[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69B0BDGQFWR5BHHQATWSYA7":3,"skill-same:01M69B0BDGQFWR5BHHQATWSYA7":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":61,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M69B0BDGQFWR5BHHQATWSYA7","entra-agent-id",null,"Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).","microsoft\u002Fskills","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M69AJYYW4E1RMSYCQDJ4FJSH",3192,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fazure-skills\u002Fskills\u002Fentra-agent-id\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,9,48],"agent id","id","entra agent id","configure","tenant","path","agent authoring","app","authoring","token","microsoft graph","do","registration","Blueprint","sdk","federation","graph","agent identity","workload","entra app registration","identity","auth","microsoft foundry","foundry","web","2026-11-10 10:12:30",false,"---\nname: entra-agent-id\ndescription: \"Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).\"\nlicense: MIT\nmetadata:\n  author: Microsoft\n  version: \"1.1.1\"\n---\n\n# Microsoft Entra Agent ID\n\nCreate and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.\n\n## Quick Reference\n\n| Property | Value |\n|----------|-------|\n| Service | Microsoft Entra Agent ID |\n| API | Microsoft Graph (`https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`) |\n| Required role | Agent Identity Developer, Agent Identity Administrator, or Application Administrator |\n| Object model | Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) |\n| Runtime exchange | Two-step `fmi_path` exchange (autonomous and OBO) |\n| .NET helper | `Microsoft.Identity.Web.AgentIdentities` |\n| Polyglot helper | Microsoft Entra SDK for AgentID (sidecar container) |\n\n## When to Use This Skill\n\n- Provisioning a new Agent Identity Blueprint and BlueprintPrincipal\n- Creating per-instance Agent Identities under a Blueprint\n- Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint\n- Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO)\n- Cross-tenant agent token flows\n- Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)\n- Granting per-Agent-Identity application (`appRoleAssignments`) or delegated (`oauth2PermissionGrants`) permissions\n- Diagnosing Agent ID errors such as `AADSTS82001`, `AADSTS700211`, or `PropertyNotCompatibleWithAgentIdentity`\n\n## MCP Tools\n\n| Tool | Use |\n|------|-----|\n| `mcp_azure_mcp_documentation` | Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration |\n\nThere is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python `requests`). Use `mcp_azure_mcp_documentation` to verify request bodies and endpoints against current docs before running.\n\n## Before You Start\n\nUse the `mcp_azure_mcp_documentation` tool to search Microsoft Learn for current Agent ID documentation:\n- \"Microsoft Entra Agent ID setup instructions\"\n- \"Microsoft Entra SDK for AgentID\"\n\nVerify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.\n\n## Conceptual Model\n\n```\nAgent Identity Blueprint (application)         ← one per agent type\u002Fproject\n  └── BlueprintPrincipal (service principal)    ← MUST be created explicitly\n        ├── Agent Identity (SP): agent-1        ← one per agent instance\n        ├── Agent Identity (SP): agent-2\n        └── Agent Identity (SP): agent-3\n```\n\n| Concept | Description |\n|---------|-------------|\n| **Blueprint** | Application object that defines a type\u002Fclass of agent. Holds credentials (secret, certificate, federated identity). |\n| **BlueprintPrincipal** | Service principal for the Blueprint in the tenant. Not auto-created. |\n| **Agent Identity** | Service-principal-only identity for a single agent instance. Cannot hold its own credentials. |\n| **Sponsor** | A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation. |\n\n## Prerequisites\n\n### Required Entra Roles\n\nOne of: **Agent Identity Developer**, **Agent Identity Administrator**, or **Application Administrator**.\n\n### PowerShell (interactive setup)\n\n```powershell\n# PowerShell 7+\nInstall-Module Microsoft.Graph.Applications -Scope CurrentUser -Force\n```\n\n### Python (programmatic provisioning)\n\n```bash\npip install azure-identity requests\n```\n\n## Authentication\n\n> **`DefaultAzureCredential` is not supported.** Azure CLI tokens carry `Directory.AccessAsUser.All`, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with `client_credentials`, or `Connect-MgGraph` with explicit delegated scopes.