From d36ec8e726db43d0037eb65a39d1a9aef480041b Mon Sep 17 00:00:00 2001 From: Sunil Garg Date: Mon, 27 Apr 2026 09:43:00 -0700 Subject: [PATCH 1/8] Update setup instructions: add authMode question, rename AI Teammate to Agent with own access --- .../a365-setup-instructions.md | 57 ++++++++++++------- 1 file changed, 35 insertions(+), 22 deletions(-) diff --git a/docs/agent365-guided-setup/a365-setup-instructions.md b/docs/agent365-guided-setup/a365-setup-instructions.md index ad6ac92a..b7bed856 100644 --- a/docs/agent365-guided-setup/a365-setup-instructions.md +++ b/docs/agent365-guided-setup/a365-setup-instructions.md @@ -4,11 +4,11 @@ --- -> **YOUR FIRST AND ONLY ACTION RIGHT NOW:** Ask the user the two path-determination questions below. Do NOT create todos, run commands, or read further until the user has answered both questions. After both answers are received, create all todos for the determined path and mark Todo 1 in-progress. +> **YOUR FIRST AND ONLY ACTION RIGHT NOW:** Ask the user the three path-determination questions below. Do NOT create todos, run commands, or read further until the user has answered all three questions. After all answers are received, create all todos for the determined path and mark Todo 1 in-progress. -**RULE 1 — ASK TWO QUESTIONS FIRST, THEN CREATE ALL TODOS.** +**RULE 1 — ASK THREE QUESTIONS FIRST, THEN CREATE ALL TODOS.** -Before creating any todos or running any commands, ask the user these two questions (one at a time, wait for each response): +Before creating any todos or running any commands, ask the user these three questions (one at a time, wait for each response): **Question 1: Is your agent already available in Teams or Copilot?** @@ -19,27 +19,40 @@ Wait for the answer. Store as `agentType`: - If **Yes**: `agentType = 1` (M365 custom engine agent) - If **No**: `agentType = 2` (All other agents) -**Question 2: What capabilities do you want to enable?** +**Question 2: What Agent 365 capabilities do you want to enable?** Present only the options that apply to the user's `agentType`: -- **If `agentType = 1`** (M365 — Discoverability is already included): +- **If `agentType = 1`**: 1. Observability 2. Work IQ - 3. AI Teammate + 3. Agent with own access - **If `agentType = 2`** (All other agents): 1. Discoverability 2. Observability 3. Work IQ - 4. AI Teammate + 4. Agent with own access Wait for the answer. Store as `capabilities`. > **Note:** The setup automatically includes all prerequisite capabilities for your selection. -After both questions are answered, set `isAITeammate = true` if `capabilities = AI Teammate`, else `isAITeammate = false`. Then create all todos for the path and mark Todo 1 in-progress: +**Question 3: How will your agent authenticate when calling downstream APIs?** -**AI Teammate path** — `isAITeammate = true` (5 todos total): +1. On-behalf-of (OBO) — the agent acts as the signed-in user (delegated permissions) +2. Service-to-service (S2S) — the agent acts as its own identity (application permissions) + +Provide this context to help the developer choose: +- **OBO**: Choose this when your agent needs to access resources on behalf of a specific user — for example, reading the user's calendar or sending mail as them. +- **S2S**: Choose this when your agent runs unattended or needs to access tenant-wide resources independently of any signed-in user — for example, reading all mailboxes or managing SharePoint sites. + +Wait for the answer. Store as `authMode`: +- If **1 (OBO)**: `authMode = "obo"` +- If **2 (S2S)**: `authMode = "s2s"` + +After all three questions are answered, set `isAITeammate = true` if `capabilities = Agent with own access`, else `isAITeammate = false`. Then create all todos for the path and mark Todo 1 in-progress: + +**Agent with own access path** — `isAITeammate = true` (5 todos total): - Todo 1: `Step 1: Verify and Install/Update the Agent 365 CLI` - Todo 2: `Step 2: Ensure Prerequisites and Environment Configuration` - Todo 3: `Step 3: Configure the Agent 365 CLI (Initialize Configuration)` @@ -51,15 +64,15 @@ After both questions are answered, set `isAITeammate = true` if `capabilities = - Todo 2: `Step 2: Ensure Prerequisites and Environment Configuration` - Todo 3: `Step 4: Run Agent 365 Setup to Provision Prerequisites` -**RULE 2 — ALWAYS BEGIN FROM STEP 1.