[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73F15Z2GDQJS94868M7PEEY":3,"skill-same:01M73F15Z2GDQJS94868M7PEEY":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":33,"ownerDescription":6,"updatedAt":34,"install":35,"resources":48},"01M73F15Z2GDQJS94868M7PEEY","entra-agent-id",null,"Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Azure RBAC (use azure-rbac), Microsoft Foundry agent authoring (use microsoft-foundry).","qhjqhj00\u002Fresearch-skills-pool","qhjqhj00","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F29684092?v=4","01M72AE0ZGXVM5C57N512DGQG8","Tommy Chien","01M72AE107ESJMHT7QC5SXX144",3,"MIT","https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Fskills_collected\u002Fmicrosoft--skills--.github__plugins__azure-skills__skills__entra-agent-id\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: entra-agent-id\ndescription: \"Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Azure RBAC (use azure-rbac), Microsoft Foundry agent authoring (use microsoft-foundry).\"\nlicense: MIT\nmetadata:\n  author: Microsoft\n  version: \"1.0.1\"\n---\n\n# Microsoft Entra Agent ID\n\nCreate and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.\n\n## Quick Reference\n\n| Property | Value |\n|----------|-------|\n| Service | Microsoft Entra Agent ID |\n| API | Microsoft Graph (`https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`) |\n| Required role | Agent Identity Developer, Agent Identity Administrator, or Application Administrator |\n| Object model | Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) |\n| Runtime exchange | Two-step `fmi_path` exchange (autonomous and OBO) |\n| .NET helper | `Microsoft.Identity.Web.AgentIdentities` |\n| Polyglot helper | Microsoft Entra SDK for AgentID (sidecar container) |\n\n## When to Use This Skill\n\n- Provisioning a new Agent Identity Blueprint and BlueprintPrincipal\n- Creating per-instance Agent Identities under a Blueprint\n- Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint\n- Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO)\n- Cross-tenant agent token flows\n- Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)\n- Granting per-Agent-Identity application (`appRoleAssignments`) or delegated (`oauth2PermissionGrants`) permissions\n- Diagnosing Agent ID errors such as `AADSTS82001`, `AADSTS700211`, or `PropertyNotCompatibleWithAgentIdentity`\n\n## MCP Tools\n\n| Tool | Use |\n|------|-----|\n| `mcp_azure_mcp_documentation` | Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration |\n\nThere is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python `requests`). Use `mcp_azure_mcp_documentation` to verify request bodies and endpoints against current docs before running.\n\n## Before You Start\n\nUse the `mcp_azure_mcp_documentation` tool to search Microsoft Learn for current Agent ID documentation:\n- \"Microsoft Entra Agent ID setup instructions\"\n- \"Microsoft Entra SDK for AgentID\"\n\nVerify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.\n\n## Conceptual Model\n\n```\nAgent Identity Blueprint (application)         ← one per agent type\u002Fproject\n  └── BlueprintPrincipal (service principal)    ← MUST be created explicitly\n        ├── Agent Identity (SP): agent-1        ← one per agent instance\n        ├── Agent Identity (SP): agent-2\n        └── Agent Identity (SP): agent-3\n```\n\n| Concept | Description |\n|---------|-------------|\n| **Blueprint** | Application object that defines a type\u002Fclass of agent. Holds credentials (secret, certificate, federated identity). |\n| **BlueprintPrincipal** | Service principal for the Blueprint in the tenant. Not auto-created. |\n| **Agent Identity** | Service-principal-only identity for a single agent instance. Cannot hold its own credentials. |\n| **Sponsor** | A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation. |\n\n## Prerequisites\n\n### Required Entra Roles\n\nOne of: **Agent Identity Developer**, **Agent Identity Administrator**, or **Application Administrator**.\n\n### PowerShell (interactive setup)\n\n```powershell\n# PowerShell 7+\nInstall-Module Microsoft.Graph.Applications -Scope CurrentUser -Force\n```\n\n### Python (programmatic provisioning)\n\n```bash\npip install azure-identity requests\n```\n\n## Authentication\n\n> **`DefaultAzureCredential` is not supported.** Azure CLI tokens carry `Directory.AccessAsUser.All`, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with `client_credentials`, or `Connect-MgGraph` with explicit delegated scopes.