\n\n### PowerShell (delegated)\n\n```powershell\nConnect-MgGraph -Scopes @(\n    \"AgentIdentityBlueprint.Create\",\n    \"AgentIdentityBlueprint.ReadWrite.All\",\n    \"AgentIdentityBlueprintPrincipal.Create\",\n    \"AgentIdentity.Create.All\",\n    \"User.Read\"\n)\n```\n\n### Python (application)\n\n```python\nimport os, requests\nfrom azure.identity import ClientSecretCredential\n\ncredential = ClientSecretCredential(\n    tenant_id=os.environ[\"AZURE_TENANT_ID\"],\n    client_id=os.environ[\"AZURE_CLIENT_ID\"],\n    client_secret=os.environ[\"AZURE_CLIENT_SECRET\"],\n)\ntoken = credential.get_token(\"https:\u002F\u002Fgraph.microsoft.com\u002F.default\")\n\nGRAPH = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\nheaders = {\n    \"Authorization\": f\"Bearer {token.token}\",\n    \"Content-Type\": \"application\u002Fjson\",\n    \"OData-Version\": \"4.0\",\n}\n```\n\n## Core Workflow\n\n### Step 1: Create Agent Identity Blueprint\n\nUse the typed endpoint. Sponsors must be **Users** at Blueprint creation. This snippet assumes the `requests` client and `headers` dict from the Python authentication block above.\n\n```python\nimport subprocess\nimport requests\n\nuser_id = subprocess.run(\n    [\"az\", \"ad\", \"signed-in-user\", \"show\", \"--query\", \"id\", \"-o\", \"tsv\"],\n    capture_output=True, text=True, check=True,\n).stdout.strip()\n\nblueprint_body = {\n    \"displayName\": \"My Agent Blueprint\",\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint\",\n    headers=headers, json=blueprint_body,\n)\nresp.raise_for_status()\n\nblueprint = resp.json()\napp_id = blueprint[\"appId\"]\nblueprint_obj_id = blueprint[\"id\"]\n```\n\n### Step 2: Create BlueprintPrincipal\n\n> Mandatory. Creating a Blueprint does NOT auto-create its service principal. Skipping this step produces:\n> `400: The Agent Blueprint Principal for the Agent Blueprint does not exist.`\n\n```python\nsp_body = {\"appId\": app_id}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal\",\n    headers=headers, json=sp_body,\n)\nresp.raise_for_status()\n```\n\nMake your provisioning scripts idempotent — always check for the BlueprintPrincipal even when the Blueprint already exists.\n\n### Step 3: Create Agent Identities\n\nSponsors for an Agent Identity may be **Users or Groups**.\n\n```python\nagent_body = {\n    \"displayName\": \"my-agent-instance-1\",\n    \"agentIdentityBlueprintId\": app_id,\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity\",\n    headers=headers, json=agent_body,\n)\nresp.raise_for_status()\nagent = resp.json()\nagent_sp_id = agent[\"id\"]\n```\n\n## Runtime Authentication\n\nAgents authenticate at runtime using credentials configured on the **Blueprint** (not on the Agent Identity — Agent Identities can't hold credentials).\n\n| Option | Use case | Credential on Blueprint |\n|--------|----------|------------------------|\n| **Managed Identity + WIF** | Production (Azure-hosted) | Federated Identity Credential |\n| **Client secret** | Local dev \u002F testing | Password credential |\n| **Microsoft Entra SDK for AgentID** | Polyglot \u002F 3P agents | Sidecar container acquires tokens over HTTP |\n\nFor the two-step `fmi_path` exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct `sub` claim and audit trail, see [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md).\n\nFor OBO (agent acting on behalf of a user), see [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md).\n\nFor the containerized polyglot auth sidecar (Python, Node, Go, Java — no SDK embedding), see [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md).\n\nFor MI+WIF and client-secret setup details, see [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md).\n\n### .NET quick path\n\nFor .NET services, use **`Microsoft.Identity.Web.AgentIdentities`** — it handles Federated Identity Credential management and the two-step exchange for you. See the package README at `github.com\u002FAzureAD\u002Fmicrosoft-identity-web` under `src\u002FMicrosoft.Identity.Web.AgentIdentities\u002F`.\n\n## Granting Permissions (Per Agent Identity)\n\nAgent Identities support both application permissions (autonomous) and delegated permissions (OBO). Grants are scoped **per Agent Identity**, not to the BlueprintPrincipal.\n\n### Application permissions (autonomous)\n\n```python\ngraph_sp = requests.get(\n    f\"{GRAPH}\u002FservicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'\",\n    headers=headers,\n).json()[\"value\"][0]\n\nuser_read_all = next(r for r in graph_sp[\"appRoles\"] if r[\"value\"] == \"User.Read.All\")\n\nrequests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002F{agent_sp_id}\u002FappRoleAssignments\",\n    headers=headers,\n    json={\n        \"principalId\": agent_sp_id,\n        \"resourceId\": graph_sp[\"id\"],\n        \"appRoleId\": user_read_all[\"id\"],\n    },\n).raise_for_status()\n```\n\n### Delegated permissions (OBO)\n\n```python\nfrom datetime import datetime, timedelta, timezone\n\nexpiry = (datetime.now(timezone.utc) + timedelta(days=3650)).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n\nrequests.post(\n    f\"{GRAPH}\u002Foauth2PermissionGrants\",\n    headers=headers,\n    json={\n        \"clientId\": agent_sp_id,\n        \"consentType\": \"AllPrincipals\",\n        \"resourceId\": graph_sp[\"id\"],\n        \"scope\": \"User.Read Tasks.ReadWrite Mail.Send\",\n        \"expiryTime\": expiry,\n    },\n).raise_for_status()\n```\n\nBrowser-based admin consent URLs do not work for Agent Identities — use `oauth2PermissionGrants` for programmatic delegated consent.