Share via

ways ai agent for end user access

James Brown 0 Reputation points
2026-02-04T09:24:55.6633333+00:00

Is ai foundry project the only way for end user to access agent

Azure AI services
Azure AI services

A group of Azure services, SDKs, and APIs designed to make apps more intelligent, engaging, and discoverable.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Manas Mohanty 14,915 Reputation points Microsoft External Staff Moderator
    2026-02-10T10:17:05.2466667+00:00

    Hi James Brown

    We provide "Azure AI user role" for user who are just sending inference requests.

    Once end users are assigned above role, they can normally interact with default credentials as suggested here.

    Regarding on behalf of Credentials, could you check below documentation.

    https://devblogs.microsoft.com/identity/ai-agent-graph-api/?utm_source=chatgpt.com

    https://learn.microsoft.com/en-us/entra/agent-id/identity-platform/agent-on-behalf-of-oauth-flow#protocol-steps

    Summary of steps

    1. User signs in → Foundry app gets Tc.
    2. App sends Tc to Agent Identity Blueprint.
    3. Blueprint obtains T1 using managed identity.
    4. Agent Identity exchanges Tc + T1 for final resource token.
    5. Optional: use refresh tokens for async tasks.
    6. Permissions can inherit from the parent blueprint.

    Diagram showing the token sequence of on-behalf-of token acquisition flow for agents.

    Other relevant thread -

    https://learn.microsoft.com/en-us/answers/questions/2247895/on-behalf-of-flow-in-azure-ai-agents

    https://github.com/Azure-Samples/ms-identity-python-on-behalf-of

    Hope above documentation helps you address your requirement.

    Thank you.

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.