\n\n### PowerShell (delegated)\n\n```powershell\nConnect-MgGraph -Scopes @(\n    \"AgentIdentityBlueprint.Create\",\n    \"AgentIdentityBlueprint.ReadWrite.All\",\n    \"AgentIdentityBlueprintPrincipal.Create\",\n    \"AgentIdentity.Create.All\",\n    \"User.Read\"\n)\n```\n\n### Python (application)\n\n```python\nimport os, requests\nfrom azure.identity import ClientSecretCredential\n\ncredential = ClientSecretCredential(\n    tenant_id=os.environ[\"AZURE_TENANT_ID\"],\n    client_id=os.environ[\"AZURE_CLIENT_ID\"],\n    client_secret=os.environ[\"AZURE_CLIENT_SECRET\"],\n)\ntoken = credential.get_token(\"https:\u002F\u002Fgraph.microsoft.com\u002F.default\")\n\nGRAPH = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\nheaders = {\n    \"Authorization\": f\"Bearer {token.token}\",\n    \"Content-Type\": \"application\u002Fjson\",\n    \"OData-Version\": \"4.0\",\n}\n```\n\n## Core Workflow\n\n### Step 1: Create Agent Identity Blueprint\n\nUse the typed endpoint. Sponsors must be **Users** at Blueprint creation. This snippet assumes the `requests` client and `headers` dict from the Python authentication block above.\n\n```python\nimport subprocess\nimport requests\n\nuser_id = subprocess.run(\n    [\"az\", \"ad\", \"signed-in-user\", \"show\", \"--query\", \"id\", \"-o\", \"tsv\"],\n    capture_output=True, text=True, check=True,\n).stdout.strip()\n\nblueprint_body = {\n    \"displayName\": \"My Agent Blueprint\",\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint\",\n    headers=headers, json=blueprint_body,\n)\nresp.raise_for_status()\n\nblueprint = resp.json()\napp_id = blueprint[\"appId\"]\nblueprint_obj_id = blueprint[\"id\"]\n```\n\n### Step 2: Create BlueprintPrincipal\n\n> Mandatory. Creating a Blueprint does NOT auto-create its service principal. Skipping this step produces:\n> `400: The Agent Blueprint Principal for the Agent Blueprint does not exist.`\n\n```python\nsp_body = {\"appId\": app_id}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal\",\n    headers=headers, json=sp_body,\n)\nresp.raise_for_status()\n```\n\nMake your provisioning scripts idempotent — always check for the BlueprintPrincipal even when the Blueprint already exists.\n\n### Step 3: Create Agent Identities\n\nSponsors for an Agent Identity may be **Users or Groups**.\n\n```python\nagent_body = {\n    \"displayName\": \"my-agent-instance-1\",\n    \"agentIdentityBlueprintId\": app_id,\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity\",\n    headers=headers, json=agent_body,\n)\nresp.raise_for_status()\nagent = resp.json()\nagent_sp_id = agent[\"id\"]\n```\n\n## Runtime Authentication\n\nAgents authenticate at runtime using credentials configured on the **Blueprint** (not on the Agent Identity — Agent Identities can't hold credentials).\n\n| Option | Use case | Credential on Blueprint |\n|--------|----------|------------------------|\n| **Managed Identity + WIF** | Production (Azure-hosted) | Federated Identity Credential |\n| **Client secret** | Local dev \u002F testing | Password credential |\n| **Microsoft Entra SDK for AgentID** | Polyglot \u002F 3P agents | Sidecar container acquires tokens over HTTP |\n\nFor the two-step `fmi_path` exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct `sub` claim and audit trail, see [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md).\n\nFor OBO (agent acting on behalf of a user), see [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md).\n\nFor the containerized polyglot auth sidecar (Python, Node, Go, Java — no SDK embedding), see [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md).\n\nFor MI+WIF and client-secret setup details, see [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md).\n\n### .NET quick path\n\nFor .NET services, use **`Microsoft.Identity.Web.AgentIdentities`** — it handles Federated Identity Credential management and the two-step exchange for you. See the package README at `github.com\u002FAzureAD\u002Fmicrosoft-identity-web` under `src\u002FMicrosoft.Identity.Web.AgentIdentities\u002F`.\n\n## Granting Permissions (Per Agent Identity)\n\nAgent Identities support both application permissions (autonomous) and delegated permissions (OBO). Grants are scoped **per Agent Identity**, not to the BlueprintPrincipal.\n\n### Application permissions (autonomous)\n\n```python\ngraph_sp = requests.get(\n    f\"{GRAPH}\u002FservicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'\",\n    headers=headers,\n).json()[\"value\"][0]\n\nuser_read_all = next(r for r in graph_sp[\"appRoles\"] if r[\"value\"] == \"User.Read.All\")\n\nrequests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002F{agent_sp_id}\u002FappRoleAssignments\",\n    headers=headers,\n    json={\n        \"principalId\": agent_sp_id,\n        \"resourceId\": graph_sp[\"id\"],\n        \"appRoleId\": user_read_all[\"id\"],\n    },\n).raise_for_status()\n```\n\n### Delegated permissions (OBO)\n\n```python\nfrom datetime import datetime, timedelta, timezone\n\nexpiry = (datetime.now(timezone.utc) + timedelta(days=3650)).