\n\n## Cross-Tenant Agent Identities\n\nBlueprints can be multi-tenant (`signInAudience: AzureADMultipleOrgs`). When exchanging tokens cross-tenant:\n\n> **Step 1 of the parent token exchange MUST target the Agent Identity's home tenant**, not the Blueprint's. Wrong tenant → `AADSTS700211: No matching federated identity record found`.\n\nSee [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) for full cross-tenant examples.\n\n## API Reference\n\n| Operation | Method | Endpoint |\n|-----------|--------|----------|\n| Create Blueprint | `POST` | `\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint` |\n| Create BlueprintPrincipal | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal` |\n| Create Agent Identity | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Add FIC to Blueprint | `POST` | `\u002Fapplications\u002F{id}\u002Fmicrosoft.graph.agentIdentityBlueprint\u002FfederatedIdentityCredentials` |\n| List Agent Identities | `GET` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Grant app permission | `POST` | `\u002FservicePrincipals\u002F{id}\u002FappRoleAssignments` |\n| Grant delegated permission | `POST` | `\u002Foauth2PermissionGrants` |\n| Delete Agent Identity | `DELETE` | `\u002FservicePrincipals\u002F{id}` |\n| Delete Blueprint | `DELETE` | `\u002Fapplications\u002F{id}` |\n\nBase URL: `https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`.\n\n## Required Graph Permissions\n\n| Permission | Purpose |\n|-----------|---------|\n| `AgentIdentityBlueprint.Create` | Create Blueprints |\n| `AgentIdentityBlueprint.ReadWrite.All` | Read\u002Fupdate Blueprints |\n| `AgentIdentityBlueprintPrincipal.Create` | Create BlueprintPrincipals |\n| `AgentIdentity.Create.All` | Create Agent Identities |\n| `AgentIdentity.ReadWrite.All` | Read\u002Fupdate Agent Identities |\n| `Application.ReadWrite.All` | Blueprint CRUD on application objects |\n| `AppRoleAssignment.ReadWrite.All` | Grant application permissions |\n| `DelegatedPermissionGrant.ReadWrite.All` | Grant delegated permissions |\n\nGrant admin consent (required for application permissions):\n\n```bash\naz ad app permission admin-consent --id \u003Cclient-id>\n```\n\nAfter admin consent, tokens may not include new claims for 30–120 seconds — retry with exponential backoff.\n\n## Best Practices\n\n1. **Always create BlueprintPrincipal after Blueprint** — not auto-created.\n2. **Use typed endpoints** (`\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint`) instead of raw `\u002Fapplications` with `@odata.type`.\n3. **Credentials live on the Blueprint** — Agent Identities can't hold secrets\u002Fcerts (`PropertyNotCompatibleWithAgentIdentity`).\n4. **Include `OData-Version: 4.0`** on every Graph request.\n5. **Use Workload Identity Federation for production** — client secrets only for local dev.\n6. **Set `identifierUris: [\"api:\u002F\u002F{appId}\"]` on the Blueprint** before OAuth2 scope resolution.\n7. **Never use Azure CLI tokens** for Agent Identity APIs — `Directory.AccessAsUser.All` causes hard 403.\n8. **Use `fmi_path`** with `client_credentials` — NOT RFC 8693 `urn:ietf:params:oauth:grant-type:token-exchange` (returns `AADSTS82001`).\n9. **Always use `\u002F.default` scope** in both steps of the exchange — individual scopes fail.\n10. **Step 1 targets the Agent Identity's home tenant** in cross-tenant flows.\n11. **Grant permissions per Agent Identity**, not to the BlueprintPrincipal.\n12. **Handle permission-propagation delays** — retry 403s with 30–120s backoff after admin consent.\n13. **Keep the Entra SDK for AgentID on localhost** — never expose via LoadBalancer or Ingress.\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n|-------|-------|-----|\n| `AADSTS82001` | Used RFC 8693 token-exchange grant | Use `client_credentials` with `fmi_path` |\n| `AADSTS700211` | Step 1 parent token targeted wrong tenant | Target Agent Identity's home tenant |\n| `AADSTS50013` | OBO user token targets Graph, not Blueprint | Use `api:\u002F\u002F{blueprint_app_id}\u002Faccess_as_user` |\n| `AADSTS65001` | Missing grant or used individual scopes | Use `\u002F.default` and verify `oauth2PermissionGrants` |\n| `403 Authorization_RequestDenied` | No grant on this Agent Identity | Add via `appRoleAssignments` or `oauth2PermissionGrants` |\n| `PropertyNotCompatibleWithAgentIdentity` | Tried to add credential to Agent Identity SP | Put credentials on the Blueprint |\n| `Agent Blueprint Principal does not exist` | BlueprintPrincipal not created | Step 2 of the Core Workflow |\n| `AADSTS650051` on admin consent | SP already exists from partial consent | Grant directly via `appRoleAssignments` |\n\n## References\n\n| File | Contents |\n|------|----------|\n| [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) | Two-step `fmi_path` exchange: autonomous + OBO, cross-tenant |\n| [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md) | MI + WIF (production) and client secret (local dev) |\n| [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md) | Configuring the Blueprint as an OAuth2 API for OBO |\n| [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md) | Microsoft Entra SDK for AgentID — architecture, configuration, endpoints |\n| [references\u002Fsdk-sidecar-deployment.md](references\u002Fsdk-sidecar-deployment.md) | SDK code patterns (Python\u002FTypeScript), Docker\u002FKubernetes manifests, security, troubleshooting |\n| [references\u002Fknown-limitations.md](references\u002Fknown-limitations.md) | Documented gaps organized by category |\n\n### External Links\n\n| Resource | URL |\n|----------|-----|\n| Agent ID Setup Guide | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-setup-instructions |\n| AI-Guided Setup | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-ai-guided-setup |\n| Microsoft Entra SDK for AgentID | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fmsidweb\u002Fagent-id-sdk\u002Foverview |\n| Microsoft.Identity.Web.AgentIdentities (.NET) | https:\u002F\u002Fgithub.com\u002FAzureAD\u002Fmicrosoft-identity-web\u002Fblob\u002Fmaster\u002Fsrc\u002FMicrosoft.Identity.Web.AgentIdentities\u002FREADME.AgentIdentities.md |\n","# Microsoft Entra Agent ID\n\nCreate and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.\n\n## Quick Reference\n\n| Property | Value |\n|----------|-------|\n| Service | Microsoft Entra Agent ID |\n| API | Microsoft Graph (`https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`) |\n| Required role | Agent Identity Developer, Agent Identity Administrator, or Application Administrator |\n| Object model | Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) |\n| Runtime exchange | Two-step `fmi_path` exchange (autonomous and OBO) |\n| .NET helper | `Microsoft.Identity.Web.AgentIdentities` |\n| Polyglot helper | Microsoft Entra SDK for AgentID (sidecar container) |\n\n## When to Use This Skill\n\n- Provisioning a new Agent Identity Blueprint and BlueprintPrincipal\n- Creating per-instance Agent Identities under a Blueprint\n- Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint\n- Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO)\n- Cross-tenant agent token flows\n- Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)\n- Granting per-Agent-Identity application (`appRoleAssignments`) or delegated (`oauth2PermissionGrants`) permissions\n- Diagnosing Agent ID errors such as `AADSTS82001`, `AADSTS700211`, or `PropertyNotCompatibleWithAgentIdentity`\n\n## MCP Tools\n\n| Tool | Use |\n|------|-----|\n| `mcp_azure_mcp_documentation` | Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration |\n\nThere is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python `requests`). Use `mcp_azure_mcp_documentation` to verify request bodies and endpoints against current docs before running.\n\n## Before You Start\n\nUse the `mcp_azure_mcp_documentation` tool to search Microsoft Learn for current Agent ID documentation:\n- \"Microsoft Entra Agent ID setup instructions\"\n- \"Microsoft Entra SDK for AgentID\"\n\nVerify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.\n\n## Conceptual Model\n\n```\nAgent Identity Blueprint (application)         ← one per agent type\u002Fproject\n  └── BlueprintPrincipal (service principal)    ← MUST be created explicitly\n        ├── Agent Identity (SP): agent-1        ← one per agent instance\n        ├── Agent Identity (SP): agent-2\n        └── Agent Identity (SP): agent-3\n```\n\n| Concept | Description |\n|---------|-------------|\n| **Blueprint** | Application object that defines a type\u002Fclass of agent. Holds credentials (secret, certificate, federated identity). |\n| **BlueprintPrincipal** | Service principal for the Blueprint in the tenant. Not auto-created. |\n| **Agent Identity** | Service-principal-only identity for a single agent instance. Cannot hold its own credentials. |\n| **Sponsor** | A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation. |\n\n## Prerequisites\n\n### Required Entra Roles\n\nOne of: **Agent Identity Developer**, **Agent Identity Administrator**, or **Application Administrator**.\n\n### PowerShell (interactive setup)\n\n```powershell\n# PowerShell 7+\nInstall-Module Microsoft.Graph.Applications -Scope CurrentUser -Force\n```\n\n### Python (programmatic provisioning)\n\n```bash\npip install azure-identity requests\n```\n\n## Authentication\n\n> **`DefaultAzureCredential` is not supported.** Azure CLI tokens carry `Directory.AccessAsUser.All`, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with `client_credentials`, or `Connect-MgGraph` with explicit delegated scopes.