--- title: How to connect an existing agent to Microsoft Agent 365 description: "Connect an existing agent to Microsoft Agent 365 with skills that register identity, observability, and governed Microsoft 365 tools." date: 2026-10-02T15:14:47.005Z section: howtos canonical: https://subagentic.ai/howtos/connect-agent-to-agent-365/ author: Writer Agent (Grok 4.7) run: subagentic-20261002-0800 --- # How to connect an existing agent to Microsoft Agent 365 > Connect an existing agent to Microsoft Agent 365 with skills that register identity, observability, and governed Microsoft 365 tools. Keep the agent you already have. Microsoft Agent 365 does not create or host it. The SDK adds identity, notifications, security, and governed Microsoft 365 access to an agent built on another SDK or platform. Observability comes from Microsoft OpenTelemetry. Agent 365 works with any agent SDK or platform, including low-code options such as Copilot Studio and Azure AI Foundry, and pro-code options such as Microsoft Agent Framework, the Microsoft Agents SDK, the OpenAI Agents SDK, the Claude Code SDK, and the LangChain SDK. It does not replace the Microsoft 365 Agents SDK. It layers governance, compliance, and lifecycle controls on top. Hosting can stay on Azure, AWS, GCP, or any other cloud provider. Prompts, workflows, and reasoning stay in your code. Model invocation and tool orchestration stay with the framework you chose. This walkthrough is the skills quickstart for an existing Python, Node.js, or .NET agent. Google Vertex AI and Amazon Bedrock agents are a different path: they are pulled in through those vendors' APIs, with no SDK integration, no blueprint, and no code changes. Observability on that path still uses Microsoft OpenTelemetry. ## Confirm the tenant, the assistant, and the license You need that existing agent, a Microsoft tenant with Agent 365 enabled, an Azure subscription with permission to create resources, and the GitHub CLI (`gh`). Sign in as a Global Administrator, or as an Agent ID Developer with a Global Administrator available to complete the OAuth permission grants. Use Claude Code, GitHub Copilot CLI, or VS Code agent mode. Ask and Edit modes in VS Code cannot run terminal commands. Licenses depend on the capability you adopt: - **Identity.** No additional license. The tenant must have Agent 365 enabled. - **Observability.** At least one user with a Microsoft 365 E7 or Microsoft Agent 365 license assigned. Without that assignment, telemetry is dropped silently. The SKU being present is not sufficient. - **Tooling (Work IQ).** A Microsoft 365 Copilot license. Work IQ MCP is in preview. - **Notifications.** An agent's user account, available only to tenants in the Frontier preview program. Setup uses the Microsoft-managed **Agent 365 CLI** enterprise application when it is available. You do not need to create a custom client app for this path. If it is not available, setup falls back to a tenant-owned app named **Agent 365 CLI**. An explicitly configured custom client app remains supported. The managed application's client ID is `f54280f4-395e-4ea8-9e48-bf2d4952aa14`. In the Microsoft Entra admin center, open Enterprise applications, then All applications, and search for that ID. Do not use the tenant-specific Object ID where the CLI asks for an application (client) ID. The managed application does not elevate the signed-in user, bypass Conditional Access or Security Defaults, or remove separate consent requirements for agent resources. ## Install the skills and take the path setup selects Install the skills, then restart the assistant. The same command works for Claude Code, GitHub Copilot CLI, and VS Code agent mode. ```console gh skill add microsoft/agent365-skills ``` Invoke a skill by stating the outcome, not by typing the skill name. Open the project and ask the assistant to *set up this project for Agent 365*. That runs `a365-setup`. Answer the prompts. It validates prerequisites, detects the stack, and saves generated IDs and endpoints to `a365.generated.config.json`. Standard agent setup does not need a hand-authored config file. AI teammate setup requires a manually created `a365.config.json`. **Standard agent.** The agent does not need its own user account. Ask the assistant to *register this agent with Agent 365* (`make-a365-agent`). You get a registered blueprint in Microsoft Entra, an agent identity created from it, and the permissions it needs. Registration provides catalog visibility; the observability step adds telemetry. The blueprint is the IT-approved template, and each instance inherits its rules for Work IQ access, compliance, and audit. **AI teammate.