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n\nrequests.post(\n    f\"{GRAPH}\u002Foauth2PermissionGrants\",\n    headers=headers,\n    json={\n        \"clientId\": agent_sp_id,\n        \"consentType\": \"AllPrincipals\",\n        \"resourceId\": graph_sp[\"id\"],\n        \"scope\": \"User.Read Tasks.ReadWrite Mail.Send\",\n        \"expiryTime\": expiry,\n    },\n).raise_for_status()\n```\n\nBrowser-based admin consent URLs do not work for Agent Identities — use `oauth2PermissionGrants` for programmatic delegated consent.\n\n## Cross-Tenant Agent Identities\n\nBlueprints can be multi-tenant (`signInAudience: AzureADMultipleOrgs`). When exchanging tokens cross-tenant:\n\n> **Step 1 of the parent token exchange MUST target the Agent Identity's home tenant**, not the Blueprint's. Wrong tenant → `AADSTS700211: No matching federated identity record found`.\n\nSee [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) for full cross-tenant examples.\n\n## API Reference\n\n| Operation | Method | Endpoint |\n|-----------|--------|----------|\n| Create Blueprint | `POST` | `\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint` |\n| Create BlueprintPrincipal | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal` |\n| Create Agent Identity | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Add FIC to Blueprint | `POST` | `\u002Fapplications\u002F{id}\u002Fmicrosoft.graph.agentIdentityBlueprint\u002FfederatedIdentityCredentials` |\n| List Agent Identities | `GET` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Grant app permission | `POST` | `\u002FservicePrincipals\u002F{id}\u002FappRoleAssignments` |\n| Grant delegated permission | `POST` | `\u002Foauth2PermissionGrants` |\n| Delete Agent Identity | `DELETE` | `\u002FservicePrincipals\u002F{id}` |\n| Delete Blueprint | `DELETE` | `\u002Fapplications\u002F{id}` |\n\nBase URL: `https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`.\n\n## Required Graph Permissions\n\n| Permission | Purpose |\n|-----------|---------|\n| `AgentIdentityBlueprint.Create` | Create Blueprints |\n| `AgentIdentityBlueprint.ReadWrite.All` | Read\u002Fupdate Blueprints |\n| `AgentIdentityBlueprintPrincipal.Create` | Create BlueprintPrincipals |\n| `AgentIdentity.Create.All` | Create Agent Identities |\n| `AgentIdentity.ReadWrite.All` | Read\u002Fupdate Agent Identities |\n| `Application.ReadWrite.All` | Blueprint CRUD on application objects |\n| `AppRoleAssignment.ReadWrite.All` | Grant application permissions |\n| `DelegatedPermissionGrant.ReadWrite.All` | Grant delegated permissions |\n\nGrant admin consent (required for application permissions):\n\n```bash\naz ad app permission admin-consent --id \u003Cclient-id>\n```\n\nAfter admin consent, tokens may not include new claims for 30–120 seconds — retry with exponential backoff.\n\n## Best Practices\n\n1. **Always create BlueprintPrincipal after Blueprint** — not auto-created.\n2. **Use typed endpoints** (`\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint`) instead of raw `\u002Fapplications` with `@odata.type`.\n3. **Credentials live on the Blueprint** — Agent Identities can't hold secrets\u002Fcerts (`PropertyNotCompatibleWithAgentIdentity`).\n4. **Include `OData-Version: 4.0`** on every Graph request.\n5. **Use Workload Identity Federation for production** — client secrets only for local dev.\n6. **Set `identifierUris: [\"api:\u002F\u002F{appId}\"]` on the Blueprint** before OAuth2 scope resolution.\n7. **Never use Azure CLI tokens** for Agent Identity APIs — `Directory.AccessAsUser.All` causes hard 403.\n8. **Use `fmi_path`** with `client_credentials` — NOT RFC 8693 `urn:ietf:params:oauth:grant-type:token-exchange` (returns `AADSTS82001`).\n9. **Always use `\u002F.default` scope** in both steps of the exchange — individual scopes fail.\n10. **Step 1 targets the Agent Identity's home tenant** in cross-tenant flows.\n11. **Grant permissions per Agent Identity**, not to the BlueprintPrincipal.\n12. **Handle permission-propagation delays** — retry 403s with 30–120s backoff after admin consent.\n13. **Keep the Entra SDK for AgentID on localhost** — never expose via LoadBalancer or Ingress.