[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M699TGDN1GERCSJA307S7BZP":3,"skill-same:01M699TGDN1GERCSJA307S7BZP":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M699TGDN1GERCSJA307S7BZP","entra-agent-id",null,"Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).","microsoft\u002Fazure-skills","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M699HXPKQFT1BH5KD1PG0CB4",1636,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fentra-agent-id\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,9,48],"agent id","id","entra agent id","configure","tenant","path","agent authoring","app","authoring","token","microsoft graph","do","registration","Blueprint","sdk","federation","graph","agent identity","workload","entra app registration","identity","auth","microsoft foundry","foundry","web","2026-11-10 10:12:30",false,"---\nname: entra-agent-id\ndescription: \"Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).\"\nlicense: MIT\nmetadata:\n  author: Microsoft\n  version: \"1.1.1\"\n---\n\n# Microsoft Entra Agent ID\n\nCreate and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.\n\n## Quick Reference\n\n| Property | Value |\n|----------|-------|\n| Service | Microsoft Entra Agent ID |\n| API | Microsoft Graph (`https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`) |\n| Required role | Agent Identity Developer, Agent Identity Administrator, or Application Administrator |\n| Object model | Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) |\n| Runtime exchange | Two-step `fmi_path` exchange (autonomous and OBO) |\n| .NET helper | `Microsoft.Identity.Web.AgentIdentities` |\n| Polyglot helper | Microsoft Entra SDK for AgentID (sidecar container) |\n\n## When to Use This Skill\n\n- Provisioning a new Agent Identity Blueprint and BlueprintPrincipal\n- Creating per-instance Agent Identities under a Blueprint\n- Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint\n- Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO)\n- Cross-tenant agent token flows\n- Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)\n- Granting per-Agent-Identity application (`appRoleAssignments`) or delegated (`oauth2PermissionGrants`) permissions\n- Diagnosing Agent ID errors such as `AADSTS82001`, `AADSTS700211`, or `PropertyNotCompatibleWithAgentIdentity`\n\n## MCP Tools\n\n| Tool | Use |\n|------|-----|\n| `mcp_azure_mcp_documentation` | Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration |\n\nThere is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python `requests`). Use `mcp_azure_mcp_documentation` to verify request bodies and endpoints against current docs before running.\n\n## Before You Start\n\nUse the `mcp_azure_mcp_documentation` tool to search Microsoft Learn for current Agent ID documentation:\n- \"Microsoft Entra Agent ID setup instructions\"\n- \"Microsoft Entra SDK for AgentID\"\n\nVerify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.\n\n## Conceptual Model\n\n```\nAgent Identity Blueprint (application)         ← one per agent type\u002Fproject\n  └── BlueprintPrincipal (service principal)    ← MUST be created explicitly\n        ├── Agent Identity (SP): agent-1        ← one per agent instance\n        ├── Agent Identity (SP): agent-2\n        └── Agent Identity (SP): agent-3\n```\n\n| Concept | Description |\n|---------|-------------|\n| **Blueprint** | Application object that defines a type\u002Fclass of agent. Holds credentials (secret, certificate, federated identity). |\n| **BlueprintPrincipal** | Service principal for the Blueprint in the tenant. Not auto-created. |\n| **Agent Identity** | Service-principal-only identity for a single agent instance. Cannot hold its own credentials. |\n| **Sponsor** | A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation. |\n\n## Prerequisites\n\n### Required Entra Roles\n\nOne of: **Agent Identity Developer**, **Agent Identity Administrator**, or **Application Administrator**.\n\n### PowerShell (interactive setup)\n\n```powershell\n# PowerShell 7+\nInstall-Module Microsoft.Graph.Applications -Scope CurrentUser -Force\n```\n\n### Python (programmatic provisioning)\n\n```bash\npip install azure-identity requests\n```\n\n## Authentication\n\n> **`DefaultAzureCredential` is not supported.** Azure CLI tokens carry `Directory.AccessAsUser.All`, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with `client_credentials`, or `Connect-MgGraph` with explicit delegated scopes.