\n\n### PowerShell (delegated)\n\n```powershell\nConnect-MgGraph -Scopes @(\n    \"AgentIdentityBlueprint.Create\",\n    \"AgentIdentityBlueprint.ReadWrite.All\",\n    \"AgentIdentityBlueprintPrincipal.Create\",\n    \"AgentIdentity.Create.All\",\n    \"User.Read\"\n)\n```\n\n### Python (application)\n\n```python\nimport os, requests\nfrom azure.identity import ClientSecretCredential\n\ncredential = ClientSecretCredential(\n    tenant_id=os.environ[\"AZURE_TENANT_ID\"],\n    client_id=os.environ[\"AZURE_CLIENT_ID\"],\n    client_secret=os.environ[\"AZURE_CLIENT_SECRET\"],\n)\ntoken = credential.get_token(\"https:\u002F\u002Fgraph.microsoft.com\u002F.default\")\n\nGRAPH = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\nheaders = {\n    \"Authorization\": f\"Bearer {token.token}\",\n    \"Content-Type\": \"application\u002Fjson\",\n    \"OData-Version\": \"4.0\",\n}\n```\n\n## Core Workflow\n\n### Step 1: Create Agent Identity Blueprint\n\nUse the typed endpoint. Sponsors must be **Users** at Blueprint creation. This snippet assumes the `requests` client and `headers` dict from the Python authentication block above.\n\n```python\nimport subprocess\nimport requests\n\nuser_id = subprocess.run(\n    [\"az\", \"ad\", \"signed-in-user\", \"show\", \"--query\", \"id\", \"-o\", \"tsv\"],\n    capture_output=True, text=True, check=True,\n).stdout.strip()\n\nblueprint_body = {\n    \"displayName\": \"My Agent Blueprint\",\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint\",\n    headers=headers, json=blueprint_body,\n)\nresp.raise_for_status()\n\nblueprint = resp.json()\napp_id = blueprint[\"appId\"]\nblueprint_obj_id = blueprint[\"id\"]\n```\n\n### Step 2: Create BlueprintPrincipal\n\n> Mandatory. Creating a Blueprint does NOT auto-create its service principal. Skipping this step produces:\n> `400: The Agent Blueprint Principal for the Agent Blueprint does not exist.`\n\n```python\nsp_body = {\"appId\": app_id}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal\",\n    headers=headers, json=sp_body,\n)\nresp.raise_for_status()\n```\n\nMake your provisioning scripts idempotent — always check for the BlueprintPrincipal even when the Blueprint already exists.\n\n### Step 3: Create Agent Identities\n\nSponsors for an Agent Identity may be **Users or Groups**.\n\n```python\nagent_body = {\n    \"displayName\": \"my-agent-instance-1\",\n    \"agentIdentityBlueprintId\": app_id,\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity\",\n    headers=headers, json=agent_body,\n)\nresp.raise_for_status()\nagent = resp.json()\nagent_sp_id = agent[\"id\"]\n```\n\n## Runtime Authentication\n\nAgents authenticate at runtime using credentials configured on the **Blueprint** (not on the Agent Identity — Agent Identities can't hold credentials).\n\n| Option | Use case | Credential on Blueprint |\n|--------|----------|------------------------|\n| **Managed Identity + WIF** | Production (Azure-hosted) | Federated Identity Credential |\n| **Client secret** | Local dev \u002F testing | Password credential |\n| **Microsoft Entra SDK for AgentID** | Polyglot \u002F 3P agents | Sidecar container acquires tokens over HTTP |\n\nFor the two-step `fmi_path` exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct `sub` claim and audit trail, see [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md).\n\nFor OBO (agent acting on behalf of a user), see [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md).\n\nFor the containerized polyglot auth sidecar (Python, Node, Go, Java — no SDK embedding), see [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md).\n\nFor MI+WIF and client-secret setup details, see [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md).\n\n### .NET quick path\n\nFor .NET services, use **`Microsoft.Identity.Web.AgentIdentities`** — it handles Federated Identity Credential management and the two-step exchange for you. See the package README at `github.com\u002FAzureAD\u002Fmicrosoft-identity-web` under `src\u002FMicrosoft.Identity.Web.AgentIdentities\u002F`.\n\n## Granting Permissions (Per Agent Identity)\n\nAgent Identities support both application permissions (autonomous) and delegated permissions (OBO). Grants are scoped **per Agent Identity**, not to the BlueprintPrincipal.\n\n### Application permissions (autonomous)\n\n```python\ngraph_sp = requests.get(\n    f\"{GRAPH}\u002FservicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'\",\n    headers=headers,\n).json()[\"value\"][0]\n\nuser_read_all = next(r for r in graph_sp[\"appRoles\"] if r[\"value\"] == \"User.Read.All\")\n\nrequests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002F{agent_sp_id}\u002FappRoleAssignments\",\n    headers=headers,\n    json={\n        \"principalId\": agent_sp_id,\n        \"resourceId\": graph_sp[\"id\"],\n        \"appRoleId\": user_read_all[\"id\"],\n    },\n).raise_for_status()\n```\n\n### Delegated permissions (OBO)\n\n```python\nfrom datetime import datetime, timedelta, timezone\n\nexpiry = (datetime.now(timezone.utc) + timedelta(days=3650)).