** No step is optional within your path. Even if the CLI appears installed or Azure appears logged in, you MUST run the validation commands in each step. Step 3 (Configure) is only required on the AI Teammate path (`isAITeammate = true`) — it is skipped entirely on all other paths. +**RULE 2 — ALWAYS BEGIN FROM STEP 1.** No step is optional within your path. Even if the CLI appears installed or Azure appears logged in, you MUST run the validation commands in each step. Step 3 (Configure) is only required on the Agent with own access path (`isAITeammate = true`) — it is skipped entirely on all other paths. **RULE 3 — SUB-SECTIONS ARE NOT SEPARATE TODOS.** Each `## Step` has internal sub-sections — these are tasks WITHIN that step, NOT separate todos. -**RULE 4 — ONE STEP AT A TIME.** Complete each step fully. Mark its todo in-progress when starting, complete when done. Do NOT run `az account show`, ask about deployment type, or gather Azure values — those belong to Steps 3 and 2 respectively. The path determination questions (`agentType`, `capabilities`) were already answered before Step 1. +**RULE 4 — ONE STEP AT A TIME.** Complete each step fully. Mark its todo in-progress when starting, complete when done. Do NOT run `az account show`, ask about deployment type, or gather Azure values — those belong to Steps 3 and 2 respectively. The path determination questions (`agentType`, `capabilities`, `authMode`) were already answered before Step 1. **RULE 6 — SILENT EXECUTION.** Work silently. Do NOT narrate what you are about to do, announce step transitions ("Proceeding to Step 2", "CLI installed, moving on"), print todo state, emoji checklists, or step completion summaries. Only speak to the user when you need input, have an error to report, or need confirmation before a destructive action. -**RULE 5 — INPUT FIELDS.** In Step 3 (AI Teammate path only), present exactly 5 fields (Azure-hosted) or 2 fields (self-hosted). Do NOT ask the user for a client app ID — the CLI resolves it automatically by the well-known app name "Agent 365 CLI". +**RULE 5 — INPUT FIELDS.** In Step 3 (Agent with own access path only), present exactly 5 fields (Azure-hosted) or 2 fields (self-hosted). Do NOT ask the user for a client app ID — the CLI resolves it automatically by the well-known app name "Agent 365 CLI". --- @@ -213,18 +226,18 @@ pip --version ### Step 2 completion > **BEFORE MOVING ON:** Mark Todo 2 (Step 2) as **completed** now. Summarize to the user what was validated. Then proceed based on your path: -> - **AI Teammate path** (`isAITeammate = true`): Mark Todo 3 in-progress and proceed to Step 3. +> - **Agent with own access path** (`isAITeammate = true`): Mark Todo 3 in-progress and proceed to Step 3. > - **All other paths** (`isAITeammate = false`): Skip Step 3 entirely. Mark Todo 3 in-progress and jump directly to Step 4. > > **VERIFY YOUR TODO STATE:** -> - AI Teammate path: Todo 1: **completed** | Todo 2: **completed** | Todo 3: **in-progress** | Todo 4: not-started | Todo 5: not-started +> - Agent with own access path: Todo 1: **completed** | Todo 2: **completed** | Todo 3: **in-progress** | Todo 4: not-started | Todo 5: not-started > - All other paths: Todo 1: **completed** | Todo 2: **completed** | Todo 3: **in-progress** --- ## Step 3: Configure the Agent 365 CLI (Initialize Configuration) -> **AI TEAMMATE PATH ONLY** (`capabilities = AI Teammate`, `isAITeammate = true`). +> **AGENT WITH OWN ACCESS PATH ONLY** (`capabilities = Agent with own access`, `isAITeammate = true`). > > If `isAITeammate = false` (Standard path), you should NOT be here. Go back, mark Todo 3 (Step 4) in-progress, and jump directly to Step 4. > @@ -233,7 +246,7 @@ pip --version > **MANDATORY GATE — DO NOT PROCEED WITHOUT VERIFICATION:** > > Before executing ANY part of this step, verify ALL of the following: -> - [ ] You created exactly 5 todos (AI Teammate path — RULE 1) +> - [ ] You created exactly 5 todos (Agent with