\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n|-------|-------|-----|\n| `AADSTS82001` | Used RFC 8693 token-exchange grant | Use `client_credentials` with `fmi_path` |\n| `AADSTS700211` | Step 1 parent token targeted wrong tenant | Target Agent Identity's home tenant |\n| `AADSTS50013` | OBO user token targets Graph, not Blueprint | Use `api:\u002F\u002F{blueprint_app_id}\u002Faccess_as_user` |\n| `AADSTS65001` | Missing grant or used individual scopes | Use `\u002F.default` and verify `oauth2PermissionGrants` |\n| `403 Authorization_RequestDenied` | No grant on this Agent Identity | Add via `appRoleAssignments` or `oauth2PermissionGrants` |\n| `PropertyNotCompatibleWithAgentIdentity` | Tried to add credential to Agent Identity SP | Put credentials on the Blueprint |\n| `Agent Blueprint Principal does not exist` | BlueprintPrincipal not created | Step 2 of the Core Workflow |\n| `AADSTS650051` on admin consent | SP already exists from partial consent | Grant directly via `appRoleAssignments` |\n\n## References\n\n| File | Contents |\n|------|----------|\n| [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) | Two-step `fmi_path` exchange: autonomous + OBO, cross-tenant |\n| [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md) | MI + WIF (production) and client secret (local dev) |\n| [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md) | Configuring the Blueprint as an OAuth2 API for OBO |\n| [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md) | Microsoft Entra SDK for AgentID — architecture, configuration, endpoints |\n| [references\u002Fsdk-sidecar-deployment.md](references\u002Fsdk-sidecar-deployment.md) | SDK code patterns (Python\u002FTypeScript), Docker\u002FKubernetes manifests, security, troubleshooting |\n| [references\u002Fknown-limitations.md](references\u002Fknown-limitations.md) | Documented gaps organized by category |\n\n### External Links\n\n| Resource | URL |\n|----------|-----|\n| Agent ID Setup Guide | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-setup-instructions |\n| AI-Guided Setup | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-ai-guided-setup |\n| Microsoft Entra SDK for AgentID | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fmsidweb\u002Fagent-id-sdk\u002Foverview |\n| Microsoft.Identity.Web.AgentIdentities (.NET) | https:\u002F\u002Fgithub.com\u002FAzureAD\u002Fmicrosoft-identity-web\u002Fblob\u002Fmaster\u002Fsrc\u002FMicrosoft.Identity.Web.AgentIdentities\u002FREADME.AgentIdentities.md |\n","# Microsoft Entra Agent ID\n\nCreate and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.\n\n## Quick Reference\n\n| Property | Value |\n|----------|-------|\n| Service | Microsoft Entra Agent ID |\n| API | Microsoft Graph (`https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`) |\n| Required role | Agent Identity Developer, Agent Identity Administrator, or Application Administrator |\n| Object model | Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) |\n| Runtime exchange | Two-step `fmi_path` exchange (autonomous and OBO) |\n| .NET helper | `Microsoft.Identity.Web.AgentIdentities` |\n| Polyglot helper | Microsoft Entra SDK for AgentID (sidecar container) |\n\n## When to Use This Skill\n\n- Provisioning a new Agent Identity Blueprint and BlueprintPrincipal\n- Creating per-instance Agent Identities under a Blueprint\n- Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint\n- Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO)\n- Cross-tenant agent token flows\n- Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)\n- Granting per-Agent-Identity application (`appRoleAssignments`) or delegated (`oauth2PermissionGrants`) permissions\n- Diagnosing Agent ID errors such as `AADSTS82001`, `AADSTS700211`, or `PropertyNotCompatibleWithAgentIdentity`\n\n## MCP Tools\n\n| Tool | Use |\n|------|-----|\n| `mcp_azure_mcp_documentation` | Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration |\n\nThere is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python `requests`). Use `mcp_azure_mcp_documentation` to verify request bodies and endpoints against current docs before running.\n\n## Before You Start\n\nUse the `mcp_azure_mcp_documentation` tool to search Microsoft Learn for current Agent ID documentation:\n- \"Microsoft Entra Agent ID setup instructions\"\n- \"Microsoft Entra SDK for AgentID\"\n\nVerify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.\n\n## Conceptual Model\n\n```\nAgent Identity Blueprint (application)         ← one per agent type\u002Fproject\n  └── BlueprintPrincipal (service principal)    ← MUST be created explicitly\n        ├── Agent Identity (SP): agent-1        ← one per agent instance\n        ├── Agent Identity (SP): agent-2\n        └── Agent Identity (SP): agent-3\n```\n\n| Concept | Description |\n|---------|-------------|\n| **Blueprint** | Application object that defines a type\u002Fclass of agent. Holds credentials (secret, certificate, federated identity). |\n| **BlueprintPrincipal** | Service principal for the Blueprint in the tenant. Not auto-created. |\n| **Agent Identity** | Service-principal-only identity for a single agent instance. Cannot hold its own credentials. |\n| **Sponsor** | A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation. |\n\n## Prerequisites\n\n### Required Entra Roles\n\nOne of: **Agent Identity Developer**, **Agent Identity Administrator**, or **Application Administrator**.