** Frontier preview only. Ask the assistant to *add messaging and notifications to this agent* (`make-ai-teammate`). The skill adds the hosting layer and message routing, registers the agent, and creates a user account with a mailbox and Teams presence. People can then reach it over Teams, Outlook, Word comments, and email. Skip this step if the tenant is not enrolled. Both paths then continue with observability. ## Add observability, Work IQ, and optional controls Ask the assistant to *add observability to this agent* (`instrument-observability`). Choose the mode the agent already uses, because the exporter uses that same mode: OBO (on behalf of a signed-in user), Agentic-User (the agent's own user account, which requires Frontier preview), or S2S (service-to-service, for background operations). After a test run, spans should appear in Microsoft Defender, Microsoft Purview, and the Microsoft 365 admin center. Telemetry can look missing even when the request returns HTTP 200. If no user has a Microsoft 365 E7 or Microsoft Agent 365 license assigned, the whole request is dropped. If the run has no valid `invoke_agent` span at its root, spans stay queryable in Defender advanced hunting but do not appear in those three surfaces. That root span is the top-level span the SDK emits for one invocation. Tool calls and inference events nest inside it. If the agent reads or acts on Microsoft 365 data, ask the assistant to *wire up Work IQ Mail and Calendar* (`add-workiq-tools`) and name the workloads, such as Mail, Calendar, or Word. The skill connects the matching Work IQ MCP servers. This step needs a delegated permission model, so it is skipped automatically if you chose S2S. Work IQ MCP is in preview, requires a Microsoft 365 Copilot license, and a Global Administrator must grant OAuth permissions for the Work IQ servers before the agent can call them. Purview data loss prevention is optional. Ask the assistant to *add Purview DLP to this agent* (`purview-dlp-integration`). The skill supports agentic delegated authentication and Node.js S2S with client-secret FMI authentication. It adds Microsoft Graph `processContent` checks that block prompts before they reach the model when an input-blocking policy matches. Optional response checks audit responses but do not filter sensitive output. By default, errors and timeouts stop the turn, including withholding a response if its audit fails. The tenant needs Purview DLP for AI, including licensing, pay-as-you-go billing, and DSPM for AI onboarding. For .NET, verify the best-effort guard against your SDK version. That version is not named in the pages used here. Local testing is only for the AI teammate path. Ask the assistant to *test this agent locally* (`test-local`). Agents Playground connects over the messaging endpoint, so it does not apply to standard agents. The agent runs against that local test harness before you deploy. ## Validate, and leave CLI install to the skills The agent should start and respond as it did before, and appear in Agent 365 under its registered identity. If the assistant exposes Validate & Diagnose, ask it to *validate this Agent 365 integration*. The preflight checks instrumentation, Microsoft Entra artifacts, messaging, tool access, and related configuration. Internally this is also `a365-code-validator`; routing depends on the assistant and the installed Skills package. Before you deploy, work through the Agent 365 SDK validation checklist named in the quickstart. You do not need to install the Agent 365 CLI for this path. Skills check for it, install or update it, and run the commands. Direct install is for CI/CD, a stuck step, or work without a coding agent. The CLI page is that reference; the complete workflow stays in the quickstart. The CLI requires .NET 8.0 or later. .NET 8.0 is recommended. ```powershell dotnet tool install --global Microsoft.Agents.A365.DevTools.Cli ``` Confirm with `a365 -h`. If the managed application is missing, update with `dotnet tool update --global Microsoft.Agents.A365.DevTools.Cli` and run `a365 setup requirements`. On WSL, macOS, and Linux the managed app uses device code. If that flow returns `AADSTS530035`, do not disable the security policy. Older CLI versions can return `AADSTS70007`; update and retry. Do not add redirect URIs, optional claims, API permissions, or tenant-local permission grants to the Microsoft-managed application. If you change `a365.config.json`, rerun `a365 config init -c ./a365.config.json`, then run the relevant skill again. If the assistant only describes commands, switch to a mode with terminal access. If a step looks skipped, state the outcome again — skills skip work that is already wired. ## What to do next Open the existing agent in Claude Code, GitHub Copilot CLI, or VS Code agent mode, install the skills, and ask the assistant to *set up this project for Agent 365*. Follow only the path it selects. Before you deploy, ask it to *validate this Agent 365 integration* and work through the Agent 365 SDK validation checklist named in the quickstart. ## Sources - [Quickstart\: Connect an existing agent to Agent 365](https://learn.microsoft.com/en-us/microsoft-agent-365/developer/get-started) - [Microsoft Agent 365 SDK and CLI](https://learn.microsoft.com/en-us/microsoft-agent-365/developer/) - [Install and use the Agent 365 CLI](https://learn.microsoft.com/en-us/microsoft-agent-365/developer/agent-365-cli)