],[661],{"type":55,"value":662},"client_credentials",{"type":55,"value":298},{"type":49,"tag":124,"props":665,"children":667},{"className":666},[],[668],{"type":55,"value":669},"Connect-MgGraph",{"type":55,"value":671}," with explicit delegated scopes.",{"type":49,"tag":518,"props":673,"children":675},{"id":674},"powershell-delegated",[676],{"type":55,"value":677},"PowerShell (delegated)",{"type":49,"tag":413,"props":679,"children":681},{"className":556,"code":680,"language":558,"meta":421,"style":421},"Connect-MgGraph -Scopes @(\n    \"AgentIdentityBlueprint.Create\",\n    \"AgentIdentityBlueprint.ReadWrite.All\",\n    \"AgentIdentityBlueprintPrincipal.Create\",\n    \"AgentIdentity.Create.All\",\n    \"User.Read\"\n)\n",[682],{"type":49,"tag":124,"props":683,"children":684},{"__ignoreMap":421},[685,693,701,710,719,728,737],{"type":49,"tag":564,"props":686,"children":687},{"class":566,"line":567},[688],{"type":49,"tag":564,"props":689,"children":690},{},[691],{"type":55,"value":692},"Connect-MgGraph -Scopes @(\n",{"type":49,"tag":564,"props":694,"children":695},{"class":566,"line":576},[696],{"type":49,"tag":564,"props":697,"children":698},{},[699],{"type":55,"value":700},"    \"AgentIdentityBlueprint.Create\",\n",{"type":49,"tag":564,"props":702,"children":704},{"class":566,"line":703},3,[705],{"type":49,"tag":564,"props":706,"children":707},{},[708],{"type":55,"value":709},"    \"AgentIdentityBlueprint.ReadWrite.All\",\n",{"type":49,"tag":564,"props":711,"children":713},{"class":566,"line":712},4,[714],{"type":49,"tag":564,"props":715,"children":716},{},[717],{"type":55,"value":718},"    \"AgentIdentityBlueprintPrincipal.Create\",\n",{"type":49,"tag":564,"props":720,"children":722},{"class":566,"line":721},5,[723],{"type":49,"tag":564,"props":724,"children":725},{},[726],{"type":55,"value":727},"    \"AgentIdentity.Create.All\",\n",{"type":49,"tag":564,"props":729,"children":731},{"class":566,"line":730},6,[732],{"type":49,"tag":564,"props":733,"children":734},{},[735],{"type":55,"value":736},"    \"User.Read\"\n",{"type":49,"tag":564,"props":738,"children":740},{"class":566,"line":739},7,[741],{"type":49,"tag":564,"props":742,"children":743},{},[744],{"type":55,"value":745},")\n",{"type":49,"tag":518,"props":747,"children":749},{"id":748},"python-application",[750],{"type":55,"value":751},"Python (application)",{"type":49,"tag":413,"props":753,"children":757},{"className":754,"code":755,"language":756,"meta":421,"style":421},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import os, requests\nfrom azure.identity import ClientSecretCredential\n\ncredential = ClientSecretCredential(\n    tenant_id=os.environ[\"AZURE_TENANT_ID\"],\n    client_id=os.environ[\"AZURE_CLIENT_ID\"],\n    client_secret=os.environ[\"AZURE_CLIENT_SECRET\"],\n)\ntoken = credential.get_token(\"https:\u002F\u002Fgraph.microsoft.com\u002F.default\")\n\nGRAPH = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\nheaders = {\n    \"Authorization\": f\"Bearer {token.token}\",\n    \"Content-Type\": \"application\u002Fjson\",\n    \"OData-Version\": \"4.0\",\n}\n","python",[758],{"type":49,"tag":124,"props":759,"children":760},{"__ignoreMap":421},[761,769,777,786,794,802,810,818,826,835,843,852,861,870,879,888],{"type":49,"tag":564,"props":762,"children":763},{"class":566,"line":567},[764],{"type":49,"tag":564,"props":765,"children":766},{},[767],{"type":55,"value":768},"import os, requests\n",{"type":49,"tag":564,"props":770,"children":771},{"class":566,"line":576},[772],{"type":49,"tag":564,"props":773,"children":774},{},[775],{"type":55,"value":776},"from azure.identity import ClientSecretCredential\n",{"type":49,"tag":564,"props":778,"children":779},{"class":566,"line":703},[780],{"type":49,"tag":564,"props":781,"children":783},{"emptyLinePlaceholder":782},true,[784],{"type":55,"value":785},"\n",{"type":49,"tag":564,"props":787,"children":788},{"class":566,"line":712},[789],{"type":49,"tag":564,"props":790,"children":791},{},[792],{"type":55,"value":793},"credential = ClientSecretCredential(\n",{"type":49,"tag":564,"props":795,"children":796},{"class":566,"line":721},[797],{"type":49,"tag":564,"props":798,"children":799},{},[800],{"type":55,"value":801},"    tenant_id=os.environ[\"AZURE_TENANT_ID\"],\n",{"type":49,"tag":564,"props":803,"children":804},{"class":566,"line":730},[805],{"type":49,"tag":564,"props":806,"children":807},{},[808],{"type":55,"value":809},"    client_id=os.environ[\"AZURE_CLIENT_ID\"],\n",{"type":49,"tag":564,"props":811,"children":812},{"class":566,"line":739},[813],{"type":49,"tag":564,"props":814,"children":815},{},[816],{"type":55,"value":817},"    client_secret=os.environ[\"AZURE_CLIENT_SECRET\"],\n",{"type":49,"tag":564,"props":819,"children":821},{"class":566,"line":820},8,[822],{"type":49,"tag":564,"props":823,"children":824},{},[825],{"type":55,"value":745},{"type":49,"tag":564,"props":827,"children":829},{"class":566,"line":828},9,[830],{"type":49,"tag":564,"props":831,"children":832},{},[833],{"type":55,"value":834},"token = credential.get_token(\"https:\u002F\u002Fgraph.microsoft.com\u002F.default\")\n",{"type":49,"tag":564,"props":836,"children":838},{"class":566,"line":837},10,[839],{"type":49,"tag":564,"props":840,"children":841},{"emptyLinePlaceholder":782},[842],{"type":55,"value":785},{"type":49,"tag":564,"props":844,"children":846},{"class":566,"line":845},11,[847],{"type":49,"tag":564,"props":848,"children":849},{},[850],{"type":55,"value":851},"GRAPH = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\n",{"type":49,"tag":564,"props":853,"children":855},{"class":566,"line":854},12,[856],{"type":49,"tag":564,"props":857,"children":858},{},[859],{"type":55,"value":860},"headers = {\n",{"type":49,"tag":564,"props":862,"children":864},{"class":566,"line":863},13,[865],{"type":49,"tag":564,"props":866,"children":867},{},[868],{"type":55,"value":869},"    \"Authorization\": f\"Bearer {token.token}\",\n",{"type":49,"tag":564,"props":871,"children":873},{"class":566,"line":872},14,[874],{"type":49,"tag":564,"props":875,"children":876},{},[877],{"type":55,"value":878},"    \"Content-Type\": \"application\u002Fjson\",\n",{"type":49,"tag":564,"props":880,"children":882},{"class":566,"line":881},15,[883],{"type":49,"tag":564,"props":884,"children":885},{},[886],{"type":55,"value":887},"    \"OData-Version\": \"4.0\",\n",{"type":49,"tag":564,"props":889,"children":891},{"class":566,"line":890},16,[892],{"type":49,"tag":564,"props":893,"children":894},{},[895],{"type":55,"value":896},"}\n",{"type":49,"tag":64,"props":898,"children":900},{"id":899},"core-workflow",[901],{"type":55,"value":902},"Core Workflow",{"type":49,"tag":518,"props":904,"children":906},{"id":905},"step-1-create-agent-identity-blueprint",[907],{"type":55,"value":908},"Step 1: Create Agent Identity Blueprint",{"type":49,"tag":58,"props":910,"children":911},{},[912,914,919,921,926,928,934],{"type":55,"value":913},"Use the typed endpoint. Sponsors must be ",{"type":49,"tag":453,"props":915,"children":916},{},[917],{"type":55,"value":918},"Users",{"type":55,"value":920}," at Blueprint creation. This snippet assumes the ",{"type":49,"tag":124,"props":922,"children":924},{"className":923},[],[925],{"type":55,"value":360},{"type":55,"value":927}," client and ",{"type":49,"tag":124,"props":929,"children":931},{"className":930},[],[932],{"type":55,"value":933},"headers",{"type":55,"value":935}," dict from the Python authentication block above.",{"type":49,"tag":413,"props":937,"children":939},{"className":754,"code":938,"language":756,"meta":421,"style":421},"import subprocess\nimport requests\n\nuser_id = subprocess.run(\n    [\"az\", \"ad\", \"signed-in-user\", \"show\", \"--query\", \"id\", \"-o\", \"tsv\"],\n    capture_output=True, text=True, check=True,\n).stdout.strip()\n\nblueprint_body = {\n    \"displayName\": \"My Agent Blueprint\",\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint\",\n    headers=headers, json=blueprint_body,\n)\nresp.raise_for_status()\n\nblueprint = resp.json()\napp_id = blueprint[\"appId\"]\nblueprint_obj_id = blueprint[\"id\"]\n",[940],{"type":49,"tag":124,"props":941,"children":942},{"__ignoreMap":421},[943,951,959,966,974,982,990,998,1005,1013,1021,1029,1037,1045,1052,1060,1068,1077,1085,1094,1102,1111,1120],{"type":49,"tag":564,"props":944,"children":945},{"class":566,"line":567},[946],{"type":49,"tag":564,"props":947,"children":948},{},[949],{"type":55,"value":950},"import subprocess\n",{"type":49,"tag":564,"props":952,"children":953},{"class":566,"line":576},[954],{"type":49,"tag":564,"props":955,"children":956},{},[957],{"type":55,"value":958},"import requests\n",{"type":49,"tag":564,"props":960,"children":961},{"class":566,"line":703},[962],{"type":49,"tag":564,"props":963,"children":964},{"emptyLinePlaceholder":782},[965],{"type":55,"value":785},{"type":49,"tag":564,"props":967,"children":968},{"class":566,"line":712},[969],{"type":49,"tag":564,"props":970,"children":971},{},[972],{"type":55,"value":973},"user_id = subprocess.run(\n",{"type":49,"tag":564,"props":975,"children":976},{"class":566,"line":721},[977],{"type":49,"tag":564,"props":978,"children":979},{},[980],{"type":55,"value":981},"    [\"az\", \"ad\", \"signed-in-user\", \"show\", \"--query\", \"id\", \"-o\", \"tsv\"],\n",{"type":49,"tag":564,"props":983,"children":984},{"class":566,"line":730},[985],{"type":49,"tag":564,"props":986,"children":987},{},[988],{"type":55,"value":989},"    capture_output=True, text=True, check=True,\n",{"type":49,"tag":564,"props":991,"children":992},{"class":566,"line":739},[993],{"type":49,"tag":564,"props":994,"children":995},{},[996],{"type":55,"value":997},").stdout.strip()\n",{"type":49,"tag":564,"props":999,"children":1000},{"class":566,"line":820},[1001],{"type":49,"tag":564,"props":1002,"children":1003},{"emptyLinePlaceholder":782},[1004],{"type":55,"value":785},{"type":49,"tag":564,"props":1006,"children":1007},{"class":566,"line":828},[1008],{"type":49,"tag":564,"props":1009,"children":1010},{},[1011],{"type":55,"value":1012},"blueprint_body = {\n",{"type":49,"tag":564,"props":1014,"children":1015},{"class":566,"line":837},[1016],{"type":49,"tag":564,"props":1017,"children":1018},{},[1019],{"type":55,"value":1020},"    \"displayName\": \"My Agent Blueprint\",\n",{"type":49,"tag":564,"props":1022,"children":1023},{"class":566,"line":845},[1024],{"type":49,"tag":564,"props":1025,"children":1026},{},[1027],{"type":55,"value":1028},"    \"sponsors@odata.bind\": [\n",{"type":49,"tag":564,"props":1030,"children":1031},{"class":566,"line":854},[1032],{"type":49,"tag":564,"props":1033,"children":1034},{},[1035],{"type":55,"value":1036},"        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n",{"type":49,"tag":564,"props":1038,"children":1039},{"class":566,"line":863},[1040],{"type":49,"tag":564,"props":1041,"children":1042},{},[1043],{"type":55,"value":1044},"    ],\n",{"type":49,"tag":564,"props":1046,"children":1047},{"class":566,"line":872},[1048],{"type":49,"tag":564,"props":1049,"children":1050},{},[1051],{"type":55,"value":896},{"type":49,"tag":564,"props":1053,"children":1054},{"class":566,"line":881},[1055],{"type":49,"tag":564,"props":1056,"children":1057},{},[1058],{"type":55,"value":1059},"resp = requests.post(\n",{"type":49,"tag":564,"props":1061,"children":1062},{"class":566,"line":890},[1063],{"type":49,"tag":564,"props":1064,"children":1065},{},[1066],{"type":55,"value":1067},"    f\"{GRAPH}\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint\",\n",{"type":49,"tag":564,"props":1069,"children":1071},{"class":566,"line":1070},17,[1072],{"type":49,"tag":564,"props":1073,"children":1074},{},[1075],{"type":55,"value":1076},"    headers=headers, json=blueprint_body,\n",{"type":49,"tag":564,"props":1078,"children":1080},{"class":566,"line":1079},18,[1081],{"type":49,"tag":564,"props":1082,"children":1083},{},[1084],{"type":55,"value":745},{"type":49,"tag":564,"props":1086,"children":1088},{"class":566,"line":1087},19,[1089],{"type":49,"tag":564,"props":1090,"children":1091},{},[1092],{"type":55,"value":1093},"resp.raise_for_status()\n",{"type":49,"tag":564,"props":1095,"children":1097},{"class":566,"line":1096},20,[1098],{"type":49,"tag":564,"props":1099,"children":1100},{"emptyLinePlaceholder":782},[1101],{"type":55,"value":785},{"type":49,"tag":564,"props":1103,"children":1105},{"class":566,"line":1104},21,[1106],{"type":49,"tag":564,"props":1107,"children":1108},{},[1109],{"type":55,"value":1110},"blueprint = resp.json()\n",{"type":49,"tag":564,"props":1112,"children":1114},{"class":566,"line":1113},22,[1115],{"type":49,"tag":564,"props":1116,"children":1117},{},[1118],{"type":55,"value":1119},"app_id = blueprint[\"appId\"]\n",{"type":49,"tag":564,"props":1121,"children":1123},{"class":566,"line":1122},23,[1124],{"type":49,"tag":564,"props":1125,"children":1126},{},[1127],{"type":55,"value":1128},"blueprint_obj_id = blueprint[\"id\"]\n",{"type":49,"tag":518,"props":1130,"children":1132},{"id":1131},"step-2-create-blueprintprincipal",[1133],{"type":55,"value":1134},"Step 2: Create BlueprintPrincipal",{"type":49,"tag":630,"props":1136,"children":1137},{},[1138],{"type":49,"tag":58,"props":1139,"children":1140},{},[1141,1143],{"type":55,"value":1142},"Mandatory. Creating a Blueprint does NOT auto-create its service principal. Skipping this step produces:\n",{"type":49,"tag":124,"props":1144,"children":1146},{"className":1145},[],[1147],{"type":55,"value":1148},"400: The Agent Blueprint Principal for the Agent Blueprint does not exist.",{"type":49,"tag":413,"props":1150,"children":1152},{"className":754,"code":1151,"language":756,"meta":421,"style":421},"sp_body = {\"appId\": app_id}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal\",\n    headers=headers, json=sp_body,\n)\nresp.raise_for_status()\n",[1153],{"type":49,"tag":124,"props":1154,"children":1155},{"__ignoreMap":421},[1156,1164,1171,1179,1187,1194],{"type":49,"tag":564,"props":1157,"children":1158},{"class":566,"line":567},[1159],{"type":49,"tag":564,"props":1160,"children":1161},{},[1162],{"type":55,"value":1163},"sp_body = {\"appId\": app_id}\n",{"type":49,"tag":564,"props":1165,"children":1166},{"class":566,"line":576},[1167],{"type":49,"tag":564,"props":1168,"children":1169},{},[1170],{"type":55,"value":1059},{"type":49,"tag":564,"props":1172,"children":1173},{"class":566,"line":703},[1174],{"type":49,"tag":564,"props":1175,"children":1176},{},[1177],{"type":55,"value":1178},"    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal\",\n",{"type":49,"tag":564,"props":1180,"children":1181},{"class":566,"line":712},[1182],{"type":49,"tag":564,"props":1183,"children":1184},{},[1185],{"type":55,"value":1186},"    headers=headers, json=sp_body,\n",{"type":49,"tag":564,"props":1188,"children":1189},{"class":566,"line":721},[1190],{"type":49,"tag":564,"props":1191,"children":1192},{},[1193],{"type":55,"value":745},{"type":49,"tag":564,"props":1195,"children":1196},{"class":566,"line":730},[1197],{"type":49,"tag":564,"props":1198,"children":1199},{},[1200],{"type":55,"value":1093},{"type":49,"tag":58,"props":1202,"children":1203},{},[1204],{"type":55,"value":1205},"Make your provisioning scripts idempotent — always check for the BlueprintPrincipal even when the Blueprint already exists.",{"type":49,"tag":518,"props":1207,"children":1209},{"id":1208},"step-3-create-agent-identities",[1210],{"type":55,"value":1211},"Step 3: Create Agent Identities",{"type":49,"tag":58,"props":1213,"children":1214},{},[1215,1217,1222],{"type":55,"value":1216},"Sponsors for an Agent Identity may be ",{"type":49,"tag":453,"props":1218,"children":1219},{},[1220],{"type":55,"value":1221},"Users or Groups",{"type":55,"value":547},{"type":49,"tag":413,"props":1224,"children":1226},{"className":754,"code":1225,"language":756,"meta":421,"style":421},"agent_body = {\n    \"displayName\": \"my-agent-instance-1\",\n    \"agentIdentityBlueprintId\": app_id,\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity\",\n    headers=headers, json=agent_body,\n)\nresp.raise_for_status()\nagent = resp.json()\nagent_sp_id = agent[\"id\"]\n",[1227],{"type":49,"tag":124,"props":1228,"children":1229},{"__ignoreMap":421},[1230,1238,1246,1254,1261,1268,1275,1282,1289,1297,1305,1312,1319,1327],{"type":49,"tag":564,"props":1231,"children":1232},{"class":566,"line":567},[1233],{"type":49,"tag":564,"props":1234,"children":1235},{},[1236],{"type":55,"value":1237},"agent_body = {\n",{"type":49,"tag":564,"props":1239,"children":1240},{"class":566,"line":576},[1241],{"type":49,"tag":564,"props":1242,"children":1243},{},[1244],{"type":55,"value":1245},"    \"displayName\": \"my-agent-instance-1\",\n",{"type":49,"tag":564,"props":1247,"children":1248},{"class":566,"line":703},[1249],{"type":49,"tag":564,"props":1250,"children":1251},{},[1252],{"type":55,"value":1253},"    \"agentIdentityBlueprintId\": app_id,\n",{"type":49,"tag":564,"props":1255,"children":1256},{"class":566,"line":712},[1257],{"type":49,"tag":564,"props":1258,"children":1259},{},[1260],{"type":55,"value":1028},{"type":49,"tag":564,"props":1262,"children":1263},{"class":566,"line":721},[1264],{"type":49,"tag":564,"props":1265,"children":1266},{},[1267],{"type":55,"value":1036},{"type":49,"tag":564,"props":1269,"children":1270},{"class":566,"line":730},[1271],{"type":49,"tag":564,"props":1272,"children":1273},{},[1274],{"type":55,"value":1044},{"type":49,"tag":564,"props":1276,"children":1277},{"class":566,"line":739},[1278],{"type":49,"tag":564,"props":1279,"children":1280},{},[1281],{"type":55,"value":896},{"type":49,"tag":564,"props":1283,"children":1284},{"class":566,"line":820},[1285],{"type":49,"tag":564,"props":1286,"children":1287},{},[1288],{"type":55,"value":1059},{"type":49,"tag":564,"props":1290,"children":1291},{"class":566,"line":828},[1292],{"type":49,"tag":564,"props":1293,"children":1294},{},[1295],{"type":55,"value":1296},"    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity\",\n",{"type":49,"tag":564,"props":1298,"children":1299},{"class":566,"line":837},[1300],{"type":49,"tag":564,"props":1301,"children":1302},{},[1303],{"type":55,"value":1304},"    headers=headers, json=agent_body,\n",{"type":49,"tag":564,"props":1306,"children":1307},{"class":566,"line":845},[1308],{"type":49,"tag":564,"props":1309,"children":1310},{},[1311],{"type":55,"value":745},{"type":49,"tag":564,"props":1313,"children":1314},{"class":566,"line":854},[1315],{"type":49,"tag":564,"props":1316,"children":1317},{},[1318],{"type":55,"value":1093},{"type":49,"tag":564,"props":1320,"children":1321},{"class":566,"line":863},[1322],{"type":49,"tag":564,"props":1323,"children":1324},{},[1325],{"type":55,"value":1326},"agent = resp.json()\n",{"type":49,"tag":564,"props":1328,"children":1329},{"class":566,"line":872},[1330],{"type":49,"tag":564,"props":1331,"children":1332},{},[1333],{"type":55,"value":1334},"agent_sp_id = agent[\"id\"]\n",{"type":49,"tag":64,"props":1336,"children":1338},{"id":1337},"runtime-authentication",[1339],{"type":55,"value":1340},"Runtime Authentication",{"type":49,"tag":58,"props":1342,"children":1343},{},[1344,1346,1350],{"type":55,"value":1345},"Agents authenticate at runtime using credentials configured on the ",{"type":49,"tag":453,"props":1347,"children":1348},{},[1349],{"type":55,"value":457},{"type":55,"value":1351}," (not on the Agent Identity — Agent Identities can't hold