own access path — RULE 1) > - [ ] Todo 1 (Step 1) is marked **completed** — CLI was verified/installed > - [ ] Todo 2 (Step 2) is marked **completed** — Azure CLI login confirmed, custom client app validated, build tools verified > - [ ] Todo 3 (Step 3) is marked **in-progress** @@ -497,7 +510,7 @@ Ask the user two questions (one at a time, wait for each response): Store as `project_dir`. If the user replies `current`, use the current working directory. -**For the AI Teammate path (`isAITeammate = true`):** +**For the Agent with own access path (`isAITeammate = true`):** - `agent_name` is derived from `agentBaseName` collected in Step 3 — do NOT ask again. - `project_dir` is the `deploymentProjectPath` from the config — do NOT ask again. @@ -515,7 +528,7 @@ Run the following command and display the full output to the user: cd "" && a365 setup all --agent-name --dry-run ``` -**AI Teammate path:** +**Agent with own access path:** ```bash cd "" && a365 setup all --dry-run ``` @@ -538,7 +551,7 @@ Run the following command from `project_dir` and stream all output: cd "" && a365 setup all --agent-name ``` -**AI Teammate path:** +**Agent with own access path:** ```bash cd "" && a365 setup all ``` @@ -557,7 +570,7 @@ This command may take several minutes. Monitor output carefully: **Important considerations:** -- **Quota limits:** An error like "Operation cannot be completed without additional quota" means the Azure subscription has hit a capacity limit for that region/SKU. Report this to the user and halt. If possible, update `location` in the config (AI Teammate path) or ask the user for a new region (Standard path) and retry. +- **Quota limits:** An error like "Operation cannot be completed without additional quota" means the Azure subscription has hit a capacity limit for that region/SKU. Report this to the user and halt. If possible, update `location` in the config (Agent with own access path) or ask the user for a new region (Standard path) and retry. - **Region support:** If an Azure resource is not available in the selected region, update the location and retry. Agent 365 preview supports only certain regions. - **Graph API permission errors:** A "Forbidden" or "Authorization_RequestDenied" error during blueprint creation indicates insufficient directory role or missing admin consent. Stop and resolve the permission issue (refer back to Step 2). After fixing, re-run `a365 setup all`. - **Interactive authentication — WAM on Windows / browser on Mac/Linux (expected on first run):** @@ -611,7 +624,7 @@ Mark all todos as completed, then check `capabilities`: ## Step 5: Publish and Deploy the Agent Application -> **AI TEAMMATE PATH ONLY.** This step does not exist on the Standard path. If `isAITeammate = false`, you should not be here. +> **AGENT WITH OWN ACCESS PATH ONLY.** This step does not exist on the Standard path. If `isAITeammate = false`, you should not be here. At this stage, your agent is set up. You should be able to see your agent in Microsoft Admin Center Agent Registry. Observability will be added after this step completes. @@ -788,7 +801,7 @@ If your agent instance isn't working as expected, see the Troubleshooting sectio ### Step 5 completion > **REQUIRED — do not skip this step.** -> AI Teammate includes observability. Immediately start following `#file:a365-observability-instructions.md`. Do NOT ask the user — just proceed. +> Agent with own access includes observability. Immediately start following `#file:a365-observability-instructions.md`. Do NOT ask the user — just proceed. --- From 88f1b3e6fade412376053bbcd92c8102e4b16b59 Mon Sep 17 00:00:00 2001 From: Sunil Garg Date: Mon, 27 Apr 2026 09:59:47 -0700 Subject: [PATCH 2/8] Update setup instructions: reorder questions, add both OBO+S2S auth option --- .../a365-setup-instructions.md | 31 ++++++++++--------- 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/docs/agent365-guided-setup/a365-setup-instructions.md b/docs/agent365-guided-setup/a365-setup-instructions.md index b7bed856..555add48 100644 --- a/docs/agent365-guided-setup/a365-setup-instructions.md +++ b/docs/agent365-guided-setup/a365-setup-instructions.md @@ -19,7 +19,23 @@ Wait for the answer. Store as `agentType`: - If **Yes**: `agentType = 1` (M365 custom engine agent) - If **No**: `agentType = 2` (All other agents) -**Question 2: What Agent 365 capabilities do you want to enable?