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n\nrequests.post(\n    f\"{GRAPH}\u002Foauth2PermissionGrants\",\n    headers=headers,\n    json={\n        \"clientId\": agent_sp_id,\n        \"consentType\": \"AllPrincipals\",\n        \"resourceId\": graph_sp[\"id\"],\n        \"scope\": \"User.Read Tasks.ReadWrite Mail.Send\",\n        \"expiryTime\": expiry,\n    },\n).raise_for_status()\n```\n\nBrowser-based admin consent URLs do not work for Agent Identities — use `oauth2PermissionGrants` for programmatic delegated consent.\n\n## Cross-Tenant Agent Identities\n\nBlueprints can be multi-tenant (`signInAudience: AzureADMultipleOrgs`). When exchanging tokens cross-tenant:\n\n> **Step 1 of the parent token exchange MUST target the Agent Identity's home tenant**, not the Blueprint's. Wrong tenant → `AADSTS700211: No matching federated identity record found`.\n\nSee [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) for full cross-tenant examples.\n\n## API Reference\n\n| Operation | Method | Endpoint |\n|-----------|--------|----------|\n| Create Blueprint | `POST` | `\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint` |\n| Create BlueprintPrincipal | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal` |\n| Create Agent Identity | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Add FIC to Blueprint | `POST` | `\u002Fapplications\u002F{id}\u002Fmicrosoft.graph.agentIdentityBlueprint\u002FfederatedIdentityCredentials` |\n| List Agent Identities | `GET` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Grant app permission | `POST` | `\u002FservicePrincipals\u002F{id}\u002FappRoleAssignments` |\n| Grant delegated permission | `POST` | `\u002Foauth2PermissionGrants` |\n| Delete Agent Identity | `DELETE` | `\u002FservicePrincipals\u002F{id}` |\n| Delete Blueprint | `DELETE` | `\u002Fapplications\u002F{id}` |\n\nBase URL: `https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`.\n\n## Required Graph Permissions\n\n| Permission | Purpose |\n|-----------|---------|\n| `AgentIdentityBlueprint.Create` | Create Blueprints |\n| `AgentIdentityBlueprint.ReadWrite.All` | Read\u002Fupdate Blueprints |\n| `AgentIdentityBlueprintPrincipal.Create` | Create BlueprintPrincipals |\n| `AgentIdentity.Create.All` | Create Agent Identities |\n| `AgentIdentity.ReadWrite.All` | Read\u002Fupdate Agent Identities |\n| `Application.ReadWrite.All` | Blueprint CRUD on application objects |\n| `AppRoleAssignment.ReadWrite.All` | Grant application permissions |\n| `DelegatedPermissionGrant.ReadWrite.All` | Grant delegated permissions |\n\nGrant admin consent (required for application permissions):\n\n```bash\naz ad app permission admin-consent --id \u003Cclient-id>\n```\n\nAfter admin consent, tokens may not include new claims for 30–120 seconds — retry with exponential backoff.\n\n## Best Practices\n\n1. **Always create BlueprintPrincipal after Blueprint** — not auto-created.\n2. **Use typed endpoints** (`\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint`) instead of raw `\u002Fapplications` with `@odata.type`.\n3. **Credentials live on the Blueprint** — Agent Identities can't hold secrets\u002Fcerts (`PropertyNotCompatibleWithAgentIdentity`).\n4. **Include `OData-Version: 4.0`** on every Graph request.\n5. **Use Workload Identity Federation for production** — client secrets only for local dev.\n6. **Set `identifierUris: [\"api:\u002F\u002F{appId}\"]` on the Blueprint** before OAuth2 scope resolution.\n7. **Never use Azure CLI tokens** for Agent Identity APIs — `Directory.AccessAsUser.All` causes hard 403.\n8. **Use `fmi_path`** with `client_credentials` — NOT RFC 8693 `urn:ietf:params:oauth:grant-type:token-exchange` (returns `AADSTS82001`).\n9. **Always use `\u002F.default` scope** in both steps of the exchange — individual scopes fail.\n10. **Step 1 targets the Agent Identity's home tenant** in cross-tenant flows.\n11. **Grant permissions per Agent Identity**, not to the BlueprintPrincipal.\n12. **Handle permission-propagation delays** — retry 403s with 30–120s backoff after admin consent.\n13. **Keep the Entra SDK for AgentID on localhost** — never expose via LoadBalancer or Ingress.\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n|-------|-------|-----|\n| `AADSTS82001` | Used RFC 8693 token-exchange grant | Use `client_credentials` with `fmi_path` |\n| `AADSTS700211` | Step 1 parent token targeted wrong tenant | Target Agent Identity's home tenant |\n| `AADSTS50013` | OBO user token targets Graph, not Blueprint | Use `api:\u002F\u002F{blueprint_app_id}\u002Faccess_as_user` |\n| `AADSTS65001` | Missing grant or used individual scopes | Use `\u002F.default` and verify `oauth2PermissionGrants` |\n| `403 Authorization_RequestDenied` | No grant on this Agent Identity | Add via `appRoleAssignments` or `oauth2PermissionGrants` |\n| `PropertyNotCompatibleWithAgentIdentity` | Tried to add credential to Agent Identity SP | Put credentials on the Blueprint |\n| `Agent Blueprint Principal does not exist` | BlueprintPrincipal not created | Step 2 of the Core Workflow |\n| `AADSTS650051` on admin consent | SP already exists from partial consent | Grant directly via `appRoleAssignments` |\n\n## References\n\n| File | Contents |\n|------|----------|\n| [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) | Two-step `fmi_path` exchange: autonomous + OBO, cross-tenant |\n| [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md) | MI + WIF (production) and client secret (local dev) |\n| [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md) | Configuring the Blueprint as an OAuth2 API for OBO |\n| [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md) | Microsoft Entra SDK for AgentID — architecture, configuration, endpoints |\n| [references\u002Fsdk-sidecar-deployment.md](references\u002Fsdk-sidecar-deployment.md) | SDK code patterns (Python\u002FTypeScript), Docker\u002FKubernetes manifests, security, troubleshooting |\n| [references\u002Fknown-limitations.md](references\u002Fknown-limitations.md) | Documented gaps organized by category |\n\n### External Links\n\n| Resource | URL |\n|----------|-----|\n| Agent ID Setup Guide | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-setup-instructions |\n| AI-Guided Setup | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-ai-guided-setup |\n| Microsoft Entra SDK for AgentID | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fmsidweb\u002Fagent-id-sdk\u002Foverview |\n| Microsoft.Identity.Web.AgentIdentities (.NET) | https:\u002F\u002Fgithub.com\u002FAzureAD\u002Fmicrosoft-identity-web\u002Fblob\u002Fmaster\u002Fsrc\u002FMicrosoft.Identity.Web.AgentIdentities\u002FREADME.AgentIdentities.md |\n",{"name":5,"license":15,"metadata":54,"description":7},{"author":12,"version":55},"1.1.1","main","3f5b461b2314e01c400564051e92469114c5b68f",".github\u002Fplugins\u002Fazure-skills\u002Fskills\u002Fentra-agent-id",364,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills","https:\u002F\u002Fmicrosoft.github.io\u002Fskills\u002F","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-11 02:03:22",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add microsoft\u002Fskills --skill entra-agent-id",{"tool":72,"command":73},"bunx","bunx skills add microsoft\u002Fskills --skill entra-agent-id",{"tool":75,"command":76},"pnpm","pnpm dlx skills add microsoft\u002Fskills --skill entra-agent-id","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fazure-skills\u002Fskills\u002Fentra-agent-id\u002FSKILL.md",true,[80,86,90,94,98,102,106,110],{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"agents\u002Fopenai.yaml","REFERENCE","参考文档",293,"https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002Fplugins\u002Fcodex-security\u002Fskills\u002Fpropose-security-hardening\u002Fagents\u002Fopenai.yaml",{"path":87,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fknown-limitations.md",4754,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fazure-skills\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Fknown-limitations.md",{"path":91,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Foauth2-token-flow.md",4507,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fazure-skills\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Foauth2-token-flow.md",{"path":95,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fobo-blueprint-setup.md",4235,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fazure-skills\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Fobo-blueprint-setup.md",{"path":99,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fproposal-format.md",4144,"https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002Fplugins\u002Fcodex-security\u002Fskills\u002Fpropose-security-hardening\u002Freferences\u002Fproposal-format.md",{"path":103,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fruntime-token-exchange.md",6746,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fazure-skills\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Fruntime-token-exchange.md",{"path":107,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fsdk-sidecar-deployment.md",6276,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fazure-skills\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Fsdk-sidecar-deployment.md",{"path":111,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fsdk-sidecar.md",6107,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fazure-skills\u002Fskills\u002Fentra-agent-id\u002Freferences\u002Fsdk-sidecar.md",[115,139,177,204,224,262],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":49},"01M69B4JCRQV5SPXAFCKXQRV0H","skill-creator","Guide for creating effective skills for AI coding agents working with Azure SDKs and Microsoft Foundry services. Use when creating new skills or updating existing skills.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fskill-creator\u002FSKILL.md",[121],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[123,124,125,9,47,46,126,127,128,129,130,131,132,133,134,135,136,137,138],"skill creator","creator","coding agents","ai coding agents","azure","services","coding","guide","use","ai coding","with","sdks","for","Existing","when","new",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":155,"publishedAt":49},"01M69B4FD57V1MYKRWAJJECTZ7","podcast-generation","Generate AI-powered podcast-style audio narratives using Azure OpenAI's GPT Realtime Mini model via WebSocket. Use when building text-to-speech features, audio narrative generation, podcast creation from content, or integrating with Azure OpenAI Realtime API for real audio output. Covers full-stack implementation from React frontend to Python FastAPI backend with WebSocket streaming.