credentials).",{"type":49,"tag":71,"props":1353,"children":1354},{},[1355,1376],{"type":49,"tag":75,"props":1356,"children":1357},{},[1358],{"type":49,"tag":79,"props":1359,"children":1360},{},[1361,1366,1371],{"type":49,"tag":83,"props":1362,"children":1363},{},[1364],{"type":55,"value":1365},"Option",{"type":49,"tag":83,"props":1367,"children":1368},{},[1369],{"type":55,"value":1370},"Use case",{"type":49,"tag":83,"props":1372,"children":1373},{},[1374],{"type":55,"value":1375},"Credential on Blueprint",{"type":49,"tag":94,"props":1377,"children":1378},{},[1379,1400,1421],{"type":49,"tag":79,"props":1380,"children":1381},{},[1382,1390,1395],{"type":49,"tag":101,"props":1383,"children":1384},{},[1385],{"type":49,"tag":453,"props":1386,"children":1387},{},[1388],{"type":55,"value":1389},"Managed Identity + WIF",{"type":49,"tag":101,"props":1391,"children":1392},{},[1393],{"type":55,"value":1394},"Production (Azure-hosted)",{"type":49,"tag":101,"props":1396,"children":1397},{},[1398],{"type":55,"value":1399},"Federated Identity Credential",{"type":49,"tag":79,"props":1401,"children":1402},{},[1403,1411,1416],{"type":49,"tag":101,"props":1404,"children":1405},{},[1406],{"type":49,"tag":453,"props":1407,"children":1408},{},[1409],{"type":55,"value":1410},"Client secret",{"type":49,"tag":101,"props":1412,"children":1413},{},[1414],{"type":55,"value":1415},"Local dev \u002F testing",{"type":49,"tag":101,"props":1417,"children":1418},{},[1419],{"type":55,"value":1420},"Password credential",{"type":49,"tag":79,"props":1422,"children":1423},{},[1424,1432,1437],{"type":49,"tag":101,"props":1425,"children":1426},{},[1427],{"type":49,"tag":453,"props":1428,"children":1429},{},[1430],{"type":55,"value":1431},"Microsoft Entra SDK for AgentID",{"type":49,"tag":101,"props":1433,"children":1434},{},[1435],{"type":55,"value":1436},"Polyglot \u002F 3P agents",{"type":49,"tag":101,"props":1438,"children":1439},{},[1440],{"type":55,"value":1441},"Sidecar container acquires tokens over HTTP",{"type":49,"tag":58,"props":1443,"children":1444},{},[1445,1447,1452,1454,1460,1462,1468],{"type":55,"value":1446},"For the two-step ",{"type":49,"tag":124,"props":1448,"children":1450},{"className":1449},[],[1451],{"type":55,"value":176},{"type":55,"value":1453}," exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct ",{"type":49,"tag":124,"props":1455,"children":1457},{"className":1456},[],[1458],{"type":55,"value":1459},"sub",{"type":55,"value":1461}," claim and audit trail, see ",{"type":49,"tag":1463,"props":1464,"children":1466},"a",{"href":1465},"references\u002Fruntime-token-exchange.md",[1467],{"type":55,"value":1465},{"type":55,"value":547},{"type":49,"tag":58,"props":1470,"children":1471},{},[1472,1474,1479],{"type":55,"value":1473},"For OBO (agent acting on behalf of a user), see ",{"type":49,"tag":1463,"props":1475,"children":1477},{"href":1476},"references\u002Fobo-blueprint-setup.md",[1478],{"type":55,"value":1476},{"type":55,"value":547},{"type":49,"tag":58,"props":1481,"children":1482},{},[1483,1485,1490],{"type":55,"value":1484},"For the containerized polyglot auth sidecar (Python, Node, Go, Java — no SDK embedding), see ",{"type":49,"tag":1463,"props":1486,"children":1488},{"href":1487},"references\u002Fsdk-sidecar.md",[1489],{"type":55,"value":1487},{"type":55,"value":547},{"type":49,"tag":58,"props":1492,"children":1493},{},[1494,1496,1501],{"type":55,"value":1495},"For MI+WIF and client-secret setup details, see ",{"type":49,"tag":1463,"props":1497,"children":1499},{"href":1498},"references\u002Foauth2-token-flow.md",[1500],{"type":55,"value":1498},{"type":55,"value":547},{"type":49,"tag":518,"props":1503,"children":1505},{"id":1504},"net-quick-path",[1506],{"type":55,"value":1507},".NET quick path",{"type":49,"tag":58,"props":1509,"children":1510},{},[1511,1513,1521,1523,1529,1531,1537],{"type":55,"value":1512},"For .NET services, use ",{"type":49,"tag":453,"props":1514,"children":1515},{},[1516],{"type":49,"tag":124,"props":1517,"children":1519},{"className":1518},[],[1520],{"type":55,"value":195},{"type":55,"value":1522}," — it handles Federated Identity Credential management and the two-step exchange for you. See the package README at ",{"type":49,"tag":124,"props":1524,"children":1526},{"className":1525},[],[1527],{"type":55,"value":1528},"github.com\u002FAzureAD\u002Fmicrosoft-identity-web",{"type":55,"value":1530}," under ",{"type":49,"tag":124,"props":1532,"children":1534},{"className":1533},[],[1535],{"type":55,"value":1536},"src\u002FMicrosoft.Identity.Web.AgentIdentities\u002F",{"type":55,"value":547},{"type":49,"tag":64,"props":1539,"children":1541},{"id":1540},"granting-permissions-per-agent-identity",[1542],{"type":55,"value":1543},"Granting Permissions (Per Agent Identity)",{"type":49,"tag":58,"props":1545,"children":1546},{},[1547,1549,1554],{"type":55,"value":1548},"Agent Identities support both application permissions (autonomous) and delegated permissions (OBO). Grants are scoped ",{"type":49,"tag":453,"props":1550,"children":1551},{},[1552],{"type":55,"value":1553},"per Agent Identity",{"type":55,"value":1555},", not to the BlueprintPrincipal.",{"type":49,"tag":518,"props":1557,"children":1559},{"id":1558},"application-permissions-autonomous",[1560],{"type":55,"value":1561},"Application permissions (autonomous)",{"type":49,"tag":413,"props":1563,"children":1565},{"className":754,"code":1564,"language":756,"meta":421,"style":421},"graph_sp = requests.get(\n    f\"{GRAPH}\u002FservicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'\",\n    headers=headers,\n).json()[\"value\"][0]\n\nuser_read_all = next(r for r in graph_sp[\"appRoles\"] if r[\"value\"] == \"User.Read.All\")\n\nrequests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002F{agent_sp_id}\u002FappRoleAssignments\",\n    headers=headers,\n    json={\n        \"principalId\": agent_sp_id,\n        \"resourceId\": graph_sp[\"id\"],\n        \"appRoleId\": user_read_all[\"id\"],\n    },\n).raise_for_status()\n",[1566],{"type":49,"tag":124,"props":1567,"children":1568},{"__ignoreMap":421},[1569,1577,1585,1593,1601,1608,1616,1623,1631,1639,1646,1654,1662,1670,1678,1686],{"type":49,"tag":564,"props":1570,"children":1571},{"class":566,"line":567},[1572],{"type":49,"tag":564,"props":1573,"children":1574},{},[1575],{"type":55,"value":1576},"graph_sp = requests.get(\n",{"type":49,"tag":564,"props":1578,"children":1579},{"class":566,"line":576},[1580],{"type":49,"tag":564,"props":1581,"children":1582},{},[1583],{"type":55,"value":1584},"    f\"{GRAPH}\u002FservicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'\",\n",{"type":49,"tag":564,"props":1586,"children":1587},{"class":566,"line":703},[1588],{"type":49,"tag":564,"props":1589,"children":1590},{},[1591],{"type":55,"value":1592},"    headers=headers,\n",{"type":49,"tag":564,"props":1594,"children":1595},{"class":566,"line":712},[1596],{"type":49,"tag":564,"props":1597,"children":1598},{},[1599],{"type":55,"value":1600},").json()[\"value\"][0]\n",{"type":49,"tag":564,"props":1602,"children":1603},{"class":566,"line":721},[1604],{"type":49,"tag":564,"props":1605,"children":1606},{"emptyLinePlaceholder":782},[1607],{"type":55,"value":785},{"type":49,"tag":564,"props":1609,"children":1610},{"class":566,"line":730},[1611],{"type":49,"tag":564,"props":1612,"children":1613},{},[1614],{"type":55,"value":1615},"user_read_all = next(r for r in graph_sp[\"appRoles\"] if r[\"value\"] == \"User.Read.All\")\n",{"type":49,"tag":564,"props":1617,"children":1618},{"class":566,"line":739},[1619],{"type":49,"tag":564,"props":1620,"children":1621},{"emptyLinePlaceholder":782},[1622],{"type":55,"value":785},{"type":49,"tag":564,"props":1624,"children":1625},{"class":566,"line":820},[1626],{"type":49,"tag":564,"props":1627,"children":1628},{},[1629],{"type":55,"value":1630},"requests.post(\n",{"type":49,"tag":564,"props":1632,"children":1633},{"class":566,"line":828},[1634],{"type":49,"tag":564,"props":1635,"children":1636},{},[1637],{"type":55,"value":1638},"    f\"{GRAPH}\u002FservicePrincipals\u002F{agent_sp_id}\u002FappRoleAssignments\",\n",{"type":49,"tag":564,"props":1640,"children":1641},{"class":566,"line":837},[1642],{"type":49,"tag":564,"props":1643,"children":1644},{},[1645],{"type":55,"value":1592},{"type":49,"tag":564,"props":1647,"children":1648},{"class":566,"line":845},[1649],{"type":49,"tag":564,"props":1650,"children":1651},{},[1652],{"type":55,"value":1653},"    json={\n",{"type":49,"tag":564,"props":1655,"children":1656},{"class":566,"line":854},[1657],{"type":49,"tag":564,"props":1658,"children":1659},{},[1660],{"type":55,"value":1661},"        \"principalId\": agent_sp_id,\n",{"type":49,"tag":564,"props":1663,"children":1664},{"class":566,"line":863},[1665],{"type":49,"tag":564,"props":1666,"children":1667},{},[1668],{"type":55,"value":1669},"        \"resourceId\": graph_sp[\"id\"],\n",{"type":49,"tag":564,"props":1671,"children":1672},{"class":566,"line":872},[1673],{"type":49,"tag":564,"props":1674,"children":1675},{},[1676],{"type":55,"value":1677},"        \"appRoleId\": user_read_all[\"id\"],\n",{"type":49,"tag":564,"props":1679,"children":1680},{"class":566,"line":881},[1681],{"type":49,"tag":564,"props":1682,"children":1683},{},[1684],{"type":55,"value":1685},"    },\n",{"type":49,"tag":564,"props":1687,"children":1688},{"class":566,"line":890},[1689],{"type":49,"tag":564,"props":1690,"children":1691},{},[1692],{"type":55,"value":1693},").raise_for_status()\n",{"type":49,"tag":518,"props":1695,"children":1697},{"id":1696},"delegated-permissions-obo",[1698],{"type":55,"value":1699},"Delegated permissions (OBO)",{"type":49,"tag":413,"props":1701,"children":1703},{"className":754,"code":1702,"language":756,"meta":421,"style":421},"from datetime import datetime, timedelta, timezone\n\nexpiry = (datetime.now(timezone.utc) + timedelta(days=3650)).