\n\n### PowerShell (delegated)\n\n```powershell\nConnect-MgGraph -Scopes @(\n    \"AgentIdentityBlueprint.Create\",\n    \"AgentIdentityBlueprint.ReadWrite.All\",\n    \"AgentIdentityBlueprintPrincipal.Create\",\n    \"AgentIdentity.Create.All\",\n    \"User.Read\"\n)\n```\n\n### Python (application)\n\n```python\nimport os, requests\nfrom azure.identity import ClientSecretCredential\n\ncredential = ClientSecretCredential(\n    tenant_id=os.environ[\"AZURE_TENANT_ID\"],\n    client_id=os.environ[\"AZURE_CLIENT_ID\"],\n    client_secret=os.environ[\"AZURE_CLIENT_SECRET\"],\n)\ntoken = credential.get_token(\"https:\u002F\u002Fgraph.microsoft.com\u002F.default\")\n\nGRAPH = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\nheaders = {\n    \"Authorization\": f\"Bearer {token.token}\",\n    \"Content-Type\": \"application\u002Fjson\",\n    \"OData-Version\": \"4.0\",\n}\n```\n\n## Core Workflow\n\n### Step 1: Create Agent Identity Blueprint\n\nUse the typed endpoint. Sponsors must be **Users** at Blueprint creation. This snippet assumes the `requests` client and `headers` dict from the Python authentication block above.\n\n```python\nimport subprocess\nimport requests\n\nuser_id = subprocess.run(\n    [\"az\", \"ad\", \"signed-in-user\", \"show\", \"--query\", \"id\", \"-o\", \"tsv\"],\n    capture_output=True, text=True, check=True,\n).stdout.strip()\n\nblueprint_body = {\n    \"displayName\": \"My Agent Blueprint\",\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint\",\n    headers=headers, json=blueprint_body,\n)\nresp.raise_for_status()\n\nblueprint = resp.json()\napp_id = blueprint[\"appId\"]\nblueprint_obj_id = blueprint[\"id\"]\n```\n\n### Step 2: Create BlueprintPrincipal\n\n> Mandatory. Creating a Blueprint does NOT auto-create its service principal. Skipping this step produces:\n> `400: The Agent Blueprint Principal for the Agent Blueprint does not exist.`\n\n```python\nsp_body = {\"appId\": app_id}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal\",\n    headers=headers, json=sp_body,\n)\nresp.raise_for_status()\n```\n\nMake your provisioning scripts idempotent — always check for the BlueprintPrincipal even when the Blueprint already exists.\n\n### Step 3: Create Agent Identities\n\nSponsors for an Agent Identity may be **Users or Groups**.\n\n```python\nagent_body = {\n    \"displayName\": \"my-agent-instance-1\",\n    \"agentIdentityBlueprintId\": app_id,\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity\",\n    headers=headers, json=agent_body,\n)\nresp.raise_for_status()\nagent = resp.json()\nagent_sp_id = agent[\"id\"]\n```\n\n## Runtime Authentication\n\nAgents authenticate at runtime using credentials configured on the **Blueprint** (not on the Agent Identity — Agent Identities can't hold credentials).\n\n| Option | Use case | Credential on Blueprint |\n|--------|----------|------------------------|\n| **Managed Identity + WIF** | Production (Azure-hosted) | Federated Identity Credential |\n| **Client secret** | Local dev \u002F testing | Password credential |\n| **Microsoft Entra SDK for AgentID** | Polyglot \u002F 3P agents | Sidecar container acquires tokens over HTTP |\n\nFor the two-step `fmi_path` exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct `sub` claim and audit trail, see [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md).\n\nFor OBO (agent acting on behalf of a user), see [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md).\n\nFor the containerized polyglot auth sidecar (Python, Node, Go, Java — no SDK embedding), see [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md).\n\nFor MI+WIF and client-secret setup details, see [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md).\n\n### .NET quick path\n\nFor .NET services, use **`Microsoft.Identity.Web.AgentIdentities`** — it handles Federated Identity Credential management and the two-step exchange for you. See the package README at `github.com\u002FAzureAD\u002Fmicrosoft-identity-web` under `src\u002FMicrosoft.Identity.Web.AgentIdentities\u002F`.\n\n## Granting Permissions (Per Agent Identity)\n\nAgent Identities support both application permissions (autonomous) and delegated permissions (OBO). Grants are scoped **per Agent Identity**, not to the BlueprintPrincipal.\n\n### Application permissions (autonomous)\n\n```python\ngraph_sp = requests.get(\n    f\"{GRAPH}\u002FservicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'\",\n    headers=headers,\n).json()[\"value\"][0]\n\nuser_read_all = next(r for r in graph_sp[\"appRoles\"] if r[\"value\"] == \"User.Read.All\")\n\nrequests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002F{agent_sp_id}\u002FappRoleAssignments\",\n    headers=headers,\n    json={\n        \"principalId\": agent_sp_id,\n        \"resourceId\": graph_sp[\"id\"],\n        \"appRoleId\": user_read_all[\"id\"],\n    },\n).raise_for_status()\n```\n\n### Delegated permissions (OBO)\n\n```python\nfrom datetime import datetime, timedelta, timezone\n\nexpiry = (datetime.now(timezone.utc) + timedelta(days=3650)).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n\nrequests.post(\n    f\"{GRAPH}\u002Foauth2PermissionGrants\",\n    headers=headers,\n    json={\n        \"clientId\": agent_sp_id,\n        \"consentType\": \"AllPrincipals\",\n        \"resourceId\": graph_sp[\"id\"],\n        \"scope\": \"User.Read Tasks.ReadWrite Mail.Send\",\n        \"expiryTime\": expiry,\n    },\n).raise_for_status()\n```\n\nBrowser-based admin consent URLs do not work for Agent Identities — use `oauth2PermissionGrants` for programmatic delegated consent.