Sign-in and rights: who is asking? – agents in Microsoft 365 (W7, lesson 4)

What you learn in this lesson

tell the two connections of an agent apart: the agent's connection to the Azure Bot and the person's connection to Microsoft Graph

connect the agent without a secret by using a managed identity, and say where a secret is allowed only locally

get the person's token with UserAuthorization and tell the direct path from the On-Behalf-Of path

choose the least delegated permission according to Learn for "My appointments this week" and keep a rights list

derive the person from the token, never from the text, and test that without a tenant

The quote agent of the Kladde answers in chat. Jana Brandt may approve quotes, Tom Seeger may draft them, and both write the same sentence. The chat does not say who is asking. You build the sign-in for that, and a tool that reads the calendar on behalf of the person, with the least permission that Learn names.

What you bring: lesson W7.2.1 "The quote agent in chat", the rule "person from the token" from T7.5 "Memory" and T8.3 "Rights for tools", K3 "No keys: managed identity", and the terms delegated, application and consent from W4.1.2 "Permissions and consent".

State of the checks

Nothing ran against a Microsoft 365 tenant, Teams or an Azure Bot. Settings and SDK calls come from Microsoft Learn (read while writing, pages under "Further reading"). Built and tested (test project outside the repository, .NET 10, xunit and Shouldly, 13 tests green, exit code 0) is only the plain code without an Agents SDK package: UserContextFactory, WeekRange, MyWeekTool against a stand-in. Not built are the excerpt with AgentApplication and everything involving Azure or Teams. What Learn does not settle is marked open. Everything with a tenant runs only in a test tenant; whether you can get a developer tenant, you clarify with Microsoft.

This lesson belongs to course W7

You will see the rest of this lesson and its video once you have bought the course. The goals above show what you learn here.

€79.00

incl. VAT, one-time payment

Access to all of the course's lessons with their exercises, solutions and videos on this site, for 24 months from the purchase. A self-study course: no tutoring, no exams or grading by us, and no certificate.

Withdraw from contract here