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n\nrequests.post(\n    f\"{GRAPH}\u002Foauth2PermissionGrants\",\n    headers=headers,\n    json={\n        \"clientId\": agent_sp_id,\n        \"consentType\": \"AllPrincipals\",\n        \"resourceId\": graph_sp[\"id\"],\n        \"scope\": \"User.Read Tasks.ReadWrite Mail.Send\",\n        \"expiryTime\": expiry,\n    },\n).raise_for_status()\n",[1704],{"type":49,"tag":124,"props":1705,"children":1706},{"__ignoreMap":421},[1707,1715,1722,1730,1737,1744,1752,1759,1766,1774,1782,1789,1797,1805,1812],{"type":49,"tag":564,"props":1708,"children":1709},{"class":566,"line":567},[1710],{"type":49,"tag":564,"props":1711,"children":1712},{},[1713],{"type":55,"value":1714},"from datetime import datetime, timedelta, timezone\n",{"type":49,"tag":564,"props":1716,"children":1717},{"class":566,"line":576},[1718],{"type":49,"tag":564,"props":1719,"children":1720},{"emptyLinePlaceholder":782},[1721],{"type":55,"value":785},{"type":49,"tag":564,"props":1723,"children":1724},{"class":566,"line":703},[1725],{"type":49,"tag":564,"props":1726,"children":1727},{},[1728],{"type":55,"value":1729},"expiry = (datetime.now(timezone.utc) + timedelta(days=3650)).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n",{"type":49,"tag":564,"props":1731,"children":1732},{"class":566,"line":712},[1733],{"type":49,"tag":564,"props":1734,"children":1735},{"emptyLinePlaceholder":782},[1736],{"type":55,"value":785},{"type":49,"tag":564,"props":1738,"children":1739},{"class":566,"line":721},[1740],{"type":49,"tag":564,"props":1741,"children":1742},{},[1743],{"type":55,"value":1630},{"type":49,"tag":564,"props":1745,"children":1746},{"class":566,"line":730},[1747],{"type":49,"tag":564,"props":1748,"children":1749},{},[1750],{"type":55,"value":1751},"    f\"{GRAPH}\u002Foauth2PermissionGrants\",\n",{"type":49,"tag":564,"props":1753,"children":1754},{"class":566,"line":739},[1755],{"type":49,"tag":564,"props":1756,"children":1757},{},[1758],{"type":55,"value":1592},{"type":49,"tag":564,"props":1760,"children":1761},{"class":566,"line":820},[1762],{"type":49,"tag":564,"props":1763,"children":1764},{},[1765],{"type":55,"value":1653},{"type":49,"tag":564,"props":1767,"children":1768},{"class":566,"line":828},[1769],{"type":49,"tag":564,"props":1770,"children":1771},{},[1772],{"type":55,"value":1773},"        \"clientId\": agent_sp_id,\n",{"type":49,"tag":564,"props":1775,"children":1776},{"class":566,"line":837},[1777],{"type":49,"tag":564,"props":1778,"children":1779},{},[1780],{"type":55,"value":1781},"        \"consentType\": \"AllPrincipals\",\n",{"type":49,"tag":564,"props":1783,"children":1784},{"class":566,"line":845},[1785],{"type":49,"tag":564,"props":1786,"children":1787},{},[1788],{"type":55,"value":1669},{"type":49,"tag":564,"props":1790,"children":1791},{"class":566,"line":854},[1792],{"type":49,"tag":564,"props":1793,"children":1794},{},[1795],{"type":55,"value":1796},"        \"scope\": \"User.Read Tasks.ReadWrite Mail.Send\",\n",{"type":49,"tag":564,"props":1798,"children":1799},{"class":566,"line":863},[1800],{"type":49,"tag":564,"props":1801,"children":1802},{},[1803],{"type":55,"value":1804},"        \"expiryTime\": expiry,\n",{"type":49,"tag":564,"props":1806,"children":1807},{"class":566,"line":872},[1808],{"type":49,"tag":564,"props":1809,"children":1810},{},[1811],{"type":55,"value":1685},{"type":49,"tag":564,"props":1813,"children":1814},{"class":566,"line":881},[1815],{"type":49,"tag":564,"props":1816,"children":1817},{},[1818],{"type":55,"value":1693},{"type":49,"tag":58,"props":1820,"children":1821},{},[1822,1824,1829],{"type":55,"value":1823},"Browser-based admin consent URLs do not work for Agent Identities — use ",{"type":49,"tag":124,"props":1825,"children":1827},{"className":1826},[],[1828],{"type":55,"value":275},{"type":55,"value":1830}," for programmatic delegated consent.",{"type":49,"tag":64,"props":1832,"children":1834},{"id":1833},"cross-tenant-agent-identities",[1835],{"type":55,"value":1836},"Cross-Tenant Agent Identities",{"type":49,"tag":58,"props":1838,"children":1839},{},[1840,1842,1848],{"type":55,"value":1841},"Blueprints can be multi-tenant (",{"type":49,"tag":124,"props":1843,"children":1845},{"className":1844},[],[1846],{"type":55,"value":1847},"signInAudience: AzureADMultipleOrgs",{"type":55,"value":1849},"). When exchanging tokens cross-tenant:",{"type":49,"tag":630,"props":1851,"children":1852},{},[1853],{"type":49,"tag":58,"props":1854,"children":1855},{},[1856,1861,1863,1869],{"type":49,"tag":453,"props":1857,"children":1858},{},[1859],{"type":55,"value":1860},"Step 1 of the parent token exchange MUST target the Agent Identity's home tenant",{"type":55,"value":1862},", not the Blueprint's. Wrong tenant → ",{"type":49,"tag":124,"props":1864,"children":1866},{"className":1865},[],[1867],{"type":55,"value":1868},"AADSTS700211: No matching federated identity record found",{"type":55,"value":547},{"type":49,"tag":58,"props":1871,"children":1872},{},[1873,1875,1879],{"type":55,"value":1874},"See ",{"type":49,"tag":1463,"props":1876,"children":1877},{"href":1465},[1878],{"type":55,"value":1465},{"type":55,"value":1880}," for full cross-tenant examples.",{"type":49,"tag":64,"props":1882,"children":1884},{"id":1883},"api-reference",[1885],{"type":55,"value":1886},"API Reference",{"type":49,"tag":71,"props":1888,"children":1889},{},[1890,1911],{"type":49,"tag":75,"props":1891,"children":1892},{},[1893],{"type":49,"tag":79,"props":1894,"children":1895},{},[1896,1901,1906],{"type":49,"tag":83,"props":1897,"children":1898},{},[1899],{"type":55,"value":1900},"Operation",{"type":49,"tag":83,"props":1902,"children":1903},{},[1904],{"type":55,"value":1905},"Method",{"type":49,"tag":83,"props":1907,"children":1908},{},[1909],{"type":55,"value":1910},"Endpoint",{"type":49,"tag":94,"props":1912,"children":1913},{},[1914,1940,1965,1990,2015,2040,2065,2090,2116],{"type":49,"tag":79,"props":1915,"children":1916},{},[1917,1922,1931],{"type":49,"tag":101,"props":1918,"children":1919},{},[1920],{"type":55,"value":1921},"Create Blueprint",{"type":49,"tag":101,"props":1923,"children":1924},{},[1925],{"type":49,"tag":124,"props":1926,"children":1928},{"className":1927},[],[1929],{"type":55,"value":1930},"POST",{"type":49,"tag":101,"props":1932,"children":1933},{},[1934],{"type":49,"tag":124,"props":1935,"children":1937},{"className":1936},[],[1938],{"type":55,"value":1939},"\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint",{"type":49,"tag":79,"props":1941,"children":1942},{},[1943,1948,1956],{"type":49,"tag":101,"props":1944,"children":1945},{},[1946],{"type":55,"value":1947},"Create BlueprintPrincipal",{"type":49,"tag":101,"props":1949,"children":1950},{},[1951],{"type":49,"tag":124,"props":1952,"children":1954},{"className":1953},[],[1955],{"type":55,"value":1930},{"type":49,"tag":101,"props":1957,"children":1958},{},[1959],{"type":49,"tag":124,"props":1960,"children":1962},{"className":1961},[],[1963],{"type":55,"value":1964},"\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal",{"type":49,"tag":79,"props":1966,"children":1967},{},[1968,1973,1981],{"type":49,"tag":101,"props":1969,"children":1970},{},[1971],{"type":55,"value":1972},"Create Agent Identity",{"type":49,"tag":101,"props":1974,"children":1975},{},[1976],{"type":49,"tag":124,"props":1977,"children":1979},{"className":1978},[],[1980],{"type":55,"value":1930},{"type":49,"tag":101,"props":1982,"children":1983},{},[1984],{"type":49,"tag":124,"props":1985,"children":1987},{"className":1986},[],[1988],{"type":55,"value":1989},"\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity",{"type":49,"tag":79,"props":1991,"children":1992},{},[1993,1998,2006],{"type":49,"tag":101,"props":1994,"children":1995},{},[1996],{"type":55,"value":1997},"Add FIC to Blueprint",{"type":49,"tag":101,"props":1999,"children":2000},{},[2001],{"type":49,"tag":124,"props":2002,"children":2004},{"className":2003},[],[2005],{"type":55,"value":1930},{"type":49,"tag":101,"props":2007,"children":2008},{},[2009],{"type":49,"tag":124,"props":2010,"children":2012},{"className":2011},[],[2013],{"type":55,"value":2014},"\u002Fapplications\u002F{id}\u002Fmicrosoft.graph.agentIdentityBlueprint\u002FfederatedIdentityCredentials",{"type":49,"tag":79,"props":2016,"children":2017},{},[2018,2023,2032],{"type":49,"tag":101,"props":2019,"children":2020},{},[2021],{"type":55,"value":2022},"List Agent Identities",{"type":49,"tag":101,"props":2024,"children":2025},{},[2026],{"type":49,"tag":124,"props":2027,"children":2029},{"className":2028},[],[2030],{"type":55,"value":2031},"GET",{"type":49,"tag":101,"props":2033,"children":2034},{},[2035],{"type":49,"tag":124,"props":2036,"children":2038},{"className":2037},[],[2039],{"type":55,"value":1989},{"type":49,"tag":79,"props":2041,"children":2042},{},[2043,2048,2056],{"type":49,"tag":101,"props":2044,"children":2045},{},[2046],{"type":55,"value":2047},"Grant app permission",{"type":49,"tag":101,"props":2049,"children":2050},{},[2051],{"type":49,"tag":124,"props":2052,"children":2054},{"className":2053},[],[2055],{"type":55,"value":1930},{"type":49,"tag":101,"props":2057,"children":2058},{},[2059],{"type":49,"tag":124,"props":2060,"children":2062},{"className":2061},[],[2063],{"type":55,"value":2064},"\u002FservicePrincipals\u002F{id}\u002FappRoleAssignments",{"type":49,"tag":79,"props":2066,"children":2067},{},[2068,2073,2081],{"type":49,"tag":101,"props":2069,"children":2070},{},[2071],{"type":55,"value":2072},"Grant delegated permission",{"type":49,"tag":101,"props":2074,"children":2075},{},[2076],{"type":49,"tag":124,"props":2077,"children":2079},{"className":2078},[],[2080],{"type":55,"value":1930},{"type":49,"tag":101,"props":2082,"children":2083},{},[2084],{"type":49,"tag":124,"props":2085,"children":2087},{"className":2086},[],[2088],{"type":55,"value":2089},"\u002Foauth2PermissionGrants",{"type":49,"tag":79,"props":2091,"children":2092},{},[2093,2098,2107],{"type":49,"tag":101,"props":2094,"children":2095},{},[2096],{"type":55,"value":2097},"Delete