\n\n## Cross-Tenant Agent Identities\n\nBlueprints can be multi-tenant (`signInAudience: AzureADMultipleOrgs`). When exchanging tokens cross-tenant:\n\n> **Step 1 of the parent token exchange MUST target the Agent Identity's home tenant**, not the Blueprint's. Wrong tenant → `AADSTS700211: No matching federated identity record found`.\n\nSee [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) for full cross-tenant examples.\n\n## API Reference\n\n| Operation | Method | Endpoint |\n|-----------|--------|----------|\n| Create Blueprint | `POST` | `\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint` |\n| Create BlueprintPrincipal | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal` |\n| Create Agent Identity | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Add FIC to Blueprint | `POST` | `\u002Fapplications\u002F{id}\u002Fmicrosoft.graph.agentIdentityBlueprint\u002FfederatedIdentityCredentials` |\n| List Agent Identities | `GET` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Grant app permission | `POST` | `\u002FservicePrincipals\u002F{id}\u002FappRoleAssignments` |\n| Grant delegated permission | `POST` | `\u002Foauth2PermissionGrants` |\n| Delete Agent Identity | `DELETE` | `\u002FservicePrincipals\u002F{id}` |\n| Delete Blueprint | `DELETE` | `\u002Fapplications\u002F{id}` |\n\nBase URL: `https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`.\n\n## Required Graph Permissions\n\n| Permission | Purpose |\n|-----------|---------|\n| `AgentIdentityBlueprint.Create` | Create Blueprints |\n| `AgentIdentityBlueprint.ReadWrite.All` | Read\u002Fupdate Blueprints |\n| `AgentIdentityBlueprintPrincipal.Create` | Create BlueprintPrincipals |\n| `AgentIdentity.Create.All` | Create Agent Identities |\n| `AgentIdentity.ReadWrite.All` | Read\u002Fupdate Agent Identities |\n| `Application.ReadWrite.All` | Blueprint CRUD on application objects |\n| `AppRoleAssignment.ReadWrite.All` | Grant application permissions |\n| `DelegatedPermissionGrant.ReadWrite.All` | Grant delegated permissions |\n\nGrant admin consent (required for application permissions):\n\n```bash\naz ad app permission admin-consent --id \u003Cclient-id>\n```\n\nAfter admin consent, tokens may not include new claims for 30–120 seconds — retry with exponential backoff.\n\n## Best Practices\n\n1. **Always create BlueprintPrincipal after Blueprint** — not auto-created.\n2. **Use typed endpoints** (`\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint`) instead of raw `\u002Fapplications` with `@odata.type`.\n3. **Credentials live on the Blueprint** — Agent Identities can't hold secrets\u002Fcerts (`PropertyNotCompatibleWithAgentIdentity`).\n4. **Include `OData-Version: 4.0`** on every Graph request.\n5. **Use Workload Identity Federation for production** — client secrets only for local dev.\n6. **Set `identifierUris: [\"api:\u002F\u002F{appId}\"]` on the Blueprint** before OAuth2 scope resolution.\n7. **Never use Azure CLI tokens** for Agent Identity APIs — `Directory.AccessAsUser.All` causes hard 403.\n8. **Use `fmi_path`** with `client_credentials` — NOT RFC 8693 `urn:ietf:params:oauth:grant-type:token-exchange` (returns `AADSTS82001`).\n9. **Always use `\u002F.default` scope** in both steps of the exchange — individual scopes fail.\n10. **Step 1 targets the Agent Identity's home tenant** in cross-tenant flows.\n11. **Grant permissions per Agent Identity**, not to the BlueprintPrincipal.\n12. **Handle permission-propagation delays** — retry 403s with 30–120s backoff after admin consent.\n13. **Keep the Entra SDK for AgentID on localhost** — never expose via LoadBalancer or Ingress.\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n|-------|-------|-----|\n| `AADSTS82001` | Used RFC 8693 token-exchange grant | Use `client_credentials` with `fmi_path` |\n| `AADSTS700211` | Step 1 parent token targeted wrong tenant | Target Agent Identity's home tenant |\n| `AADSTS50013` | OBO user token targets Graph, not Blueprint | Use `api:\u002F\u002F{blueprint_app_id}\u002Faccess_as_user` |\n| `AADSTS65001` | Missing grant or used individual scopes | Use `\u002F.default` and verify `oauth2PermissionGrants` |\n| `403 Authorization_RequestDenied` | No grant on this Agent Identity | Add via `appRoleAssignments` or `oauth2PermissionGrants` |\n| `PropertyNotCompatibleWithAgentIdentity` | Tried to add credential to Agent Identity SP | Put credentials on the Blueprint |\n| `Agent Blueprint Principal does not exist` | BlueprintPrincipal not created | Step 2 of the Core Workflow |\n| `AADSTS650051` on admin consent | SP already exists from partial consent | Grant directly via `appRoleAssignments` |\n\n## References\n\n| File | Contents |\n|------|----------|\n| [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) | Two-step `fmi_path` exchange: autonomous + OBO, cross-tenant |\n| [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md) | MI + WIF (production) and client secret (local dev) |\n| [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md) | Configuring the Blueprint as an OAuth2 API for OBO |\n| [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md) | Microsoft Entra SDK for AgentID — architecture, configuration, endpoints |\n| [references\u002Fsdk-sidecar-deployment.md](references\u002Fsdk-sidecar-deployment.md) | SDK code patterns (Python\u002FTypeScript), Docker\u002FKubernetes manifests, security, troubleshooting |\n| [references\u002Fknown-limitations.md](references\u002Fknown-limitations.md) | Documented gaps organized by category |\n\n### External Links\n\n| Resource | URL |\n|----------|-----|\n| Agent ID Setup Guide | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-setup-instructions |\n| AI-Guided Setup | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-ai-guided-setup |\n| Microsoft Entra SDK for AgentID | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fmsidweb\u002Fagent-id-sdk\u002Foverview |\n| Microsoft.Identity.Web.AgentIdentities (.NET) | https:\u002F\u002Fgithub.com\u002FAzureAD\u002Fmicrosoft-identity-web\u002Fblob\u002Fmaster\u002Fsrc\u002FMicrosoft.Identity.Web.AgentIdentities\u002FREADME.AgentIdentities.md |\n","# Microsoft Entra Agent ID\n\nCreate and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.\n\n## Quick Reference\n\n| Property | Value |\n|----------|-------|\n| Service | Microsoft Entra Agent ID |\n| API | Microsoft Graph (`https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`) |\n| Required role | Agent Identity Developer, Agent Identity Administrator, or Application Administrator |\n| Object model | Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) |\n| Runtime exchange | Two-step `fmi_path` exchange (autonomous and OBO) |\n| .NET helper | `Microsoft.Identity.Web.AgentIdentities` |\n| Polyglot helper | Microsoft Entra SDK for AgentID (sidecar container) |\n\n## When to Use This Skill\n\n- Provisioning a new Agent Identity Blueprint and BlueprintPrincipal\n- Creating per-instance Agent Identities under a Blueprint\n- Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint\n- Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO)\n- Cross-tenant agent token flows\n- Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)\n- Granting per-Agent-Identity application (`appRoleAssignments`) or delegated (`oauth2PermissionGrants`) permissions\n- Diagnosing Agent ID errors such as `AADSTS82001`, `AADSTS700211`, or `PropertyNotCompatibleWithAgentIdentity`\n\n## MCP Tools\n\n| Tool | Use |\n|------|-----|\n| `mcp_azure_mcp_documentation` | Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration |\n\nThere is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python `requests`). Use `mcp_azure_mcp_documentation` to verify request bodies and endpoints against current docs before running.\n\n## Before You Start\n\nUse the `mcp_azure_mcp_documentation` tool to search Microsoft Learn for current Agent ID documentation:\n- \"Microsoft Entra Agent ID setup instructions\"\n- \"Microsoft Entra SDK for AgentID\"\n\nVerify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.\n\n## Conceptual Model\n\n```\nAgent Identity Blueprint (application)         ← one per agent type\u002Fproject\n  └── BlueprintPrincipal (service principal)    ← MUST be created explicitly\n        ├── Agent Identity (SP): agent-1        ← one per agent instance\n        ├── Agent Identity (SP): agent-2\n        └── Agent Identity (SP): agent-3\n```\n\n| Concept | Description |\n|---------|-------------|\n| **Blueprint** | Application object that defines a type\u002Fclass of agent. Holds credentials (secret, certificate, federated identity). |\n| **BlueprintPrincipal** | Service principal for the Blueprint in the tenant. Not auto-created. |\n| **Agent Identity** | Service-principal-only identity for a single agent instance. Cannot hold its own credentials. |\n| **Sponsor** | A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation. |\n\n## Prerequisites\n\n### Required Entra Roles\n\nOne of: **Agent Identity Developer**, **Agent Identity Administrator**, or **Application Administrator**.\n\n### PowerShell (interactive setup)\n\n```powershell\n# PowerShell 7+\nInstall-Module Microsoft.Graph.Applications -Scope CurrentUser -Force\n```\n\n### Python (programmatic provisioning)\n\n```bash\npip install azure-identity requests\n```\n\n## Authentication\n\n> **`DefaultAzureCredential` is not supported.** Azure CLI tokens carry `Directory.AccessAsUser.All`, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with `client_credentials`, or `Connect-MgGraph` with explicit delegated scopes.