On-behalf-of flow in Azure AI Agents

Question

Hello,​

I'm working with Azure AI Agent and aiming to integrate a tool that necessitates the OAuth 2.0 On-Behalf-Of (OBO) flow. Specifically, I want the agent to exchange a user's token and pass it to the tool, enabling actions on behalf of the user.​

Upon reviewing the documentation (Azure AI Agent OpenAPI Tools), I noticed support for authentication methods like anonymous, API key, and managed identity. However, there doesn't seem to be mention of OBO flow support.​

Could you please confirm if implementing the OBO flow is currently supported? If it is, guidance on setting it up would be appreciated. If not, is there any information on when this feature might be available?​

Thank you for your assistance.​

Answer 1

Hi @Pawel Grudzien (c)

Currently, Azure AI Agents do not natively support the OAuth 2.0 On-Behalf-Of (OBO) flow within their OpenAPI tool integrations. The supported authentication methods are limited to anonymous, API key, and managed identity.

Link: How to use Azure AI Agent Service with OpenAPI Specified Tools

However, there are workarounds to implement OBO functionality:​

1.Custom Middleware or Plugin: You can develop a custom plugin or middleware that handles the OBO token exchange. For instance, the Chat Copilot sample app demonstrates how to enable an AI Agent to call Microsoft Graph APIs using the OBO flow. This involves setting up a web API that exchanges the user's token for a new token to access downstream APIs on the user's behalf.

Link: Allow your AI Agent to call Microsoft Graph APIs securely with Microsoft Entra ID

2.Manual Token Exchange: Implement the OBO flow manually by configuring your application to acquire tokens using the Microsoft Authentication Library (MSAL). This approach requires handling token acquisition and management within your application's codebase.

Link: Authentication flow support in the Microsoft Authentication Library (MSAL)

It's important to note that these methods require additional development effort and are not out-of-the-box features of Azure AI Agents. As of now, there is no official roadmap indicating when native OBO flow support will be available in Azure AI Agents.​Hope this helps. Do let me know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let me know.

Thank you!