Agent Identity",{"type":49,"tag":101,"props":2099,"children":2100},{},[2101],{"type":49,"tag":124,"props":2102,"children":2104},{"className":2103},[],[2105],{"type":55,"value":2106},"DELETE",{"type":49,"tag":101,"props":2108,"children":2109},{},[2110],{"type":49,"tag":124,"props":2111,"children":2113},{"className":2112},[],[2114],{"type":55,"value":2115},"\u002FservicePrincipals\u002F{id}",{"type":49,"tag":79,"props":2117,"children":2118},{},[2119,2124,2132],{"type":49,"tag":101,"props":2120,"children":2121},{},[2122],{"type":55,"value":2123},"Delete Blueprint",{"type":49,"tag":101,"props":2125,"children":2126},{},[2127],{"type":49,"tag":124,"props":2128,"children":2130},{"className":2129},[],[2131],{"type":55,"value":2106},{"type":49,"tag":101,"props":2133,"children":2134},{},[2135],{"type":49,"tag":124,"props":2136,"children":2138},{"className":2137},[],[2139],{"type":55,"value":2140},"\u002Fapplications\u002F{id}",{"type":49,"tag":58,"props":2142,"children":2143},{},[2144,2146,2151],{"type":55,"value":2145},"Base URL: ",{"type":49,"tag":124,"props":2147,"children":2149},{"className":2148},[],[2150],{"type":55,"value":129},{"type":55,"value":547},{"type":49,"tag":64,"props":2153,"children":2155},{"id":2154},"required-graph-permissions",[2156],{"type":55,"value":2157},"Required Graph Permissions",{"type":49,"tag":71,"props":2159,"children":2160},{},[2161,2177],{"type":49,"tag":75,"props":2162,"children":2163},{},[2164],{"type":49,"tag":79,"props":2165,"children":2166},{},[2167,2172],{"type":49,"tag":83,"props":2168,"children":2169},{},[2170],{"type":55,"value":2171},"Permission",{"type":49,"tag":83,"props":2173,"children":2174},{},[2175],{"type":55,"value":2176},"Purpose",{"type":49,"tag":94,"props":2178,"children":2179},{},[2180,2197,2214,2231,2248,2265,2282,2299],{"type":49,"tag":79,"props":2181,"children":2182},{},[2183,2192],{"type":49,"tag":101,"props":2184,"children":2185},{},[2186],{"type":49,"tag":124,"props":2187,"children":2189},{"className":2188},[],[2190],{"type":55,"value":2191},"AgentIdentityBlueprint.Create",{"type":49,"tag":101,"props":2193,"children":2194},{},[2195],{"type":55,"value":2196},"Create Blueprints",{"type":49,"tag":79,"props":2198,"children":2199},{},[2200,2209],{"type":49,"tag":101,"props":2201,"children":2202},{},[2203],{"type":49,"tag":124,"props":2204,"children":2206},{"className":2205},[],[2207],{"type":55,"value":2208},"AgentIdentityBlueprint.ReadWrite.All",{"type":49,"tag":101,"props":2210,"children":2211},{},[2212],{"type":55,"value":2213},"Read\u002Fupdate Blueprints",{"type":49,"tag":79,"props":2215,"children":2216},{},[2217,2226],{"type":49,"tag":101,"props":2218,"children":2219},{},[2220],{"type":49,"tag":124,"props":2221,"children":2223},{"className":2222},[],[2224],{"type":55,"value":2225},"AgentIdentityBlueprintPrincipal.Create",{"type":49,"tag":101,"props":2227,"children":2228},{},[2229],{"type":55,"value":2230},"Create BlueprintPrincipals",{"type":49,"tag":79,"props":2232,"children":2233},{},[2234,2243],{"type":49,"tag":101,"props":2235,"children":2236},{},[2237],{"type":49,"tag":124,"props":2238,"children":2240},{"className":2239},[],[2241],{"type":55,"value":2242},"AgentIdentity.Create.All",{"type":49,"tag":101,"props":2244,"children":2245},{},[2246],{"type":55,"value":2247},"Create Agent Identities",{"type":49,"tag":79,"props":2249,"children":2250},{},[2251,2260],{"type":49,"tag":101,"props":2252,"children":2253},{},[2254],{"type":49,"tag":124,"props":2255,"children":2257},{"className":2256},[],[2258],{"type":55,"value":2259},"AgentIdentity.ReadWrite.All",{"type":49,"tag":101,"props":2261,"children":2262},{},[2263],{"type":55,"value":2264},"Read\u002Fupdate Agent Identities",{"type":49,"tag":79,"props":2266,"children":2267},{},[2268,2277],{"type":49,"tag":101,"props":2269,"children":2270},{},[2271],{"type":49,"tag":124,"props":2272,"children":2274},{"className":2273},[],[2275],{"type":55,"value":2276},"Application.ReadWrite.All",{"type":49,"tag":101,"props":2278,"children":2279},{},[2280],{"type":55,"value":2281},"Blueprint CRUD on application objects",{"type":49,"tag":79,"props":2283,"children":2284},{},[2285,2294],{"type":49,"tag":101,"props":2286,"children":2287},{},[2288],{"type":49,"tag":124,"props":2289,"children":2291},{"className":2290},[],[2292],{"type":55,"value":2293},"AppRoleAssignment.ReadWrite.All",{"type":49,"tag":101,"props":2295,"children":2296},{},[2297],{"type":55,"value":2298},"Grant application permissions",{"type":49,"tag":79,"props":2300,"children":2301},{},[2302,2311],{"type":49,"tag":101,"props":2303,"children":2304},{},[2305],{"type":49,"tag":124,"props":2306,"children":2308},{"className":2307},[],[2309],{"type":55,"value":2310},"DelegatedPermissionGrant.ReadWrite.All",{"type":49,"tag":101,"props":2312,"children":2313},{},[2314],{"type":55,"value":2315},"Grant delegated permissions",{"type":49,"tag":58,"props":2317,"children":2318},{},[2319],{"type":55,"value":2320},"Grant admin consent (required for application permissions):",{"type":49,"tag":413,"props":2322,"children":2324},{"className":591,"code":2323,"language":593,"meta":421,"style":421},"az ad app permission admin-consent --id \u003Cclient-id>\n",[2325],{"type":49,"tag":124,"props":2326,"children":2327},{"__ignoreMap":421},[2328],{"type":49,"tag":564,"props":2329,"children":2330},{"class":566,"line":567},[2331,2336,2341,2346,2351,2356,2361,2367,2372,2378],{"type":49,"tag":564,"props":2332,"children":2333},{"style":603},[2334],{"type":55,"value":2335},"az",{"type":49,"tag":564,"props":2337,"children":2338},{"style":609},[2339],{"type":55,"value":2340}," ad",{"type":49,"tag":564,"props":2342,"children":2343},{"style":609},[2344],{"type":55,"value":2345}," app",{"type":49,"tag":564,"props":2347,"children":2348},{"style":609},[2349],{"type":55,"value":2350}," permission",{"type":49,"tag":564,"props":2352,"children":2353},{"style":609},[2354],{"type":55,"value":2355}," admin-consent",{"type":49,"tag":564,"props":2357,"children":2358},{"style":609},[2359],{"type":55,"value":2360}," --id",{"type":49,"tag":564,"props":2362,"children":2364},{"style":2363},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[2365],{"type":55,"value":2366}," \u003C",{"type":49,"tag":564,"props":2368,"children":2369},{"style":609},[2370],{"type":55,"value":2371},"client-i",{"type":49,"tag":564,"props":2373,"children":2375},{"style":2374},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[2376],{"type":55,"value":2377},"d",{"type":49,"tag":564,"props":2379,"children":2380},{"style":2363},[2381],{"type":55,"value":2382},">\n",{"type":49,"tag":58,"props":2384,"children":2385},{},[2386],{"type":55,"value":2387},"After admin consent, tokens may not include new claims for 30–120 seconds — retry with exponential backoff.",{"type":49,"tag":64,"props":2389,"children":2391},{"id":2390},"best-practices",[2392],{"type":55,"value":2393},"Best Practices",{"type":49,"tag":2395,"props":2396,"children":2397},"ol",{},[2398,2408,2440,2457,2473,2483,2501,2518,2553,2571,2581,2590,2600],{"type":49,"tag":220,"props":2399,"children":2400},{},[2401,2406],{"type":49,"tag":453,"props":2402,"children":2403},{},[2404],{"type":55,"value":2405},"Always create BlueprintPrincipal after Blueprint",{"type":55,"value":2407}," — not auto-created.",{"type":49,"tag":220,"props":2409,"children":2410},{},[2411,2416,2418,2423,2425,2431,2433,2439],{"type":49,"tag":453,"props":2412,"children":2413},{},[2414],{"type":55,"value":2415},"Use typed endpoints",{"type":55,"value":2417}," (",{"type":49,"tag":124,"props":2419,"children":2421},{"className":2420},[],[2422],{"type":55,"value":1939},{"type":55,"value":2424},") instead of raw ",{"type":49,"tag":124,"props":2426,"children":2428},{"className":2427},[],[2429],{"type":55,"value":2430},"\u002Fapplications",{"type":55,"value":2432}," with ",{"type":49,"tag":124,"props":2434,"children":2436},{"className":2435},[],[2437],{"type":55,"value":2438},"@odata.type",{"type":55,"value":547},{"type":49,"tag":220,"props":2441,"children":2442},{},[2443,2448,2450,2455],{"type":49,"tag":453,"props":2444,"children":2445},{},[2446],{"type":55,"value":2447},"Credentials live on the Blueprint",{"type":55,"value":2449}," — Agent Identities can't hold secrets\u002Fcerts (",{"type":49,"tag":124,"props":2451,"children":2453},{"className":2452},[],[2454],{"type":55,"value":304},{"type":55,"value":2456},").",{"type":49,"tag":220,"props":2458,"children":2459},{},[2460,2471],{"type":49,"tag":453,"props":2461,"children":2462},{},[2463,2465],{"type":55,"value":2464},"Include ",{"type":49,"tag":124,"props":2466,"children":2468},{"className":2467},[],[2469],{"type":55,"value":2470},"OData-Version: 4.0",{"type":55,"value":2472}," on every Graph request.",{"type":49,"tag":220,"props":2474,"children":2475},{},[2476,2481],{"type":49,"tag":453,"props":2477,"children":2478},{},[2479],{"type":55,"value":2480},"Use Workload Identity Federation for production",{"type":55,"value":2482}," — client secrets only for local dev.",{"type":49,"tag":220,"props":2484,"children":2485},{},[2486,2499],{"type":49,"tag":453,"props":2487,"children":2488},{},[2489,2491,2497],{"type":55,"value":2490},"Set ",{"type":49,"tag":124,"props":2492,"children":2494},{"className":2493},[],[2495],{"type":55,"value":2496},"identifierUris: [\"api:\u002F\u002F{appId}\"]",{"type":55,"value":2498}," on the Blueprint",{"type":55,"value":2500}," before OAuth2 scope resolution.",{"type":49,"tag":220,"props":2502,"children":2503},{},[2504,2509,2511,2516],{"type":49,"tag":453,"props":2505,"children":2506},{},[2507],{"type":55,"value":2508},"Never use Azure CLI