\n\n### PowerShell (delegated)\n\n```powershell\nConnect-MgGraph -Scopes @(\n    \"AgentIdentityBlueprint.Create\",\n    \"AgentIdentityBlueprint.ReadWrite.All\",\n    \"AgentIdentityBlueprintPrincipal.Create\",\n    \"AgentIdentity.Create.All\",\n    \"User.Read\"\n)\n```\n\n### Python (application)\n\n```python\nimport os, requests\nfrom azure.identity import ClientSecretCredential\n\ncredential = ClientSecretCredential(\n    tenant_id=os.environ[\"AZURE_TENANT_ID\"],\n    client_id=os.environ[\"AZURE_CLIENT_ID\"],\n    client_secret=os.environ[\"AZURE_CLIENT_SECRET\"],\n)\ntoken = credential.get_token(\"https:\u002F\u002Fgraph.microsoft.com\u002F.default\")\n\nGRAPH = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\nheaders = {\n    \"Authorization\": f\"Bearer {token.token}\",\n    \"Content-Type\": \"application\u002Fjson\",\n    \"OData-Version\": \"4.0\",\n}\n```\n\n## Core Workflow\n\n### Step 1: Create Agent Identity Blueprint\n\nUse the typed endpoint. Sponsors must be **Users** at Blueprint creation. This snippet assumes the `requests` client and `headers` dict from the Python authentication block above.\n\n```python\nimport subprocess\nimport requests\n\nuser_id = subprocess.run(\n    [\"az\", \"ad\", \"signed-in-user\", \"show\", \"--query\", \"id\", \"-o\", \"tsv\"],\n    capture_output=True, text=True, check=True,\n).stdout.strip()\n\nblueprint_body = {\n    \"displayName\": \"My Agent Blueprint\",\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint\",\n    headers=headers, json=blueprint_body,\n)\nresp.raise_for_status()\n\nblueprint = resp.json()\napp_id = blueprint[\"appId\"]\nblueprint_obj_id = blueprint[\"id\"]\n```\n\n### Step 2: Create BlueprintPrincipal\n\n> Mandatory. Creating a Blueprint does NOT auto-create its service principal. Skipping this step produces:\n> `400: The Agent Blueprint Principal for the Agent Blueprint does not exist.`\n\n```python\nsp_body = {\"appId\": app_id}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal\",\n    headers=headers, json=sp_body,\n)\nresp.raise_for_status()\n```\n\nMake your provisioning scripts idempotent — always check for the BlueprintPrincipal even when the Blueprint already exists.\n\n### Step 3: Create Agent Identities\n\nSponsors for an Agent Identity may be **Users or Groups**.\n\n```python\nagent_body = {\n    \"displayName\": \"my-agent-instance-1\",\n    \"agentIdentityBlueprintId\": app_id,\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity\",\n    headers=headers, json=agent_body,\n)\nresp.raise_for_status()\nagent = resp.json()\nagent_sp_id = agent[\"id\"]\n```\n\n## Runtime Authentication\n\nAgents authenticate at runtime using credentials configured on the **Blueprint** (not on the Agent Identity — Agent Identities can't hold credentials).\n\n| Option | Use case | Credential on Blueprint |\n|--------|----------|------------------------|\n| **Managed Identity + WIF** | Production (Azure-hosted) | Federated Identity Credential |\n| **Client secret** | Local dev \u002F testing | Password credential |\n| **Microsoft Entra SDK for AgentID** | Polyglot \u002F 3P agents | Sidecar container acquires tokens over HTTP |\n\nFor the two-step `fmi_path` exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct `sub` claim and audit trail, see [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md).\n\nFor OBO (agent acting on behalf of a user), see [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md).\n\nFor the containerized polyglot auth sidecar (Python, Node, Go, Java — no SDK embedding), see [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md).\n\nFor MI+WIF and client-secret setup details, see [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md).\n\n### .NET quick path\n\nFor .NET services, use **`Microsoft.Identity.Web.AgentIdentities`** — it handles Federated Identity Credential management and the two-step exchange for you. See the package README at `github.com\u002FAzureAD\u002Fmicrosoft-identity-web` under `src\u002FMicrosoft.Identity.Web.AgentIdentities\u002F`.\n\n## Granting Permissions (Per Agent Identity)\n\nAgent Identities support both application permissions (autonomous) and delegated permissions (OBO). Grants are scoped **per Agent Identity**, not to the BlueprintPrincipal.\n\n### Application permissions (autonomous)\n\n```python\ngraph_sp = requests.get(\n    f\"{GRAPH}\u002FservicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'\",\n    headers=headers,\n).json()[\"value\"][0]\n\nuser_read_all = next(r for r in graph_sp[\"appRoles\"] if r[\"value\"] == \"User.Read.All\")\n\nrequests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002F{agent_sp_id}\u002FappRoleAssignments\",\n    headers=headers,\n    json={\n        \"principalId\": agent_sp_id,\n        \"resourceId\": graph_sp[\"id\"],\n        \"appRoleId\": user_read_all[\"id\"],\n    },\n).raise_for_status()\n```\n\n### Delegated permissions (OBO)\n\n```python\nfrom datetime import datetime, timedelta, timezone\n\nexpiry = (datetime.now(timezone.utc) + timedelta(days=3650)).