** +**Question 2: How will your agent authenticate when calling downstream APIs?** + +1. On-behalf-of (OBO) — the agent acts as the signed-in user (delegated permissions) +2. Service-to-service (S2S) — the agent acts as its own identity (application permissions) +3. Both (OBO and S2S) + +Provide this context to help the developer choose: +- **OBO**: Choose this when your agent needs to access resources on behalf of a specific user — for example, reading the user's calendar or sending mail as them. +- **S2S**: Choose this when your agent runs unattended or needs to access tenant-wide resources independently of any signed-in user — for example, reading all mailboxes or managing SharePoint sites. +- **Both**: Choose this when your agent needs to support both modes. + +Wait for the answer. Store as `authMode`: +- If **1 (OBO)**: `authMode = "obo"` +- If **2 (S2S)**: `authMode = "s2s"` +- If **3 (Both)**: `authMode = "both"` + +**Question 3: What Agent 365 capabilities do you want to enable?** Present only the options that apply to the user's `agentType`: @@ -37,19 +53,6 @@ Wait for the answer. Store as `capabilities`. > **Note:** The setup automatically includes all prerequisite capabilities for your selection. -**Question 3: How will your agent authenticate when calling downstream APIs?** - -1. On-behalf-of (OBO) — the agent acts as the signed-in user (delegated permissions) -2. Service-to-service (S2S) — the agent acts as its own identity (application permissions) - -Provide this context to help the developer choose: -- **OBO**: Choose this when your agent needs to access resources on behalf of a specific user — for example, reading the user's calendar or sending mail as them. -- **S2S**: Choose this when your agent runs unattended or needs to access tenant-wide resources independently of any signed-in user — for example, reading all mailboxes or managing SharePoint sites. - -Wait for the answer. Store as `authMode`: -- If **1 (OBO)**: `authMode = "obo"` -- If **2 (S2S)**: `authMode = "s2s"` - After all three questions are answered, set `isAITeammate = true` if `capabilities = Agent with own access`, else `isAITeammate = false`. Then create all todos for the path and mark Todo 1 in-progress: **Agent with own access path** — `isAITeammate = true` (5 todos total): From 96eed998cfcc2a5e90b381b8bc08f71030414f5a Mon Sep 17 00:00:00 2001 From: Sunil Garg Date: Mon, 27 Apr 2026 12:21:16 -0700 Subject: [PATCH 3/8] Add local config, docs, and error-log files to .gitignore --- .gitignore | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.gitignore b/.gitignore index e769f62b..43baa477 100644 --- a/.gitignore +++ b/.gitignore @@ -2,8 +2,16 @@ docs/plans/ docs/Permissions-Review.md docs/Testing.md +docs/CLIimprovementRecommendations.docx +docs/functional-spec-nondw.md +docs/agent365-guided-setup/a365errors.md scripts/skills/ +# Local config and generated files +a365.config.json +a365.generated.config.json +error-log.md + # IDE launch profiles (developer-specific) **/Properties/launchSettings.json From ccbcca30af3aa35549b215d3bd3f3c9ead3d15fa Mon Sep 17 00:00:00 2001 From: Sunil Garg Date: Tue, 28 Apr 2026 08:03:36 -0700 Subject: [PATCH 4/8] Update setup instructions to clarify capabilities based on agentType and authMode --- .../a365-setup-instructions.md | 55 +++++++++++-------- 1 file changed, 33 insertions(+), 22 deletions(-) diff --git a/docs/agent365-guided-setup/a365-setup-instructions.md b/docs/agent365-guided-setup/a365-setup-instructions.md index 555add48..dd9ab3a8 100644 --- a/docs/agent365-guided-setup/a365-setup-instructions.md +++ b/docs/agent365-guided-setup/a365-setup-instructions.md @@ -37,25 +37,36 @@ Wait for the answer. Store as `authMode`: **Question 3: What Agent 365 capabilities do you want to enable?