tokens",{"type":55,"value":2510}," for Agent Identity APIs — ",{"type":49,"tag":124,"props":2512,"children":2514},{"className":2513},[],[2515],{"type":55,"value":654},{"type":55,"value":2517}," causes hard 403.",{"type":49,"tag":220,"props":2519,"children":2520},{},[2521,2531,2532,2537,2539,2545,2547,2552],{"type":49,"tag":453,"props":2522,"children":2523},{},[2524,2526],{"type":55,"value":2525},"Use ",{"type":49,"tag":124,"props":2527,"children":2529},{"className":2528},[],[2530],{"type":55,"value":176},{"type":55,"value":2432},{"type":49,"tag":124,"props":2533,"children":2535},{"className":2534},[],[2536],{"type":55,"value":662},{"type":55,"value":2538}," — NOT RFC 8693 ",{"type":49,"tag":124,"props":2540,"children":2542},{"className":2541},[],[2543],{"type":55,"value":2544},"urn:ietf:params:oauth:grant-type:token-exchange",{"type":55,"value":2546}," (returns ",{"type":49,"tag":124,"props":2548,"children":2550},{"className":2549},[],[2551],{"type":55,"value":288},{"type":55,"value":2456},{"type":49,"tag":220,"props":2554,"children":2555},{},[2556,2569],{"type":49,"tag":453,"props":2557,"children":2558},{},[2559,2561,2567],{"type":55,"value":2560},"Always use ",{"type":49,"tag":124,"props":2562,"children":2564},{"className":2563},[],[2565],{"type":55,"value":2566},"\u002F.default",{"type":55,"value":2568}," scope",{"type":55,"value":2570}," in both steps of the exchange — individual scopes fail.",{"type":49,"tag":220,"props":2572,"children":2573},{},[2574,2579],{"type":49,"tag":453,"props":2575,"children":2576},{},[2577],{"type":55,"value":2578},"Step 1 targets the Agent Identity's home tenant",{"type":55,"value":2580}," in cross-tenant flows.",{"type":49,"tag":220,"props":2582,"children":2583},{},[2584,2589],{"type":49,"tag":453,"props":2585,"children":2586},{},[2587],{"type":55,"value":2588},"Grant permissions per Agent Identity",{"type":55,"value":1555},{"type":49,"tag":220,"props":2591,"children":2592},{},[2593,2598],{"type":49,"tag":453,"props":2594,"children":2595},{},[2596],{"type":55,"value":2597},"Handle permission-propagation delays",{"type":55,"value":2599}," — retry 403s with 30–120s backoff after admin consent.",{"type":49,"tag":220,"props":2601,"children":2602},{},[2603,2608],{"type":49,"tag":453,"props":2604,"children":2605},{},[2606],{"type":55,"value":2607},"Keep the Entra SDK for AgentID on localhost",{"type":55,"value":2609}," — never expose via LoadBalancer or Ingress.",{"type":49,"tag":64,"props":2611,"children":2613},{"id":2612},"troubleshooting",[2614],{"type":55,"value":2615},"Troubleshooting",{"type":49,"tag":71,"props":2617,"children":2618},{},[2619,2640],{"type":49,"tag":75,"props":2620,"children":2621},{},[2622],{"type":49,"tag":79,"props":2623,"children":2624},{},[2625,2630,2635],{"type":49,"tag":83,"props":2626,"children":2627},{},[2628],{"type":55,"value":2629},"Error",{"type":49,"tag":83,"props":2631,"children":2632},{},[2633],{"type":55,"value":2634},"Cause",{"type":49,"tag":83,"props":2636,"children":2637},{},[2638],{"type":55,"value":2639},"Fix",{"type":49,"tag":94,"props":2641,"children":2642},{},[2643,2674,2695,2722,2755,2789,2810,2832],{"type":49,"tag":79,"props":2644,"children":2645},{},[2646,2654,2659],{"type":49,"tag":101,"props":2647,"children":2648},{},[2649],{"type":49,"tag":124,"props":2650,"children":2652},{"className":2651},[],[2653],{"type":55,"value":288},{"type":49,"tag":101,"props":2655,"children":2656},{},[2657],{"type":55,"value":2658},"Used RFC 8693 token-exchange grant",{"type":49,"tag":101,"props":2660,"children":2661},{},[2662,2663,2668,2669],{"type":55,"value":2525},{"type":49,"tag":124,"props":2664,"children":2666},{"className":2665},[],[2667],{"type":55,"value":662},{"type":55,"value":2432},{"type":49,"tag":124,"props":2670,"children":2672},{"className":2671},[],[2673],{"type":55,"value":176},{"type":49,"tag":79,"props":2675,"children":2676},{},[2677,2685,2690],{"type":49,"tag":101,"props":2678,"children":2679},{},[2680],{"type":49,"tag":124,"props":2681,"children":2683},{"className":2682},[],[2684],{"type":55,"value":296},{"type":49,"tag":101,"props":2686,"children":2687},{},[2688],{"type":55,"value":2689},"Step 1 parent token targeted wrong tenant",{"type":49,"tag":101,"props":2691,"children":2692},{},[2693],{"type":55,"value":2694},"Target Agent Identity's home tenant",{"type":49,"tag":79,"props":2696,"children":2697},{},[2698,2707,2712],{"type":49,"tag":101,"props":2699,"children":2700},{},[2701],{"type":49,"tag":124,"props":2702,"children":2704},{"className":2703},[],[2705],{"type":55,"value":2706},"AADSTS50013",{"type":49,"tag":101,"props":2708,"children":2709},{},[2710],{"type":55,"value":2711},"OBO user token targets Graph, not Blueprint",{"type":49,"tag":101,"props":2713,"children":2714},{},[2715,2716],{"type":55,"value":2525},{"type":49,"tag":124,"props":2717,"children":2719},{"className":2718},[],[2720],{"type":55,"value":2721},"api:\u002F\u002F{blueprint_app_id}\u002Faccess_as_user",{"type":49,"tag":79,"props":2723,"children":2724},{},[2725,2734,2739],{"type":49,"tag":101,"props":2726,"children":2727},{},[2728],{"type":49,"tag":124,"props":2729,"children":2731},{"className":2730},[],[2732],{"type":55,"value":2733},"AADSTS65001",{"type":49,"tag":101,"props":2735,"children":2736},{},[2737],{"type":55,"value":2738},"Missing grant or used individual scopes",{"type":49,"tag":101,"props":2740,"children":2741},{},[2742,2743,2748,2750],{"type":55,"value":2525},{"type":49,"tag":124,"props":2744,"children":2746},{"className":2745},[],[2747],{"type":55,"value":2566},{"type":55,"value":2749}," and verify ",{"type":49,"tag":124,"props":2751,"children":2753},{"className":2752},[],[2754],{"type":55,"value":275},{"type":49,"tag":79,"props":2756,"children":2757},{},[2758,2767,2772],{"type":49,"tag":101,"props":2759,"children":2760},{},[2761],{"type":49,"tag":124,"props":2762,"children":2764},{"className":2763},[],[2765],{"type":55,"value":2766},"403 Authorization_RequestDenied",{"type":49,"tag":101,"props":2768,"children":2769},{},[2770],{"type":55,"value":2771},"No grant on this Agent Identity",{"type":49,"tag":101,"props":2773,"children":2774},{},[2775,2777,2782,2784],{"type":55,"value":2776},"Add via ",{"type":49,"tag":124,"props":2778,"children":2780},{"className":2779},[],[2781],{"type":55,"value":267},{"type":55,"value":2783}," or ",{"type":49,"tag":124,"props":2785,"children":2787},{"className":2786},[],[2788],{"type":55,"value":275},{"type":49,"tag":79,"props":2790,"children":2791},{},[2792,2800,2805],{"type":49,"tag":101,"props":2793,"children":2794},{},[2795],{"type":49,"tag":124,"props":2796,"children":2798},{"className":2797},[],[2799],{"type":55,"value":304},{"type":49,"tag":101,"props":2801,"children":2802},{},[2803],{"type":55,"value":2804},"Tried to add credential to Agent Identity SP",{"type":49,"tag":101,"props":2806,"children":2807},{},[2808],{"type":55,"value":2809},"Put credentials on the Blueprint",{"type":49,"tag":79,"props":2811,"children":2812},{},[2813,2822,2827],{"type":49,"tag":101,"props":2814,"children":2815},{},[2816],{"type":49,"tag":124,"props":2817,"children":2819},{"className":2818},[],[2820],{"type":55,"value":2821},"Agent Blueprint Principal does not exist",{"type":49,"tag":101,"props":2823,"children":2824},{},[2825],{"type":55,"value":2826},"BlueprintPrincipal not created",{"type":49,"tag":101,"props":2828,"children":2829},{},[2830],{"type":55,"value":2831},"Step 2 of the Core Workflow",{"type":49,"tag":79,"props":2833,"children":2834},{},[2835,2846,2851],{"type":49,"tag":101,"props":2836,"children":2837},{},[2838,2844],{"type":49,"tag":124,"props":2839,"children":2841},{"className":2840},[],[2842],{"type":55,"value":2843},"AADSTS650051",{"type":55,"value":2845}," on admin consent",{"type":49,"tag":101,"props":2847,"children":2848},{},[2849],{"type":55,"value":2850},"SP already exists from partial consent",{"type":49,"tag":101,"props":2852,"children":2853},{},[2854,2856],{"type":55,"value":2855},"Grant directly via ",{"type":49,"tag":124,"props":2857,"children":2859},{"className":2858},[],[2860],{"type":55,"value":267},{"type":49,"tag":64,"props":2862,"children":2864},{"id":2863},"references",[2865],{"type":55,"value":2866},"References",{"type":49,"tag":71,"props":2868,"children":2869},{},[2870,2886],{"type":49,"tag":75,"props":2871,"children":2872},{},[2873],{"type":49,"tag":79,"props":2874,"children":2875},{},[2876,2881],{"type":49,"tag":83,"props":2877,"children":2878},{},[2879],{"type":55,"value":2880},"File",{"type":49,"tag":83,"props":2882,"children":2883},{},[2884],{"type":55,"value":2885},"Contents",{"type":49,"tag":94,"props":2887,"children":2888},{},[2889,2910,2925,2940,2955,2971],{"type":49,"tag":79,"props":2890,"children":2891},{},[2892,2899],{"type":49,"tag":101,"props":2893,"children":2894},{},[2895],{"type":49,"tag":1463,"props":2896,"children":2897},{"href":1465},[2898],{"type":55,"value":1465},{"type":49,"tag":101,"props":2900,"children":2901},{},[2902,2903,2908],{"type":55,"value":170},{"type":49,"tag":124,"props":2904,"children":2906},{"className":2905},[],[2907],{"type":55,"value":176},{"type":55,"value":2909}," exchange: autonomous + OBO, cross-tenant",{"type":49,"tag":79,"props":2911,"children":2912},{},[2913,2920],{"type":49,"tag":101,"props":2914,"children":2915},{},[2916],{"type":49,"tag":1463,"props":2917,"children":2918},{"href":1498},[2919],{"type":55,"value":1498},{"type":49,"tag":101,"props":2921,"children":2922},{},[2923],{"type":55,"value":2924},"MI + WIF (production) and client secret (local dev)",{"type":49,"tag":79,"props":2926,"children":2927},{},[2928,2935],{"type":49,"tag":101,"props":2929,"children":2930},{},[2931],{"type":49,"tag":1463,"props":2932,"children":2933},{"href":1476},[2934],{"type":55,"value":1476},{"type":49,"tag":101,"props":2936,"children":2937},{},[2938],{"type":55,"value":2939},"Configuring