\n\n### PowerShell (interactive setup)\n\n```powershell\n# PowerShell 7+\nInstall-Module Microsoft.Graph.Applications -Scope CurrentUser -Force\n```\n\n### Python (programmatic provisioning)\n\n```bash\npip install azure-identity requests\n```\n\n## Authentication\n\n> **`DefaultAzureCredential` is not supported.** Azure CLI tokens carry `Directory.AccessAsUser.All`, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with `client_credentials`, or `Connect-MgGraph` with explicit delegated scopes.\n\n### PowerShell (delegated)\n\n```powershell\nConnect-MgGraph -Scopes @(\n    \"AgentIdentityBlueprint.Create\",\n    \"AgentIdentityBlueprint.ReadWrite.All\",\n    \"AgentIdentityBlueprintPrincipal.Create\",\n    \"AgentIdentity.Create.All\",\n    \"User.Read\"\n)\n```\n\n### Python (application)\n\n```python\nimport os, requests\nfrom azure.identity import ClientSecretCredential\n\ncredential = ClientSecretCredential(\n    tenant_id=os.environ[\"AZURE_TENANT_ID\"],\n    client_id=os.environ[\"AZURE_CLIENT_ID\"],\n    client_secret=os.environ[\"AZURE_CLIENT_SECRET\"],\n)\ntoken = credential.get_token(\"https:\u002F\u002Fgraph.microsoft.com\u002F.default\")\n\nGRAPH = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\nheaders = {\n    \"Authorization\": f\"Bearer {token.token}\",\n    \"Content-Type\": \"application\u002Fjson\",\n    \"OData-Version\": \"4.0\",\n}\n```\n\n## Core Workflow\n\n### Step 1: Create Agent Identity Blueprint\n\nUse the typed endpoint. Sponsors must be **Users** at Blueprint creation. This snippet assumes the `requests` client and `headers` dict from the Python authentication block above.\n\n```python\nimport subprocess\nimport requests\n\nuser_id = subprocess.run(\n    [\"az\", \"ad\", \"signed-in-user\", \"show\", \"--query\", \"id\", \"-o\", \"tsv\"],\n    capture_output=True, text=True, check=True,\n).stdout.strip()\n\nblueprint_body = {\n    \"displayName\": \"My Agent Blueprint\",\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint\",\n    headers=headers, json=blueprint_body,\n)\nresp.raise_for_status()\n\nblueprint = resp.json()\napp_id = blueprint[\"appId\"]\nblueprint_obj_id = blueprint[\"id\"]\n```\n\n### Step 2: Create BlueprintPrincipal\n\n> Mandatory. Creating a Blueprint does NOT auto-create its service principal. Skipping this step produces:\n> `400: The Agent Blueprint Principal for the Agent Blueprint does not exist.`\n\n```python\nsp_body = {\"appId\": app_id}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal\",\n    headers=headers, json=sp_body,\n)\nresp.raise_for_status()\n```\n\nMake your provisioning scripts idempotent — always check for the BlueprintPrincipal even when the Blueprint already exists.\n\n### Step 3: Create Agent Identities\n\nSponsors for an Agent Identity may be **Users or Groups**.\n\n```python\nagent_body = {\n    \"displayName\": \"my-agent-instance-1\",\n    \"agentIdentityBlueprintId\": app_id,\n    \"sponsors@odata.bind\": [\n        f\"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F{user_id}\"\n    ],\n}\nresp = requests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity\",\n    headers=headers, json=agent_body,\n)\nresp.raise_for_status()\nagent = resp.json()\nagent_sp_id = agent[\"id\"]\n```\n\n## Runtime Authentication\n\nAgents authenticate at runtime using credentials configured on the **Blueprint** (not on the Agent Identity — Agent Identities can't hold credentials).\n\n| Option | Use case | Credential on Blueprint |\n|--------|----------|------------------------|\n| **Managed Identity + WIF** | Production (Azure-hosted) | Federated Identity Credential |\n| **Client secret** | Local dev \u002F testing | Password credential |\n| **Microsoft Entra SDK for AgentID** | Polyglot \u002F 3P agents | Sidecar container acquires tokens over HTTP |\n\nFor the two-step `fmi_path` exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct `sub` claim and audit trail, see [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md).\n\nFor OBO (agent acting on behalf of a user), see [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md).\n\nFor the containerized polyglot auth sidecar (Python, Node, Go, Java — no SDK embedding), see [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md).\n\nFor MI+WIF and client-secret setup details, see [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md).