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n\nrequests.post(\n    f\"{GRAPH}\u002Foauth2PermissionGrants\",\n    headers=headers,\n    json={\n        \"clientId\": agent_sp_id,\n        \"consentType\": \"AllPrincipals\",\n        \"resourceId\": graph_sp[\"id\"],\n        \"scope\": \"User.Read Tasks.ReadWrite Mail.Send\",\n        \"expiryTime\": expiry,\n    },\n).raise_for_status()\n```\n\nBrowser-based admin consent URLs do not work for Agent Identities — use `oauth2PermissionGrants` for programmatic delegated consent.\n\n## Cross-Tenant Agent Identities\n\nBlueprints can be multi-tenant (`signInAudience: AzureADMultipleOrgs`). When exchanging tokens cross-tenant:\n\n> **Step 1 of the parent token exchange MUST target the Agent Identity's home tenant**, not the Blueprint's. Wrong tenant → `AADSTS700211: No matching federated identity record found`.\n\nSee [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) for full cross-tenant examples.\n\n## API Reference\n\n| Operation | Method | Endpoint |\n|-----------|--------|----------|\n| Create Blueprint | `POST` | `\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint` |\n| Create BlueprintPrincipal | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal` |\n| Create Agent Identity | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Add FIC to Blueprint | `POST` | `\u002Fapplications\u002F{id}\u002Fmicrosoft.graph.agentIdentityBlueprint\u002FfederatedIdentityCredentials` |\n| List Agent Identities | `GET` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Grant app permission | `POST` | `\u002FservicePrincipals\u002F{id}\u002FappRoleAssignments` |\n| Grant delegated permission | `POST` | `\u002Foauth2PermissionGrants` |\n| Delete Agent Identity | `DELETE` | `\u002FservicePrincipals\u002F{id}` |\n| Delete Blueprint | `DELETE` | `\u002Fapplications\u002F{id}` |\n\nBase URL: `https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`.\n\n## Required Graph Permissions\n\n| Permission | Purpose |\n|-----------|---------|\n| `AgentIdentityBlueprint.Create` | Create Blueprints |\n| `AgentIdentityBlueprint.ReadWrite.All` | Read\u002Fupdate Blueprints |\n| `AgentIdentityBlueprintPrincipal.Create` | Create BlueprintPrincipals |\n| `AgentIdentity.Create.All` | Create Agent Identities |\n| `AgentIdentity.ReadWrite.All` | Read\u002Fupdate Agent Identities |\n| `Application.ReadWrite.All` | Blueprint CRUD on application objects |\n| `AppRoleAssignment.ReadWrite.All` | Grant application permissions |\n| `DelegatedPermissionGrant.ReadWrite.All` | Grant delegated permissions |\n\nGrant admin consent (required for application permissions):\n\n```bash\naz ad app permission admin-consent --id \u003Cclient-id>\n```\n\nAfter admin consent, tokens may not include new claims for 30–120 seconds — retry with exponential backoff.\n\n## Best Practices\n\n1. **Always create BlueprintPrincipal after Blueprint** — not auto-created.\n2. **Use typed endpoints** (`\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint`) instead of raw `\u002Fapplications` with `@odata.type`.\n3. **Credentials live on the Blueprint** — Agent Identities can't hold secrets\u002Fcerts (`PropertyNotCompatibleWithAgentIdentity`).\n4. **Include `OData-Version: 4.0`** on every Graph request.\n5. **Use Workload Identity Federation for production** — client secrets only for local dev.\n6. **Set `identifierUris: [\"api:\u002F\u002F{appId}\"]` on the Blueprint** before OAuth2 scope resolution.\n7. **Never use Azure CLI tokens** for Agent Identity APIs — `Directory.AccessAsUser.All` causes hard 403.\n8. **Use `fmi_path`** with `client_credentials` — NOT RFC 8693 `urn:ietf:params:oauth:grant-type:token-exchange` (returns `AADSTS82001`).\n9. **Always use `\u002F.default` scope** in both steps of the exchange — individual scopes fail.\n10. **Step 1 targets the Agent Identity's home tenant** in cross-tenant flows.\n11. **Grant permissions per Agent Identity**, not to the BlueprintPrincipal.\n12. **Handle permission-propagation delays** — retry 403s with 30–120s backoff after admin consent.\n13. **Keep the Entra SDK for AgentID on localhost** — never expose via LoadBalancer or Ingress.\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n|-------|-------|-----|\n| `AADSTS82001` | Used RFC 8693 token-exchange grant | Use `client_credentials` with `fmi_path` |\n| `AADSTS700211` | Step 1 parent token targeted wrong tenant | Target Agent Identity's home tenant |\n| `AADSTS50013` | OBO user token targets Graph, not Blueprint | Use `api:\u002F\u002F{blueprint_app_id}\u002Faccess_as_user` |\n| `AADSTS65001` | Missing grant or used individual scopes | Use `\u002F.default` and verify `oauth2PermissionGrants` |\n| `403 Authorization_RequestDenied` | No grant on this Agent Identity | Add via `appRoleAssignments` or `oauth2PermissionGrants` |\n| `PropertyNotCompatibleWithAgentIdentity` | Tried to add credential to Agent Identity SP | Put credentials