Pastaba.
Prieigai prie šio puslapio reikalingas įgaliojimas. Galite bandyti prisijungti arba pakeisti katalogus.
Prieigai prie šio puslapio reikalingas įgaliojimas. Galite bandyti pakeisti katalogus.
Agent 365 Skills provide a guided setup path for connecting an existing agent to Agent 365 from a supported coding assistant. You state the outcome you want, such as add observability to this agent, and the skill identifies the project, gathers the required values, makes the integration changes, and checks the result.
Skills run in all coding agents including Claude Code, GitHub Copilot CLI, and VS Code agent mode.
To install the skills and follow the onboarding path for your agent, see Quickstart: Connect an existing agent to Agent 365.
Note
Skills replace the earlier setup workflow that used an instructions.md file.
When to use Skills
Connecting an existing agent to enterprise identity, observability, governed tooling, and notifications takes several ordered setup steps. These steps include installing the Agent 365 CLI, validating Azure prerequisites, registering a blueprint, configuring Entra resources, wiring OpenTelemetry exporters, connecting Model Context Protocol (MCP) servers, and testing locally.
Skills perform those steps in the required order for the selected path and validate the resulting project.
How a skill runs
Each skill follows the same workflow:
- State the outcome you want.
- Let the skill identify the project stack and existing configuration.
- Provide the values it requests, such as the authentication mode.
- Review the code, manifest, and configuration changes it makes.
- Confirm that the project still builds and the integration works.
Available Agent 365 Skills
a365-setup is the entry point. After it validates prerequisites, it routes you down one of two paths, and you follow only that path:
- Standard agent.
a365-setupdelegates tomake-a365-agent. Use this path when the agent doesn't need its own user account. A standard agent authenticates with OBO or S2S, so it can act for a signed-in user or run without one. - AI teammate.
a365-setupdelegates tomake-ai-teammate, for an agent that needs its own user account. An AI teammate authenticates as that user account (Agentic-User). This path requires the Frontier preview program.
To choose a path and an authentication mode, see Agent types and authentication modes.
| Skill | Purpose |
|---|---|
a365-setup |
Installs the Agent 365 CLI, validates Azure prerequisites, and detects the agent stack. For a standard agent, asks whether the agent authenticates with OBO or S2S. Then delegates to make-a365-agent or make-ai-teammate. |
make-a365-agent |
Provisions a standard agent that doesn't need its own user account. Registers the agent identity blueprint in Microsoft Entra, creates an agent identity from it, and configures the Entra ID permissions the agent needs: delegated permissions for OBO or application permissions for S2S. Then offers observability and tooling as add-ons. |
make-ai-teammate |
Transforms an agent into an AI teammate with its own user account. Registers the agent identity blueprint and creates an agent identity from it, then adds the hosting layer, message routing, and notifications. Requires a365-setup to have run first. |
instrument-observability |
Wires OpenTelemetry and the Agent 365 tracing exporter so agent spans reach Microsoft Defender, Microsoft Purview, and the Microsoft 365 admin center. Supports OBO, S2S, and Agentic-User. Asks for the agent kind and the authentication mode if a365-setup didn't already record them. |
a365-code-validator |
Validates and diagnoses an existing Agent 365 integration, including instrumentation, Microsoft Entra artifacts, messaging, tool access, and related configuration. Read-only by default. Use instrument-observability to add observability from scratch. |
add-workiq-tools |
Connects Work IQ MCP servers, including Mail, Calendar, and Word, so the agent can read and act on Microsoft 365 data. Requires a delegated permission model, and is skipped automatically when the authentication mode is S2S. |
purview-dlp-integration |
Adds Microsoft Purview data loss prevention (DLP) checks before the agent's LLM calls by using Microsoft Graph processContent, with optional response auditing. Guides Graph permission and DLP policy setup. |
test-local |
Runs an AI teammate agent locally and opens Agents Playground for interactive testing, with no cloud deployment required. Applies to the AI teammate path. |
Important
make-ai-teammate gives your agent its own user account, including a mailbox and Teams presence. This capability is available only to tenants participating in the Frontier preview program.