\n\n### .NET quick path\n\nFor .NET services, use **`Microsoft.Identity.Web.AgentIdentities`** — it handles Federated Identity Credential management and the two-step exchange for you. See the package README at `github.com\u002FAzureAD\u002Fmicrosoft-identity-web` under `src\u002FMicrosoft.Identity.Web.AgentIdentities\u002F`.\n\n## Granting Permissions (Per Agent Identity)\n\nAgent Identities support both application permissions (autonomous) and delegated permissions (OBO). Grants are scoped **per Agent Identity**, not to the BlueprintPrincipal.\n\n### Application permissions (autonomous)\n\n```python\ngraph_sp = requests.get(\n    f\"{GRAPH}\u002FservicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'\",\n    headers=headers,\n).json()[\"value\"][0]\n\nuser_read_all = next(r for r in graph_sp[\"appRoles\"] if r[\"value\"] == \"User.Read.All\")\n\nrequests.post(\n    f\"{GRAPH}\u002FservicePrincipals\u002F{agent_sp_id}\u002FappRoleAssignments\",\n    headers=headers,\n    json={\n        \"principalId\": agent_sp_id,\n        \"resourceId\": graph_sp[\"id\"],\n        \"appRoleId\": user_read_all[\"id\"],\n    },\n).raise_for_status()\n```\n\n### Delegated permissions (OBO)\n\n```python\nfrom datetime import datetime, timedelta, timezone\n\nexpiry = (datetime.now(timezone.utc) + timedelta(days=3650)).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n\nrequests.post(\n    f\"{GRAPH}\u002Foauth2PermissionGrants\",\n    headers=headers,\n    json={\n        \"clientId\": agent_sp_id,\n        \"consentType\": \"AllPrincipals\",\n        \"resourceId\": graph_sp[\"id\"],\n        \"scope\": \"User.Read Tasks.ReadWrite Mail.Send\",\n        \"expiryTime\": expiry,\n    },\n).raise_for_status()\n```\n\nBrowser-based admin consent URLs do not work for Agent Identities — use `oauth2PermissionGrants` for programmatic delegated consent.\n\n## Cross-Tenant Agent Identities\n\nBlueprints can be multi-tenant (`signInAudience: AzureADMultipleOrgs`). When exchanging tokens cross-tenant:\n\n> **Step 1 of the parent token exchange MUST target the Agent Identity's home tenant**, not the Blueprint's. Wrong tenant → `AADSTS700211: No matching federated identity record found`.\n\nSee [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) for full cross-tenant examples.\n\n## API Reference\n\n| Operation | Method | Endpoint |\n|-----------|--------|----------|\n| Create Blueprint | `POST` | `\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint` |\n| Create BlueprintPrincipal | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentityBlueprintPrincipal` |\n| Create Agent Identity | `POST` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Add FIC to Blueprint | `POST` | `\u002Fapplications\u002F{id}\u002Fmicrosoft.graph.agentIdentityBlueprint\u002FfederatedIdentityCredentials` |\n| List Agent Identities | `GET` | `\u002FservicePrincipals\u002Fmicrosoft.graph.agentIdentity` |\n| Grant app permission | `POST` | `\u002FservicePrincipals\u002F{id}\u002FappRoleAssignments` |\n| Grant delegated permission | `POST` | `\u002Foauth2PermissionGrants` |\n| Delete Agent Identity | `DELETE` | `\u002FservicePrincipals\u002F{id}` |\n| Delete Blueprint | `DELETE` | `\u002Fapplications\u002F{id}` |\n\nBase URL: `https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0`.\n\n## Required Graph Permissions\n\n| Permission | Purpose |\n|-----------|---------|\n| `AgentIdentityBlueprint.Create` | Create Blueprints |\n| `AgentIdentityBlueprint.ReadWrite.All` | Read\u002Fupdate Blueprints |\n| `AgentIdentityBlueprintPrincipal.Create` | Create BlueprintPrincipals |\n| `AgentIdentity.Create.All` | Create Agent Identities |\n| `AgentIdentity.ReadWrite.All` | Read\u002Fupdate Agent Identities |\n| `Application.ReadWrite.All` | Blueprint CRUD on application objects |\n| `AppRoleAssignment.ReadWrite.All` | Grant application permissions |\n| `DelegatedPermissionGrant.ReadWrite.All` | Grant delegated permissions |\n\nGrant admin consent (required for application permissions):\n\n```bash\naz ad app permission admin-consent --id \u003Cclient-id>\n```\n\nAfter admin consent, tokens may not include new claims for 30–120 seconds — retry with exponential backoff.\n\n## Best Practices\n\n1. **Always create BlueprintPrincipal after Blueprint** — not auto-created.\n2. **Use typed endpoints** (`\u002Fapplications\u002Fmicrosoft.graph.agentIdentityBlueprint`) instead of raw `\u002Fapplications` with `@odata.type`.\n3. **Credentials live on the Blueprint** — Agent Identities can't hold secrets\u002Fcerts (`PropertyNotCompatibleWithAgentIdentity`).\n4. **Include `OData-Version: 4.0`** on every Graph request.