on the Blueprint |\n| `Agent Blueprint Principal does not exist` | BlueprintPrincipal not created | Step 2 of the Core Workflow |\n| `AADSTS650051` on admin consent | SP already exists from partial consent | Grant directly via `appRoleAssignments` |\n\n## References\n\n| File | Contents |\n|------|----------|\n| [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) | Two-step `fmi_path` exchange: autonomous + OBO, cross-tenant |\n| [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md) | MI + WIF (production) and client secret (local dev) |\n| [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md) | Configuring the Blueprint as an OAuth2 API for OBO |\n| [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md) | Microsoft Entra SDK for AgentID — architecture, configuration, endpoints |\n| [references\u002Fsdk-sidecar-deployment.md](references\u002Fsdk-sidecar-deployment.md) | SDK code patterns (Python\u002FTypeScript), Docker\u002FKubernetes manifests, security, troubleshooting |\n| [references\u002Fknown-limitations.md](references\u002Fknown-limitations.md) | Documented gaps organized by category |\n\n### External Links\n\n| Resource | URL |\n|----------|-----|\n| Agent ID Setup Guide | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-setup-instructions |\n| AI-Guided Setup | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-ai-guided-setup |\n| Microsoft Entra SDK for AgentID | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fmsidweb\u002Fagent-id-sdk\u002Foverview |\n| Microsoft.Identity.Web.AgentIdentities (.NET) | https:\u002F\u002Fgithub.com\u002FAzureAD\u002Fmicrosoft-identity-web\u002Fblob\u002Fmaster\u002Fsrc\u002FMicrosoft.Identity.Web.AgentIdentities\u002FREADME.AgentIdentities.md |\n",{"name":5,"license":15,"metadata":54,"description":7},{"author":12,"version":55},"1.1.1","main","fbda857c484a85c7ce644f56809b7f204471fb69","skills\u002Fentra-agent-id",266,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-12 02:02:55",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add microsoft\u002Fazure-skills --skill entra-agent-id",{"tool":71,"command":72},"bunx","bunx skills add microsoft\u002Fazure-skills --skill entra-agent-id",{"tool":74,"command":75},"pnpm","pnpm dlx skills add microsoft\u002Fazure-skills --skill entra-agent-id","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fentra-agent-id\u002FSKILL.md",true,[79,85,89,93,97,101],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fknown-limitations.md","REFERENCE","参考文档",4754,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Fknown-limitations.md",{"path":86,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Foauth2-token-flow.md",4507,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Foauth2-token-flow.md",{"path":90,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fobo-blueprint-setup.md",4235,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Fobo-blueprint-setup.md",{"path":94,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fruntime-token-exchange.md",6746,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Fruntime-token-exchange.md",{"path":98,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fsdk-sidecar-deployment.md",6276,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Fsdk-sidecar-deployment.md",{"path":102,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fsdk-sidecar.md",6107,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Fsdk-sidecar.md",[106,134,159,180,197,213],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":115,"publishedAt":49},"01M699VFT1T15GFDGC4K4ZHY4N","python-appservice-deploy","Deploy Python (Flask\u002FDjango\u002FFastAPI) code to Azure App Service Linux. WHEN: \"Flask App Service\", \"Django App Service\", \"FastAPI App Service\", \"deploy Python to App Service\". DO NOT USE FOR: Container Apps, Functions, non-Python, Terraform\u002FBicep\u002FIaC, full infra — use azure-prepare.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fpython-appservice-deploy\u002FSKILL.md",[112],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",[116,117,118,119,120,31,35,121,122,123,124,125,126,127,128,129,130,131,132,133],"python appservice deploy","deploy","python","linux","infra","django","for","azure app service","azure","container","iac","fastapi","use","apps","when","code","functions","fastapi app",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":142,"publishedAt":49},"01M699VDV3PT5P0YDXRT4GM2TJ","preset","Intelligently deploys Azure OpenAI models to optimal regions by analyzing capacity across all available regions. Automatically checks current region first and shows alternatives if needed. USE FOR: quick deployment, optimal region, best region, automatic region selection, fast setup, multi-region capacity check, high availability deployment, deploy to best location. DO NOT USE FOR: custom SKU selection (use customize), specific version selection (use customize), custom capacity