** -Present only the options that apply to the user's `agentType`: +Present only the options that apply to the user's `agentType` **and** `authMode`. Work IQ is not supported for S2S — omit it when `authMode = "s2s"`. - **If `agentType = 1`**: - 1. Observability - 2. Work IQ - 3. Agent with own access + - `authMode = "obo"` or `"both"`: + 1. Observability + 2. Work IQ + 3. AI Teammate + - `authMode = "s2s"`: + 1. Observability + 2. AI Teammate - **If `agentType = 2`** (All other agents): - 1. Discoverability - 2. Observability - 3. Work IQ - 4. Agent with own access + - `authMode = "obo"` or `"both"`: + 1. Discoverability + 2. Observability + 3. Work IQ + 4. AI Teammate + - `authMode = "s2s"`: + 1. Discoverability + 2. Observability + 3. AI Teammate + +> **Note:** Work IQ requires delegated (OBO) permissions and is not available for S2S-only agents. Wait for the answer. Store as `capabilities`. > **Note:** The setup automatically includes all prerequisite capabilities for your selection. -After all three questions are answered, set `isAITeammate = true` if `capabilities = Agent with own access`, else `isAITeammate = false`. Then create all todos for the path and mark Todo 1 in-progress: +After all three questions are answered, set `isAITeammate = true` if `capabilities = AI Teammate`, else `isAITeammate = false`. Then create all todos for the path and mark Todo 1 in-progress: -**Agent with own access path** — `isAITeammate = true` (5 todos total): +**AI Teammate path** — `isAITeammate = true` (5 todos total): - Todo 1: `Step 1: Verify and Install/Update the Agent 365 CLI` - Todo 2: `Step 2: Ensure Prerequisites and Environment Configuration` - Todo 3: `Step 3: Configure the Agent 365 CLI (Initialize Configuration)` @@ -67,7 +78,7 @@ After all three questions are answered, set `isAITeammate = true` if `capabiliti - Todo 2: `Step 2: Ensure Prerequisites and Environment Configuration` - Todo 3: `Step 4: Run Agent 365 Setup to Provision Prerequisites` -**RULE 2 — ALWAYS BEGIN FROM STEP 1.** No step is optional within your path. Even if the CLI appears installed or Azure appears logged in, you MUST run the validation commands in each step. Step 3 (Configure) is only required on the Agent with own access path (`isAITeammate = true`) — it is skipped entirely on all other paths. +**RULE 2 — ALWAYS BEGIN FROM STEP 1.** No step is optional within your path. Even if the CLI appears installed or Azure appears logged in, you MUST run the validation commands in each step. Step 3 (Configure) is only required on the AI Teammate path (`isAITeammate = true`) — it is skipped entirely on all other paths. **RULE 3 — SUB-SECTIONS ARE NOT SEPARATE TODOS.** Each `## Step` has internal sub-sections — these are tasks WITHIN that step, NOT separate todos. @@ -75,7 +86,7 @@ After all three questions are answered, set `isAITeammate = true` if `capabiliti **RULE 6 — SILENT EXECUTION.** Work silently. Do NOT narrate what you are about to do, announce step transitions ("Proceeding to Step 2", "CLI installed, moving on"), print todo state, emoji checklists, or step completion summaries. Only speak to the user when you need input, have an error to report, or need confirmation before a destructive action. -**RULE 5 — INPUT FIELDS.** In Step 3 (Agent with own access path only), present exactly 5 fields (Azure-hosted) or 2 fields (self-hosted). Do NOT ask the user for a client app ID — the CLI resolves it automatically by the well-known app name "Agent 365 CLI". +**RULE 5 — INPUT FIELDS.** In Step 3 (AI Teammate path only), present exactly 5 fields (Azure-hosted) or 2 fields (self-hosted). Do NOT ask the user for a client app ID — the CLI resolves it automatically by the well-known app name "Agent 365 CLI". --- @@ -229,18 +240,18 @@ pip --version ### Step 2 completion > **BEFORE MOVING ON:** Mark Todo 2 (Step 2) as **completed** now. Summarize to the user what was validated. Then proceed based on your path: -> - **Agent with own access path** (`isAITeammate = true`): Mark Todo 3 in-progress and proceed to Step 3. +> - **AI Teammate path** (`isAITeammate = true`): Mark Todo 3 in-progress and proceed to Step 3. > - **All other paths** (`isAITeammate = false`): Skip Step 3 entirely. Mark Todo 3 in-progress