\n5. **Use Workload Identity Federation for production** — client secrets only for local dev.\n6. **Set `identifierUris: [\"api:\u002F\u002F{appId}\"]` on the Blueprint** before OAuth2 scope resolution.\n7. **Never use Azure CLI tokens** for Agent Identity APIs — `Directory.AccessAsUser.All` causes hard 403.\n8. **Use `fmi_path`** with `client_credentials` — NOT RFC 8693 `urn:ietf:params:oauth:grant-type:token-exchange` (returns `AADSTS82001`).\n9. **Always use `\u002F.default` scope** in both steps of the exchange — individual scopes fail.\n10. **Step 1 targets the Agent Identity's home tenant** in cross-tenant flows.\n11. **Grant permissions per Agent Identity**, not to the BlueprintPrincipal.\n12. **Handle permission-propagation delays** — retry 403s with 30–120s backoff after admin consent.\n13. **Keep the Entra SDK for AgentID on localhost** — never expose via LoadBalancer or Ingress.\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n|-------|-------|-----|\n| `AADSTS82001` | Used RFC 8693 token-exchange grant | Use `client_credentials` with `fmi_path` |\n| `AADSTS700211` | Step 1 parent token targeted wrong tenant | Target Agent Identity's home tenant |\n| `AADSTS50013` | OBO user token targets Graph, not Blueprint | Use `api:\u002F\u002F{blueprint_app_id}\u002Faccess_as_user` |\n| `AADSTS65001` | Missing grant or used individual scopes | Use `\u002F.default` and verify `oauth2PermissionGrants` |\n| `403 Authorization_RequestDenied` | No grant on this Agent Identity | Add via `appRoleAssignments` or `oauth2PermissionGrants` |\n| `PropertyNotCompatibleWithAgentIdentity` | Tried to add credential to Agent Identity SP | Put credentials on the Blueprint |\n| `Agent Blueprint Principal does not exist` | BlueprintPrincipal not created | Step 2 of the Core Workflow |\n| `AADSTS650051` on admin consent | SP already exists from partial consent | Grant directly via `appRoleAssignments` |\n\n## References\n\n| File | Contents |\n|------|----------|\n| [references\u002Fruntime-token-exchange.md](references\u002Fruntime-token-exchange.md) | Two-step `fmi_path` exchange: autonomous + OBO, cross-tenant |\n| [references\u002Foauth2-token-flow.md](references\u002Foauth2-token-flow.md) | MI + WIF (production) and client secret (local dev) |\n| [references\u002Fobo-blueprint-setup.md](references\u002Fobo-blueprint-setup.md) | Configuring the Blueprint as an OAuth2 API for OBO |\n| [references\u002Fsdk-sidecar.md](references\u002Fsdk-sidecar.md) | Microsoft Entra SDK for AgentID — architecture, configuration, endpoints |\n| [references\u002Fsdk-sidecar-deployment.md](references\u002Fsdk-sidecar-deployment.md) | SDK code patterns (Python\u002FTypeScript), Docker\u002FKubernetes manifests, security, troubleshooting |\n| [references\u002Fknown-limitations.md](references\u002Fknown-limitations.md) | Documented gaps organized by category |\n\n### External Links\n\n| Resource | URL |\n|----------|-----|\n| Agent ID Setup Guide | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-setup-instructions |\n| AI-Guided Setup | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fagent-id\u002Fidentity-platform\u002Fagent-id-ai-guided-setup |\n| Microsoft Entra SDK for AgentID | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fmsidweb\u002Fagent-id-sdk\u002Foverview |\n| Microsoft.Identity.Web.AgentIdentities (.NET) | https:\u002F\u002Fgithub.com\u002FAzureAD\u002Fmicrosoft-identity-web\u002Fblob\u002Fmaster\u002Fsrc\u002FMicrosoft.Identity.Web.AgentIdentities\u002FREADME.AgentIdentities.md |\n",{"name":5,"license":15,"metadata":24,"description":7},{"author":25,"version":26},"Microsoft","1.0.1","master","c247302c836de6438d746b45670990eb71691166","skills_collected\u002Fmicrosoft--skills--.github__plugins__azure-skills__skills__entra-agent-id",1,"https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool","https:\u002F\u002Fgithub.com\u002Fqhjqhj00","chien.io","2026-05-11 15:07:59",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add qhjqhj00\u002Fresearch-skills-pool --skill entra-agent-id",{"tool":41,"command":42},"bunx","bunx skills add qhjqhj00\u002Fresearch-skills-pool --skill entra-agent-id",{"tool":44,"command":45},"pnpm","pnpm dlx skills add qhjqhj00\u002Fresearch-skills-pool --skill