This article answers common questions about the Agent 365 SDK: what it does and doesn't do, when you need it, which capabilities are available, how identity works, and how to validate an integration.
Scope and positioning
Can I build an agent with the Agent 365 SDK?
No. The SDK isn't an agent-building framework. Build your agent with your chosen framework, then use the Agent 365 SDK to bring it into Agent 365. See When to use the Agent 365 SDK.
Does the SDK make language model calls or orchestrate steps?
No. Your agent continues to make its own model calls, and orchestration stays in your framework or runtime. See Agent 365 SDK and the agent ecosystem.
Does the SDK host or deploy my agent?
No. Your agent runs wherever it runs today. See How is the Agent 365 SDK different?.
Does the SDK execute my agent's tool calls?
No. The SDK registers governed Model Context Protocol (MCP) servers; execution stays in your runtime. See Agent 365 SDK and the agent ecosystem.
Does the SDK replace my agent framework?
No. Keep your model, framework or runtime, and host. The SDK runs alongside them and adds identity, observability, tooling, and notifications. For the layer-by-layer boundary, see Agent 365 SDK overview.
How does the Agent 365 SDK differ from the Microsoft 365 Agents SDK?
The Microsoft 365 Agents SDK builds conversational agents, handling channel connectivity and conversation state. The Agent 365 SDK extends an agent you already built. The two work together. See Agent 365 SDK overview.
Which languages does the SDK support?
Python, JavaScript, and .NET. See Agent 365 SDK packages.
Choosing an integration mechanism
Do I need the SDK?
Not always. If built-in integration or registry sync already provides the capabilities your agent needs, you might not need the SDK. See Choose your integration option.
When is built-in integration enough?
When the platform path already provides the Agent 365 capabilities required by your scenario. Copilot Studio and Azure AI Foundry can fall into this category, but support depends on how the agent is built, authenticated, and hosted. Owning or deploying code doesn't by itself require the SDK. See Compare Agent 365 integration mechanisms.
What's the difference between registry sync and SDK integration?
Registry sync brings agents from connected agent platforms, such as Google Vertex AI and Amazon Bedrock, into Agent 365 through platform-level configuration. SDK integration is for agents you build with an agent SDK or framework, and it gives you code-level control. See Compare Agent 365 integration mechanisms.
My agent runs outside Azure. Can I still use the SDK?
Yes. The SDK doesn't change where your agent runs. It works with agents hosted on Azure, AWS, Google Cloud, or on-premises. See Agent 365 Agent Development lifecycle.
Capabilities
Do I have to adopt all four capabilities?
No, but they have prerequisites. An agent identity blueprint underpins the identity, tooling, and notifications capabilities, and notifications additionally require an agent's user account, which is available only to tenants participating in the Frontier preview program. Observability also works with a standard Microsoft Entra app registration. Beyond that, add capabilities in any order. See Verify notifications.
Which capability should I start with?
Identity. Registration is what makes the agent visible in Agent 365, so start there. Add observability next, when you need operational visibility. See Register the agent and Instrument for observability.
Where does my telemetry go?
Agent spans appear in Microsoft Defender, Microsoft Purview, and the Microsoft 365 admin center.
Two things can make telemetry look like it vanished, even though ingestion returns HTTP 200.
If no user in the tenant has a Microsoft 365 E7 or Microsoft Agent 365 license assigned, the whole request is dropped.
If the run has no valid invoke_agent span at its root, the spans are still queryable in Defender advanced hunting but don't appear in any of the three surfaces.
See Where your data shows up and Limits and drop conditions.
What is Work IQ?
Work IQ is the set of governed MCP servers that expose Microsoft 365 workloads, such as Mail, Calendar, Word, SharePoint, and Teams, to your agent under admin control. Work IQ MCP is in preview and requires a Microsoft 365 Copilot license. See Verify tooling.
Which notification sources are supported?