and jump directly to Step 4. > > **VERIFY YOUR TODO STATE:** -> - Agent with own access path: Todo 1: **completed** | Todo 2: **completed** | Todo 3: **in-progress** | Todo 4: not-started | Todo 5: not-started +> - AI Teammate path: Todo 1: **completed** | Todo 2: **completed** | Todo 3: **in-progress** | Todo 4: not-started | Todo 5: not-started > - All other paths: Todo 1: **completed** | Todo 2: **completed** | Todo 3: **in-progress** --- ## Step 3: Configure the Agent 365 CLI (Initialize Configuration) -> **AGENT WITH OWN ACCESS PATH ONLY** (`capabilities = Agent with own access`, `isAITeammate = true`). +> **AI Teammate path ONLY** (`capabilities = AI Teammate`, `isAITeammate = true`). > > If `isAITeammate = false` (Standard path), you should NOT be here. Go back, mark Todo 3 (Step 4) in-progress, and jump directly to Step 4. > @@ -249,7 +260,7 @@ pip --version > **MANDATORY GATE — DO NOT PROCEED WITHOUT VERIFICATION:** > > Before executing ANY part of this step, verify ALL of the following: -> - [ ] You created exactly 5 todos (Agent with own access path — RULE 1) +> - [ ] You created exactly 5 todos (AI Teammate path — RULE 1) > - [ ] Todo 1 (Step 1) is marked **completed** — CLI was verified/installed > - [ ] Todo 2 (Step 2) is marked **completed** — Azure CLI login confirmed, custom client app validated, build tools verified > - [ ] Todo 3 (Step 3) is marked **in-progress** @@ -513,7 +524,7 @@ Ask the user two questions (one at a time, wait for each response): Store as `project_dir`. If the user replies `current`, use the current working directory. -**For the Agent with own access path (`isAITeammate = true`):** +**For the AI Teammate path (`isAITeammate = true`):** - `agent_name` is derived from `agentBaseName` collected in Step 3 — do NOT ask again. - `project_dir` is the `deploymentProjectPath` from the config — do NOT ask again. @@ -531,7 +542,7 @@ Run the following command and display the full output to the user: cd "" && a365 setup all --agent-name --dry-run ``` -**Agent with own access path:** +**AI Teammate path:** ```bash cd "" && a365 setup all --dry-run ``` @@ -554,7 +565,7 @@ Run the following command from `project_dir` and stream all output: cd "" && a365 setup all --agent-name ``` -**Agent with own access path:** +**AI Teammate path:** ```bash cd "" && a365 setup all ``` @@ -573,7 +584,7 @@ This command may take several minutes. Monitor output carefully: **Important considerations:** -- **Quota limits:** An error like "Operation cannot be completed without additional quota" means the Azure subscription has hit a capacity limit for that region/SKU. Report this to the user and halt. If possible, update `location` in the config (Agent with own access path) or ask the user for a new region (Standard path) and retry. +- **Quota limits:** An error like "Operation cannot be completed without additional quota" means the Azure subscription has hit a capacity limit for that region/SKU. Report this to the user and halt. If possible, update `location` in the config (AI Teammate path) or ask the user for a new region (Standard path) and retry. - **Region support:** If an Azure resource is not available in the selected region, update the location and retry. Agent 365 preview supports only certain regions. - **Graph API permission errors:** A "Forbidden" or "Authorization_RequestDenied" error during blueprint creation indicates insufficient directory role or missing admin consent. Stop and resolve the permission issue (refer back to Step 2). After fixing, re-run `a365 setup all`. - **Interactive authentication — WAM on Windows / browser on Mac/Linux (expected on first run):** @@ -627,7 +638,7 @@ Mark all todos as completed, then check `capabilities`: ## Step 5: Publish and Deploy the Agent Application -> **AGENT WITH OWN ACCESS PATH ONLY.** This step does not exist on the Standard path. If `isAITeammate = false`, you should not be here. +> **AI Teammate path ONLY.