entra-agent-id","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Fskills_collected\u002Fmicrosoft--skills--.github__plugins__azure-skills__skills__entra-agent-id\u002FSKILL.md",true,[49,55,59,63,67,71],{"path":50,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":53,"sourceHtmlUrl":54},"references\u002Fknown-limitations.md","REFERENCE","参考文档",4754,"https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Fskills_collected\u002Fmicrosoft--skills--.github__plugins__azure-skills__skills__entra-agent-id\u002Freferences\u002Fknown-limitations.md",{"path":56,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":57,"sourceHtmlUrl":58},"references\u002Foauth2-token-flow.md",4507,"https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Fskills_collected\u002Fmicrosoft--skills--.github__plugins__azure-skills__skills__entra-agent-id\u002Freferences\u002Foauth2-token-flow.md",{"path":60,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":61,"sourceHtmlUrl":62},"references\u002Fobo-blueprint-setup.md",4235,"https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Fskills_collected\u002Fmicrosoft--skills--.github__plugins__azure-skills__skills__entra-agent-id\u002Freferences\u002Fobo-blueprint-setup.md",{"path":64,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":65,"sourceHtmlUrl":66},"references\u002Fruntime-token-exchange.md",6746,"https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Fskills_collected\u002Fmicrosoft--skills--.github__plugins__azure-skills__skills__entra-agent-id\u002Freferences\u002Fruntime-token-exchange.md",{"path":68,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":69,"sourceHtmlUrl":70},"references\u002Fsdk-sidecar-deployment.md",6276,"https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Fskills_collected\u002Fmicrosoft--skills--.github__plugins__azure-skills__skills__entra-agent-id\u002Freferences\u002Fsdk-sidecar-deployment.md",{"path":72,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fsdk-sidecar.md",6107,"https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Fskills_collected\u002Fmicrosoft--skills--.github__plugins__azure-skills__skills__entra-agent-id\u002Freferences\u002Fsdk-sidecar.md",[76,83,90,97,104,111],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":19},"01M73JJB6EQPFPPVQK2Y9N67Q0","transformer-lens-interpretability","Provides guidance for mechanistic interpretability research using TransformerLens to inspect and manipulate transformer internals via HookPoints and activation caching. Use when reverse-engineering model algorithms, studying attention patterns, or performing activation patching experiments.","https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Ftop100-runs\u002F130-transformer-lens\u002FSKILL.md",[],[],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":19},"01M73JHTANRRWEE9HP98TPEHAY","wiki-vitepress","Packages generated wiki Markdown into a VitePress static site with dark theme, dark-mode Mermaid diagrams with click-to-zoom, and production build output. Use when the user wants to create a browsable website from generated wiki pages.","https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Ftop100-runs\u002F126-wiki-vitepress\u002FSKILL.md",[],[],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":19},"01M73JHJBMVFW46F1Y8K3SBF43","phoenix-observability","Open-source AI observability platform for LLM tracing, evaluation, and monitoring. Use when debugging LLM applications with detailed traces, running evaluations on datasets, or monitoring production AI systems with real-time insights.","https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Ftop100-runs\u002F124-phoenix\u002FSKILL.md",[],[],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":19},"01M73JHFPA3A2806PMP42ZN86Q","frontend-ui-dark-ts","Build dark-themed React applications using Tailwind CSS with custom theming, glassmorphism effects, and Framer Motion animations. Use when creating dashboards, admin panels, or data-rich interfaces with a refined dark aesthetic.","https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Ftop100-runs\u002F123-frontend-ui-dark-ts\u002FSKILL.md",[],[],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":19},"01M73JFVBVK57NRJS49TT2VDCT","tensorboard","Visualize training metrics, debug models with histograms, compare experiments, visualize model graphs, and profile performance with TensorBoard - Google's ML visualization toolkit","https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Ftop100-runs\u002F113-tensorboard\u002FSKILL.md",[],[],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":19},"01M73JFF6PK6ZCN41C89J7HS2B","markdown-mermaid-writing","Comprehensive markdown and Mermaid diagram writing skill. Use when creating any scientific document, report, analysis, or visualization. Establishes text-based diagrams as the default documentation standard with full style guides (markdown + mermaid), 24 diagram type references, and 9 document templates.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fqhjqhj00\u002Fresearch-skills-pool\u002Fblob\u002Fmaster\u002Ftop100-runs\u002F110-markdown-mermaid-writing\u002FSKILL.md",[],[]]