the Blueprint as an OAuth2 API for OBO",{"type":49,"tag":79,"props":2941,"children":2942},{},[2943,2950],{"type":49,"tag":101,"props":2944,"children":2945},{},[2946],{"type":49,"tag":1463,"props":2947,"children":2948},{"href":1487},[2949],{"type":55,"value":1487},{"type":49,"tag":101,"props":2951,"children":2952},{},[2953],{"type":55,"value":2954},"Microsoft Entra SDK for AgentID — architecture, configuration, endpoints",{"type":49,"tag":79,"props":2956,"children":2957},{},[2958,2966],{"type":49,"tag":101,"props":2959,"children":2960},{},[2961],{"type":49,"tag":1463,"props":2962,"children":2964},{"href":2963},"references\u002Fsdk-sidecar-deployment.md",[2965],{"type":55,"value":2963},{"type":49,"tag":101,"props":2967,"children":2968},{},[2969],{"type":55,"value":2970},"SDK code patterns (Python\u002FTypeScript), Docker\u002FKubernetes manifests, security, troubleshooting",{"type":49,"tag":79,"props":2972,"children":2973},{},[2974,2982],{"type":49,"tag":101,"props":2975,"children":2976},{},[2977],{"type":49,"tag":1463,"props":2978,"children":2980},{"href":2979},"references\u002Fknown-limitations.md",[2981],{"type":55,"value":2979},{"type":49,"tag":101,"props":2983,"children":2984},{},[2985],{"type":55,"value":2986},"Documented gaps organized by category",{"type":49,"tag":518,"props":2988,"children":2990},{"id":2989},"external-links",[2991],{"type":55,"value":2992},"External Links",{"type":49,"tag":71,"props":2994,"children":2995},{},[2996,3012],{"type":49,"tag":75,"props":2997,"children":2998},{},[2999],{"type":49,"tag":79,"props":3000,"children":3001},{},[3002,3007],{"type":49,"tag":83,"props":3003,"children":3004},{},[3005],{"type":55,"value":3006},"Resource",{"type":49,"tag":83,"props":3008,"children":3009},{},[3010],{"type":55,"value":3011},"URL",{"type":49,"tag":94,"props":3013,"children":3014},{},[3015,3033,3050,3066],{"type":49,"tag":79,"props":3016,"children":3017},{},[3018,3023],{"type":49,"tag":101,"props":3019,"children":3020},{},[3021],{"type":55,"value":3022},"Agent ID Setup Guide",{"type":49,"tag":101,"props":3024,"children":3025},{},[3026],{"type":49,"tag":1463,"props":3027,"children":3031},{"href":3028,"rel":3029},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-setup-instructions",[3030],"nofollow",[3032],{"type":55,"value":3028},{"type":49,"tag":79,"props":3034,"children":3035},{},[3036,3041],{"type":49,"tag":101,"props":3037,"children":3038},{},[3039],{"type":55,"value":3040},"AI-Guided Setup",{"type":49,"tag":101,"props":3042,"children":3043},{},[3044],{"type":49,"tag":1463,"props":3045,"children":3048},{"href":3046,"rel":3047},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-ai-guided-setup",[3030],[3049],{"type":55,"value":3046},{"type":49,"tag":79,"props":3051,"children":3052},{},[3053,3057],{"type":49,"tag":101,"props":3054,"children":3055},{},[3056],{"type":55,"value":1431},{"type":49,"tag":101,"props":3058,"children":3059},{},[3060],{"type":49,"tag":1463,"props":3061,"children":3064},{"href":3062,"rel":3063},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fmsidweb\u002Fagent-id-sdk\u002Foverview",[3030],[3065],{"type":55,"value":3062},{"type":49,"tag":79,"props":3067,"children":3068},{},[3069,3074],{"type":49,"tag":101,"props":3070,"children":3071},{},[3072],{"type":55,"value":3073},"Microsoft.Identity.Web.AgentIdentities (.NET)",{"type":49,"tag":101,"props":3075,"children":3076},{},[3077],{"type":49,"tag":1463,"props":3078,"children":3081},{"href":3079,"rel":3080},"https:\u002F\u002Fgithub.com\u002FAzureAD\u002Fmicrosoft-identity-web\u002Fblob\u002Fmaster\u002Fsrc\u002FMicrosoft.Identity.Web.AgentIdentities\u002FREADME.AgentIdentities.md",[3030],[3082],{"type":55,"value":3079},{"type":49,"tag":3084,"props":3085,"children":3086},"style",{},[3087],{"type":55,"value":3088},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3090,"total":3280},[3091,3113,3132,3153,3166,3182,3193,3206,3221,3236,3255,3268],{"slug":3092,"name":3092,"fn":3093,"description":3094,"org":3095,"tags":3096,"stars":3110,"repoUrl":3111,"updatedAt":3112},"rushstack-best-practices","manage Rush monorepos with best practices","Provides best practices and guidance for working with Rush monorepos. Use when the user is working in a Rush-based repository, asks about Rush commands (install, update, build, rebuild), needs help with project selection, dependency management, build caching, subspace configuration, or troubleshooting Rush-specific issues.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3097,3100,3103,3104,3107],{"name":3098,"slug":3099,"type":15},"Engineering","engineering",{"name":3101,"slug":3102,"type":15},"Local Development","local-development",{"name":9,"slug":8,"type":15},{"name":3105,"slug":3106,"type":15},"Project Management","project-management",{"name":3108,"slug":3109,"type":15},"Rush","rush",6484,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Frushstack","2026-04-06T18:34:44.965032",{"slug":3114,"name":3114,"fn":3115,"description":3116,"org":3117,"tags":3118,"stars":3129,"repoUrl":3130,"updatedAt":3131},"azure-ai-agents-persistent-dotnet","build AI agents with Azure .NET SDK","Azure AI Agents Persistent SDK for .NET. Low-level SDK for creating and managing AI agents with threads, messages, runs, and tools. Use for agent CRUD, conversation threads, streaming responses, function calling, file search, and code interpreter. Triggers: \"PersistentAgentsClient\", \"persistent agents\", \"agent threads\", \"agent runs\", \"streaming agents\", \"function calling agents .NET\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3119,3122,3125,3126],{"name":3120,"slug":3121,"type":15},".NET","net",{"name":3123,"slug":3124,"type":15},"Agents","agents",{"name":17,"slug":18,"type":15},{"name":3127,"slug":3128,"type":15},"LLM","llm",2804,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills","2026-07-03T16:32:10.297433",{"slug":3133,"name":3133,"fn":3134,"description":3135,"org":3136,"tags":3137,"stars":3129,"repoUrl":3130,"updatedAt":3152},"azure-ai-anomalydetector-java","build anomaly detection applications with Java","Build anomaly detection applications with Azure AI Anomaly Detector SDK for Java. Use when implementing univariate\u002Fmultivariate anomaly detection, time-series analysis, or AI-powered monitoring.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3138,3141,3142,3145,3148,3149],{"name":3139,"slug":3140,"type":15},"Analytics","analytics",{"name":17,"slug":18,"type":15},{"name":3143,"slug":3144,"type":15},"Data Analysis","data-analysis",{"name":3146,"slug":3147,"type":15},"Java","java",{"name":9,"slug":8,"type":15},{"name":3150,"slug":3151,"type":15},"Monitoring","monitoring","2026-05-13T06:14:16.261754",{"slug":3154,"name":3154,"fn":3155,"description":3156,"org":3157,"tags":3158,"stars":3129,"repoUrl":3130,"updatedAt":3165},"azure-ai-contentsafety-java","build content moderation applications with Azure AI","Build content moderation applications with Azure AI Content Safety SDK for Java. Use when implementing text\u002Fimage analysis, blocklist management, or harm detection for hate, violence, sexual content, and self-harm.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3159,3162,3163,3164],{"name":3160,"slug":3161,"type":15},"AI Infrastructure","ai-infrastructure",{"name":17,"slug":18,"type":15},{"name":3146,"slug":3147,"type":15},{"name":13,"slug":14,"type":15},"2026-07-07T06:53:31.293235",{"slug":3167,"name":3167,"fn":3168,"description":3169,"org":3170,"tags":3171,"stars":3129,"repoUrl":3130,"updatedAt":3181},"azure-ai-contentsafety-py","detect harmful content with Azure AI Content Safety","Azure AI Content Safety SDK for Python. Use for detecting harmful content in text and images with multi-severity classification.\nTriggers: \"azure-ai-contentsafety\", \"ContentSafetyClient\", \"content moderation\", \"harmful content\", \"text analysis\", \"image analysis\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3172,3173,3176,3177,3178,3180],{"name":17,"slug":18,"type":15},{"name":3174,"slug":3175,"type":15},"Compliance","compliance",{"name":3127,"slug":3128,"type":15},{"name":9,"slug":8,"type":15},{"name":3179,"slug":756,"type":15},"Python",{"name":13,"slug":14,"type":15},"2026-07-18T05:14:23.017504",{"slug":3183,"name":3183,"fn":3184,"description":3185,"org":3186,"tags":3187,"stars":3129,"repoUrl":3130,"updatedAt":3192},"azure-ai-language-conversations-py","implement conversational language understanding with Python","Implement Conversational Language Understanding (CLU) using the azure-ai-language-conversations Python SDK. Use when working with ConversationAnalysisClient to analyze conversation intent and entities, building NLP features, or integrating language understanding into applications.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3188,3189,3190,3191],{"name":3139,"slug":3140,"type":15},{"name":17,"slug":18,"type":15},{"name":3127,"slug":3128,"type":15},{"name":3179,"slug":756,"type":15},"2026-07-31T05:54:29.068751",{"slug":3194,"name":3194,"fn":3195,"description":3196,"org":3197,"tags":3198,"stars":3129,"repoUrl":3130,"updatedAt":3205},"azure-ai-translation-text-py","translate text using Azure AI services","Azure AI Text Translation SDK for real-time text translation, transliteration, language detection, and dictionary lookup. Use for translating text content in applications.\nTriggers: \"text translation\", \"translator\", \"translate text\", \"transliterate\", \"TextTranslationClient\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3199,3202,3203,3204],{"name":3200,"slug":3201,"type":15},"API Development","api-development",{"name":17,"slug":18,"type":15},{"name":9,"slug":8,"type":15},{"name":3179,"slug":756,"type":15},"2026-07-18T05:14:16.988376",{"slug":3207,"name":3207,"fn":3208,"description":3209,"org":3210,"tags":3211,"stars":3129,"repoUrl":3130,"updatedAt":3220},"azure-ai-vision-imageanalysis-py","analyze images with Azure AI Vision","Azure AI Vision Image Analysis SDK for captions, tags, objects, OCR, people detection, and smart cropping. Use for computer vision and image understanding tasks.