You usually invoke a skill by stating the outcome rather than naming the skill. For example, add observability to this agent runs instrument-observability. If your coding assistant exposes the internal a365-code-validator capability, ask it to validate this Agent 365 integration; the capability is also described internally as Validate & Diagnose. Availability and invocation depend on the assistant and installed Skills package. For the request phrasing used at each step, see Quickstart: Connect an existing agent to Agent 365.
Agent types and authentication modes
Skills set up both standard agents and AI teammates. The path determines which authentication modes are available to the agent. The authentication mode, called the execution mode in Agent identity, determines who the agent acts as when it calls downstream services such as Microsoft Graph and MCP servers.
| Authentication mode | Path | The agent acts as | Use it when |
|---|---|---|---|
| OBO (on-behalf-of) | Standard agent | The signed-in user, with delegated permissions | The agent works in a user's context, such as reading that user's calendar or sending mail for them. |
| S2S (service-to-service) | Standard agent | Its own agent identity, with application permissions | The agent runs without a signed-in user, such as for scheduled tasks, monitoring, or background processing. |
| Agentic-User | AI teammate | Its own user account | The agent needs its own mailbox, Teams presence, or other user-based Microsoft 365 experiences. Requires the Frontier preview program. |
For a standard agent, a365-setup asks whether the agent uses OBO or S2S, and later skills reuse your answer. An AI teammate always uses Agentic-User, so a365-setup doesn't ask. Skills configure one mode for each agent. If the agent needs both delegated and application permissions, run a365 setup all --authmode both with the Agent 365 CLI. For the roles that each mode requires, see Agent identity grants.
The authentication mode changes what the skills set up:
make-a365-agentrunsa365 setup allwith--authmode oboor--authmode s2s. OBO grants delegated permissions to the agent identity, and S2S assigns application permissions to it.instrument-observabilityexports telemetry over the S2S route with an app-only token in every mode, so a registered agent instance doesn't need an observability permission or admin consent. For OBO and Agentic-User, the skill configures the agent to get that token by reusing the blueprint credentials from its hosting connection. For S2S, it adds a token service that acquires and refreshes the token for .NET, Node.js, and Python agents. See Agent 365-enabled using S2S.add-workiq-toolsrequires a delegated user token, so it works with OBO and Agentic-User but not with S2S. If you choose S2S,a365-setupremoves Work IQ from your selected capabilities.purview-dlp-integrationsupports agentic delegated authentication. For S2S, it supports only Node.js agents that use client-secret Federated Managed Identity (FMI) authentication.test-localapplies only to AI teammates.
Supported stacks
Skills automatically detect the project stack, so you don't need to map your project manually. These are the stacks that Skills detect. The SDK also works with other frameworks.
| Language | Frameworks |
|---|---|
| .NET | Microsoft Agent Framework, Semantic Kernel, Azure AI Foundry |
| Node.js | LangChain, OpenAI Agents SDK, Claude Agent SDK, Semantic Kernel, Google ADK |
| Python | Microsoft Agent Framework, LangChain, OpenAI Agents SDK, Claude Agent SDK, Semantic Kernel, Google ADK |
Safety and repeatability
Skills are designed to apply setup changes without altering your project's existing behavior. Confirm this behavior with the Agent 365 SDK validation checklist.
- Additive and idempotent. Skills don't delete or restructure existing code, and rerunning a skill doesn't duplicate completed work.
- State-aware. Skills detect what's already wired, so they skip rather than repeat completed steps.
- Guard-railed. Skills don't modify files outside your project, and they verify the build still passes before finishing.
Use Skills when:
- You have an existing agent and want to onboard it without writing the integration by hand.
- Your development workflow already includes a coding assistant.
- You want consistent, repeatable onboarding across projects.
Use manual setup when:
- Your environment is nonstandard and each step needs individual control.
- Your organization restricts coding-assistant workflows.
- You're troubleshooting and want to run each step yourself.
For the manual path, use the setup steps in Quickstart: Connect an existing agent to Agent 365, and run the equivalent Agent 365 CLI commands for your environment.