MicrosoftDocs/entra-docs/docs/agent-id

Merge pull request #14531 from markwahl-msft/mwahl-agent-perms clarify AP delegated perms

fix dup

initial revision

Merge pull request #14529 from MicrosoftDocs/repo_sync_working_branch Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/entra-docs (branch main)

Remove straggler ms.author and author fields for MSec files (#14465)

Spelling fixes (#2125) * spelling an auto space removal * Apply suggestion from @ShawnKupfer --------- Co-authored-by: Shawn Kupfer <60445862+ShawnKupfer@users.noreply.github.com>

Remove obsolete custom role management FAQ

Remove obsolete custom role restrictions for agents

Document custom role support for agents

Clarify custom role support for agent users

Merge pull request #14283 from Jackson-Woods/sponsor-enable-fix Clarify sponsors can't enable

Add how-to: Secure an MCP server with Microsoft Entra ID (#14290) * Add how-to: Secure an MCP server with Microsoft Entra ID New agent-id article covering how to configure Entra ID as the authorization server for an MCP server (requestedAccessTokenVersion=2, App ID URI = server URL, RFC 8707 resource parameter), how to connect an MCP client using Entra Agent ID, and an FAQ/troubleshooting section for AADSTS9010010. Adds the article to the agent-id TOC. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add mermaid sequence diagram of the MCP-Entra token flow Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Finish Step 4 (define scopes) and refocus Step 5 on app roles Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Note that official MCP SDKs can handle token validation instead of Entra middleware Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add AADSTS9010010 cause: scope defined on a different app than the resource Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Link to Azure App Service MCP auth guidance Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Note that identifierUris can hold multiple MCP server URLs Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove mermaid sequence diagram Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add section on protected resource metadata (PRM) format for Entra-secured MCP servers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Link claims validation article in token validation section Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add FAQ: use_guid aud optional claim as a workaround when v2 tokens aren't possible Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Clarify sponsors can't enable

docs: enhance on-behalf-of request documentation with UI instructions and policy configuration (#14201) - Add new section to agent-access-packages.md with step-by-step instructions for requesting access on behalf of another user - Include screenshot of selecting 'Anyone in your organization' option - Update entitlement-management-request-behalf.md with improved policy configuration screenshot - Add images for both user-facing workflow and admin policy configuration Co-authored-by: Sri Ponnada <sriponnada@microsoft.com>

Merge pull request #13605 from MicrosoftDocs/learn-build-service-prodbot/docutune-autopr-20260623-010826-4635907-ignore-build [BULK] - DocuTune remediation - Content SFI - docs/agent-id

Agent ID docs: fix compile-breaking C# create/delete agent identity samples (#14121)

Agent ID docs: rename Graph sample variables to describe app-only vs OBO scenarios

Agent ID docs: add missing usings and align Graph sample scopes (least privilege)

Merge pull request #14118 from ArLucaID/agent-id-fix-call-api-graph-csharp Agent ID docs: fix compile-breaking C# samples in call-api-microsoft-graph

Agent ID docs: add anti-pattern guidance and AI coding assistant guardrails