configuration (use customize), PTU deployments (use customize).","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmicrosoft-foundry\u002Fmodels\u002Fdeploy-model\u002Fpreset\u002FSKILL.md",[140,141],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[136,117,143,9,144,145,35,146,147,122,148,149,150,124,151,152,153,128,154,155,156,157,158],"setup","capacity","customize","quick","availability","deployment","alternatives","selection","custom","deployments","high availability","version","across","check","multi","first",{"skillNo":160,"name":145,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":49},"01M699VBT6YFAKBWCK890XDB6N","Interactive guided deployment flow for Azure OpenAI models with full customization control. Step-by-step selection of model version, SKU (GlobalStandard\u002FStandard\u002FProvisionedManaged), capacity, RAI policy (content filter), and advanced options (dynamic quota, priority processing, spillover). USE FOR: custom deployment, customize model deployment, choose version, select SKU, set capacity, configure content filter, RAI policy, deployment options, detailed deployment, advanced deployment, PTU deployment, provisioned throughput. DO NOT USE FOR: quick deployment to optimal region (use preset).","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmicrosoft-foundry\u002Fmodels\u002Fdeploy-model\u002Fcustomize\u002FSKILL.md",[164],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[145,136,9,144,166,167,146,168,169,170,171,172,150,27,173,174,175,176,177,178,179,35,122,148],"policy","SET","processing","advanced","model","select","choose","filter","azure openai","options","flow","openai","throughput","full",{"skillNo":181,"name":144,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":49},"01M699V9FXHBSWG3Y48057VAYZ","Discovers available Azure OpenAI model capacity across regions and projects. Analyzes quota limits, compares availability, and recommends optimal deployment locations based on capacity requirements. USE FOR: find capacity, check quota, where can I deploy, capacity discovery, best region for capacity, multi-project capacity search, quota analysis, model availability, region comparison, check TPM availability. DO NOT USE FOR: actual deployment (hand off to preset or customize after discovery), quota increase requests (direct user to Azure Portal), listing existing deployments.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmicrosoft-foundry\u002Fmodels\u002Fdeploy-model\u002Fcapacity\u002FSKILL.md",[],[144,136,117,9,145,186,170,187,188,189,190,191,155,174,192,193,177,194,195,35,147,122,196,148],"projects","project","search","analysis","listing","hand","limits","azure portal","direct","TPM","discovery",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":205,"publishedAt":49},"01M699V7GW2RF4AB3RE3Z8Y048","deploy-model","Unified Azure OpenAI model deployment skill with intelligent intent-based routing. Handles quick preset deployments, fully customized deployments (version\u002FSKU\u002Fcapacity\u002FRAI policy), and capacity discovery across regions and projects. USE FOR: deploy model, deploy gpt, create deployment, model deployment, deploy openai model, set up model, provision model, find capacity, check model availability, where can I deploy, best region for model, capacity analysis. DO NOT USE FOR: listing existing deployments (use foundry_models_deployments_list MCP tool), deleting deployments, agent creation (use agent\u002Fcreate), project creation (use project\u002Fcreate).","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmicrosoft-foundry\u002Fmodels\u002Fdeploy-model\u002FSKILL.md",[203,204],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[117,206,170,136,207,47,9,144,166,167,186,146,208,187,209,189,190,155,210,174,211,212,177,35,147],"deploy model","MCP","creation","up","create","intent","list",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":49},"01M699V3NA4YQKCHJTVWHBQH10","finetuning","Fine-tune models on Microsoft Foundry using SFT (supervised), DPO (preference), or RFT (reinforcement with graders). Covers dataset preparation, training job submission, deployment, and evaluation. USE FOR: fine-tune, SFT, DPO, RFT, training data, grader, distillation, fine-tuned model, training job, large file upload, calibrate grader, deploy fine-tuned model, evaluate fine-tuned model. DO NOT USE FOR: general model deployment without fine-tuning (use deploy-model), agent creation (use agents), prompt optimization without training (use prompt-optimizer).","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmicrosoft-foundry\u002Ffinetuning\u002FSKILL.md",[219],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[215,221,117,47,46,9,222,208,170,223,224,225,226,227,228,229,230,231,35,122,232,233,148,234],"placeholder","Prompt Optimization","training","dataset","optimizer","Evaluation","tuning","grader","data","supervised","distillation","Optimization","calibrate","submission"]