\nTriggers: \"image analysis\", \"computer vision\", \"OCR\", \"object detection\", \"ImageAnalysisClient\", \"image caption\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3212,3213,3216,3219],{"name":17,"slug":18,"type":15},{"name":3214,"slug":3215,"type":15},"Computer Vision","computer-vision",{"name":3217,"slug":3218,"type":15},"Images","images",{"name":3179,"slug":756,"type":15},"2026-07-18T05:14:18.007737",{"slug":3222,"name":3222,"fn":3223,"description":3224,"org":3225,"tags":3226,"stars":3129,"repoUrl":3130,"updatedAt":3235},"azure-appconfiguration-java","manage configuration with Azure App Configuration","Azure App Configuration SDK for Java. Centralized application configuration management with key-value settings, feature flags, and snapshots.\nTriggers: \"ConfigurationClient java\", \"app configuration java\", \"feature flag java\", \"configuration setting java\", \"azure config java\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3227,3228,3231,3234],{"name":17,"slug":18,"type":15},{"name":3229,"slug":3230,"type":15},"Configuration","configuration",{"name":3232,"slug":3233,"type":15},"Feature Flags","feature-flags",{"name":3146,"slug":3147,"type":15},"2026-07-03T16:32:01.278468",{"slug":3237,"name":3237,"fn":3238,"description":3239,"org":3240,"tags":3241,"stars":3129,"repoUrl":3130,"updatedAt":3254},"azure-cosmos-rust","build applications with Azure Cosmos DB","Azure Cosmos DB library for Rust (NoSQL API). Document CRUD, containers, and globally distributed data.\nTriggers: \"cosmos db rust\", \"CosmosClient rust\", \"document crud rust\", \"NoSQL rust\", \"partition key rust\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3242,3245,3248,3251],{"name":3243,"slug":3244,"type":15},"Cosmos DB","cosmos-db",{"name":3246,"slug":3247,"type":15},"Database","database",{"name":3249,"slug":3250,"type":15},"NoSQL","nosql",{"name":3252,"slug":3253,"type":15},"Rust","rust","2026-07-31T05:54:27.021432",{"slug":3256,"name":3256,"fn":3238,"description":3257,"org":3258,"tags":3259,"stars":3129,"repoUrl":3130,"updatedAt":3267},"azure-cosmos-ts","Azure Cosmos DB JavaScript\u002FTypeScript SDK (@azure\u002Fcosmos) for data plane operations. Use for CRUD operations on documents, queries, bulk operations, and container management. Triggers: \"Cosmos DB\", \"@azure\u002Fcosmos\", \"CosmosClient\", \"document CRUD\", \"NoSQL queries\", \"bulk operations\", \"partition key\", \"container.items\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3260,3261,3262,3263,3264],{"name":3243,"slug":3244,"type":15},{"name":3246,"slug":3247,"type":15},{"name":9,"slug":8,"type":15},{"name":3249,"slug":3250,"type":15},{"name":3265,"slug":3266,"type":15},"TypeScript","typescript","2026-07-03T16:31:19.368382",{"slug":3269,"name":3269,"fn":3270,"description":3271,"org":3272,"tags":3273,"stars":3129,"repoUrl":3130,"updatedAt":3279},"azure-data-tables-java","build table storage applications with Java","Build table storage applications with Azure Tables SDK for Java. Use when working with Azure Table Storage or Cosmos DB Table API for NoSQL key-value data, schemaless storage, or structured data at scale.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3274,3275,3276,3277,3278],{"name":17,"slug":18,"type":15},{"name":3243,"slug":3244,"type":15},{"name":3246,"slug":3247,"type":15},{"name":3146,"slug":3147,"type":15},{"name":3249,"slug":3250,"type":15},"2026-05-13T06:14:17.582229",267,{"items":3282,"total":3400},[3283,3301,3313,3332,3349,3366,3382],{"slug":3284,"name":3284,"fn":3285,"description":3286,"org":3287,"tags":3288,"stars":29,"repoUrl":30,"updatedAt":3300},"airunway-aks-setup","set up AI Runway on Azure Kubernetes Service","Set up AI Runway on AKS — from bare cluster to running model. Covers cluster verification, controller install, GPU assessment, provider setup, and first deployment. WHEN: \"setup AI Runway\", \"onboard AKS cluster\", \"install AI Runway\", \"airunway setup\", \"deploy model to AKS\", \"GPU inference on AKS\", \"KAITO setup on AKS\", \"run LLM on AKS\", \"vLLM on AKS\", \"set up model serving on AKS\", \"AI Runway controller\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3289,3290,3291,3294,3297],{"name":3160,"slug":3161,"type":15},{"name":17,"slug":18,"type":15},{"name":3292,"slug":3293,"type":15},"Deployment","deployment",{"name":3295,"slug":3296,"type":15},"Kubernetes","kubernetes",{"name":3298,"slug":3299,"type":15},"Runway","runway","2026-07-31T05:56:13.054971",{"slug":3302,"name":3302,"fn":3303,"description":3304,"org":3305,"tags":3306,"stars":29,"repoUrl":30,"updatedAt":3312},"appinsights-instrumentation","instrument webapps with Azure Application Insights","Guidance for instrumenting webapps with Azure Application Insights. Provides telemetry patterns, SDK setup, and configuration references. WHEN: how to instrument app, App Insights SDK, telemetry patterns, what is App Insights, Application Insights guidance, instrumentation examples, APM best practices.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3307,3308,3309],{"name":17,"slug":18,"type":15},{"name":3150,"slug":3151,"type":15},{"name":3310,"slug":3311,"type":15},"Observability","observability","2026-07-31T05:56:09.068625",{"slug":3314,"name":3314,"fn":3315,"description":3316,"org":3317,"tags":3318,"stars":29,"repoUrl":30,"updatedAt":3331},"azure-ai","build applications with Azure AI services","Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector\u002Fhybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3319,3320,3321,3322,3325,3328],{"name":3160,"slug":3161,"type":15},{"name":17,"slug":18,"type":15},{"name":3127,"slug":3128,"type":15},{"name":3323,"slug":3324,"type":15},"OpenAI","openai",{"name":3326,"slug":3327,"type":15},"Search","search",{"name":3329,"slug":3330,"type":15},"Speech","speech","2026-07-31T05:56:19.069133",{"slug":3333,"name":3333,"fn":3334,"description":3335,"org":3336,"tags":3337,"stars":29,"repoUrl":30,"updatedAt":3348},"azure-aigateway","configure Azure API Management as an AI Gateway","Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbreak detection, add Azure OpenAI backend, add AI Foundry model, test AI gateway, LLM policies, configure AI backend, token metrics, AI cost control, convert API to MCP, import OpenAPI to gateway.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3338,3339,3340,3341,3344,3347],{"name":3160,"slug":3161,"type":15},{"name":3200,"slug":3201,"type":15},{"name":17,"slug":18,"type":15},{"name":3342,"slug":3343,"type":15},"Caching","caching",{"name":3345,"slug":3346,"type":15},"Governance","governance",{"name":13,"slug":14,"type":15},"2026-07-31T05:56:23.05242",{"slug":3350,"name":3350,"fn":3351,"description":3352,"org":3353,"tags":3354,"stars":29,"repoUrl":30,"updatedAt":3365},"azure-cloud-migrate","migrate cross-cloud workloads to Azure","Assess and migrate cross-cloud workloads to Azure with reports and code conversion. Supports Lambda→Functions, Beanstalk\u002FHeroku\u002FApp Engine→App Service, Fargate\u002FKubernetes\u002FCloud Run\u002FSpring Boot→Container Apps. WHEN: migrate Lambda to Functions, AWS to Azure, migrate Beanstalk, migrate Heroku, migrate App Engine, Cloud Run migration, Fargate to ACA, ECS\u002FKubernetes\u002FGKE\u002FEKS to Container Apps, Spring Boot to Container Apps, cross-cloud migration.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3355,3358,3359,3362],{"name":3356,"slug":3357,"type":15},"AWS","aws",{"name":17,"slug":18,"type":15},{"name":3360,"slug":3361,"type":15},"Google Cloud","google-cloud",{"name":3363,"slug":3364,"type":15},"Migration","migration","2026-07-31T05:56:29.049979",{"slug":3367,"name":3367,"fn":3368,"description":3369,"org":3370,"tags":3371,"stars":29,"repoUrl":30,"updatedAt":3381},"azure-compliance","audit Azure compliance and security","Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy\u002Fcompliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3372,3375,3376,3377,3380],{"name":3373,"slug":3374,"type":15},"Audit","audit",{"name":17,"slug":18,"type":15},{"name":3174,"slug":3175,"type":15},{"name":3378,"slug":3379,"type":15},"Regulatory Compliance","regulatory-compliance",{"name":13,"slug":14,"type":15},"2026-07-31T05:56:11.06797",{"slug":3383,"name":3383,"fn":3384,"description":3385,"org":3386,"tags":3387,"stars":29,"repoUrl":30,"updatedAt":3399},"azure-compute","manage and optimize Azure compute resources","Azure VM\u002FVMSS router. WHEN: create \u002F provision \u002F deploy \u002F spin-up VM, recommend VM size, compare VM pricing, VMSS, scale set, autoscale, burstable, lightweight server, website, backend, GPU, machine learning, HPC simulation, dev\u002Ftest, workload, family, load balancer, Flexible orchestration, Uniform orchestration, cost estimate, capacity reservation (CRG), reserve, guarantee capacity, pre-provision, CRG association, CRG disassociation, machine enrollment (EMM), Essential Machine Management, monitor. PREFER OVER mcp__azure__get_azure_bestpractices for VM create intents — use compute_vm_list-skus \u002F compute_vm_list-images \u002F compute_vm_check-quota.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3388,3389,3390,3393,3396],{"name":3160,"slug":3161,"type":15},{"name":17,"slug":18,"type":15},{"name":3391,"slug":3392,"type":15},"Cost Optimization","cost-optimization",{"name":3394,"slug":3395,"type":15},"Performance","performance",{"name":3397,"slug":3398,"type":15},"Virtual Machines","virtual-machines","2026-07-31T05:56:16.042469",28]