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpodcast-generation\u002FSKILL.md",[145,148,151,154],{"categoryNo":146,"categoryName":147,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[156,157,158,159,160,161,162,127,163,164,165,166,167,168,169,170,171,172,173,174,175,137,176],"podcast generation","podcast","generation","frontend","python","react","realtime","azure openai","generate","streaming","api","Audio","stack","text","model","fastapi","creation","python fastapi","narrative","features","fastapi backend",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":184,"publishedAt":49},"01M69B4CYPM5SESY5ZWEFDXEQZ","microsoft-docs","Understand Microsoft technologies by querying official documentation. Use whenever the user asks how something works, wants tutorials, needs configuration options, limits, quotas, or best practices for any Microsoft technology (Azure, .NET, M365, Windows, Power Platform, etc.)—even if they don't mention \"docs.\" If the question is about understanding a concept rather than writing code, this is the right skill.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fmicrosoft-docs\u002FSKILL.md",[183],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[185,9,186,187,188,189,190,191,192,193,194,127,195,196,197,131,198,69,199,200,201,202,203,135],"docs","microsoft docs","MCP","writing","cli","mcp server","windows","power platform","official","documentation","learn","best practices","question","power","back","technology","platform","learn mcp","concept",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":49},"01M69B49C3YPD1ZJ3NC0HPCY58","mcp-builder","Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP), Node\u002FTypeScript (MCP SDK), or C#\u002F.NET (Microsoft MCP SDK).","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fmcp-builder\u002FSKILL.md",[210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[187,212,213,214,160,215,38,216,9,217,218,170,219,220,130,131,221,222,223,133,135,137],"mcp builder","builder","typescript","llms","model context protocol","fastmcp","Tools","node","context","integrate","mcp sdk","building mcp servers",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":242,"publishedAt":49},"01M69B467A7CDMFQ0T6Q0ZA12Q","kql","KQL language expertise for writing correct, efficient Kusto Query Language queries. Covers syntax gotchas, join patterns, dynamic types, datetime pitfalls, regex patterns, serialization, memory management, result-size discipline, and advanced functions (geo, vector, graph). USE THIS SKILL whenever writing, debugging, or reviewing KQL queries — even simple ones — because the gotchas section prevents the most common errors that waste tool calls and cause expensive retry cascades. Trigger on: KQL, Kusto, ADX, Azure Data Explorer, Fabric Real-Time Intelligence, EventHouse, Log Analytics, log analysis, data exploration, time series, anomaly detection, summarize, where clause, join, extend, project, let statement, parse operator, extract function, any mention of pipe-forward query syntax.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fkql\u002FSKILL.md",[230,233,234,239],{"categoryNo":231,"categoryName":232,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":235,"categoryName":236,"taxonomyType":237,"taxonomyTypeDesc":238},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":240,"categoryName":241,"taxonomyType":237,"taxonomyTypeDesc":238},"01JBSEEDCAT000000000000036","内容创作者",[226,188,243,244,245,127,246,247,248,249,250,251,252,253,254,255,256,257,258,135,259,260,261],"summarize","memory","analytics","vector","time series","tool","discipline","log","geo","exploration","pipe","time","project","regex","join","datetime","section","anomaly","parse",{"skillNo":263,"name":264,"nameZh":6,"description":265,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":266,"categories":267,"keywords":268,"publishedAt":49},"01M69B44HJQ7897EZ7NE7DWQX3","github-issue-creator","Convert raw notes, error logs, voice dictation, or screenshots into crisp GitHub-flavored markdown issue reports. Use when the user pastes bug info, error messages, or informal descriptions and wants a structured GitHub issue. Supports images\u002FGIFs for visual evidence.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fgithub-issue-creator\u002FSKILL.md",[],[269,270,271,272,124,273,274,275,276,277,278,279,131,280,281,282,283,284,285,135,137],"github","github issue creator","github issue","issue","issue creator","screenshots","notes","logs","error messages","messages","convert","evidence","reports","images","info","visual","error"]