Teams, Outlook, Word comments, and email. Notifications require an agent's user account, which is available only to tenants participating in the Frontier preview program. See Notification types and Verify notifications.
Identity
Does my agent need its own identity?
Every Agent 365 integration needs an identity model, but that doesn't always mean giving the agent its own user account. The agent can use S2S to act as its agent identity, OBO to act on behalf of a signed-in user, or Agentic-User to act through its own Microsoft Entra user account. Choose the mode that matches the agent's work, permissions, and required Microsoft 365 resources. See Agent identity.
What's the difference between an agent identity blueprint and an agent identity?
The blueprint is the reusable template that holds the credentials and declared permissions for a kind of agent. An agent identity is the account an individual agent authenticates as. One blueprint can create many agent identities. See Identity objects and S2S, Blueprint-derived agent identity.
Where are my agent's credentials stored?
On the blueprint, not on the agent identity. Because a compromised blueprint affects every agent created from it, treat the number of blueprints as a security boundary decision. See Agent identity.
How many blueprints should I create?
As many as you need to keep credential and permission boundaries separate. Group only agent identities that can safely share the blueprint's credentials and inherited permissions. See The identity foundation and S2S, Blueprint-derived agent identity.
Which permission model should I use?
Application permissions for service-to-service work, where the agent acts with its own permissions. Delegated permissions for on-behalf-of work, where the agent acts with a signed-in user's permissions and context. See Agent identity.
Does my agent need a Microsoft 365 license?
Only if it has an agent's user account and needs services such as Teams, Exchange, or SharePoint. Agents with their own user account are available only to tenants in the Frontier preview program. Tenant-level licensing still applies to other capabilities: telemetry is dropped unless at least one user in the tenant has a Microsoft 365 E7 or Microsoft Agent 365 license assigned, and Work IQ MCP requires a Microsoft 365 Copilot license. See Agent's user account, Verify identity, Verify observability, and Verify tooling.
Why isn't my agent's mailbox available yet?
Resource provisioning can lag license assignment. See Agent 365 SDK validation checklist for the expected timings.
What's a sponsor?
The business representative accountable for an agent's purpose and lifecycle. At least one sponsor is required for each agent identity and agent identity blueprint. Security teams use the sponsor to reach a responsible human during an incident. See Sponsors and Verify identity.
Setup and Skills
What are Agent 365 Skills?
A way to have a coding assistant, such as GitHub Copilot CLI, perform the integration steps for you. See Agent 365 Skills.
What replaced the instructions.md setup workflow?
Agent 365 Skills replaced that workflow. Use Skills instead.
If your coding assistant exposes the internal Validate & Diagnose capability,
you can ask it to validate the Agent 365 integration; it's also referred to internally as a365-code-validator.
Availability depends on the assistant and installed Skills package. See Agent 365 Skills.
Do I have to use Skills?
No. You can perform each step manually. Skills suit standard setups and repeatable onboarding; manual setup suits nonstandard environments and troubleshooting. See When to use Skills.
Is it safe to run a skill more than once?
Yes. Skills are additive and idempotent, so completed steps are skipped rather than duplicated. See Safety and repeatability.
A skill appeared to skip a step. Is that a problem?
Usually not. Skills skip work that's already configured. Run the specific skill again and state the outcome explicitly if you want to confirm. See Safety and repeatability.
Can I test before deploying to the cloud?
On the AI teammate path, yes.
The test-local skill runs your agent alongside Agents Playground, a local test harness, for smoke testing.
Agents Playground connects over the agent messaging endpoint, so it doesn't apply to standard agents.
See The seven skills and Test agent in Agents Playground.
Validation
How do I confirm the integration worked?
Work through the Agent 365 SDK validation checklist.
My agent behaves differently after integration. What went wrong?
The SDK extends your agent rather than replacing any part of it. Investigate any behavior change before deploying: generated code, dependency conflicts, configuration, and SDK compatibility are all possible causes. Start with Verify existing behavior.