** This step does not exist on the Standard path. If `isAITeammate = false`, you should not be here. At this stage, your agent is set up. You should be able to see your agent in Microsoft Admin Center Agent Registry. Observability will be added after this step completes. @@ -804,7 +815,7 @@ If your agent instance isn't working as expected, see the Troubleshooting sectio ### Step 5 completion > **REQUIRED — do not skip this step.** -> Agent with own access includes observability. Immediately start following `#file:a365-observability-instructions.md`. Do NOT ask the user — just proceed. +> AI Teammate includes observability. Immediately start following `#file:a365-observability-instructions.md`. Do NOT ask the user — just proceed. --- From 1096f53c692607b3d3a4c4e43fc3067df8934d24 Mon Sep 17 00:00:00 2001 From: Sunil Garg Date: Wed, 29 Apr 2026 08:07:53 -0700 Subject: [PATCH 5/8] Revert .gitignore changes from this branch --- .gitignore | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.gitignore b/.gitignore index 43baa477..e769f62b 100644 --- a/.gitignore +++ b/.gitignore @@ -2,16 +2,8 @@ docs/plans/ docs/Permissions-Review.md docs/Testing.md -docs/CLIimprovementRecommendations.docx -docs/functional-spec-nondw.md -docs/agent365-guided-setup/a365errors.md scripts/skills/ -# Local config and generated files -a365.config.json -a365.generated.config.json -error-log.md - # IDE launch profiles (developer-specific) **/Properties/launchSettings.json From 51189b6e8fc768d9ab071e35469e9e78a03768b4 Mon Sep 17 00:00:00 2001 From: Sunil Garg Date: Wed, 29 Apr 2026 08:32:05 -0700 Subject: [PATCH 6/8] Rename Discoverability to Register in capabilities list --- docs/agent365-guided-setup/a365-setup-instructions.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/agent365-guided-setup/a365-setup-instructions.md b/docs/agent365-guided-setup/a365-setup-instructions.md index bf80e35d..e6100a35 100644 --- a/docs/agent365-guided-setup/a365-setup-instructions.md +++ b/docs/agent365-guided-setup/a365-setup-instructions.md @@ -49,12 +49,12 @@ Present only the options that apply to the user's `agentType` **and** `authMode` 2. AI Teammate - **If `agentType = 2`** (All other agents): - `authMode = "obo"` or `"both"`: - 1. Discoverability + 1. Register 2. Observability 3. Work IQ 4. AI Teammate - `authMode = "s2s"`: - 1. Discoverability + 1. Register 2. Observability 3. AI Teammate From 24f43bc709761137f553a563ac00b18119ed1a33 Mon Sep 17 00:00:00 2001 From: Sunil Garg Date: Wed, 29 Apr 2026 10:44:07 -0700 Subject: [PATCH 7/8] Clarify Work IQ applies only to OBO portion when authMode is both --- docs/agent365-guided-setup/a365-setup-instructions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/agent365-guided-setup/a365-setup-instructions.md b/docs/agent365-guided-setup/a365-setup-instructions.md index e6100a35..52719425 100644 --- a/docs/agent365-guided-setup/a365-setup-instructions.md +++ b/docs/agent365-guided-setup/a365-setup-instructions.md @@ -58,7 +58,7 @@ Present only the options that apply to the user's `agentType` **and** `authMode` 2. Observability 3. AI Teammate -> **Note:** Work IQ requires delegated (OBO) permissions and is not available for S2S-only agents. +> **Note:** Work IQ requires delegated (OBO) permissions and is not available for S2S-only agents. When `authMode = "both"`, Work IQ is available but applies only to the OBO (delegated) portion of your agent — it does not apply to S2S calls. Wait for the answer. Store as `capabilities`. From 40a2b53e8d1818f1c9027a289c7ec3aa94cc1c1a Mon Sep 17 00:00:00 2001 From: Sunil Garg Date: Thu, 30 Apr 2026 10:18:07 -0700 Subject: [PATCH 8/8] Remove Work IQ from AI guided setup instructions --- .../a365-setup-instructions.md | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) diff --git a/docs/agent365-guided-setup/a365-setup-instructions.md b/docs/agent365-guided-setup/a365-setup-instructions.md index 52719425..3b143295 100644 --- a/docs/agent365-guided-setup/a365-setup-instructions.md +++ b/docs/agent365-guided-setup/a365-setup-instructions.md @@ -37,29 +37,18 @@ Wait for the answer. Store as `authMode`: **Question 3: What Agent 365 capabilities do you want to enable?** -Present only the options that apply to the user's `agentType` **and** `authMode`. Work IQ is not supported for S2S — omit it when `authMode = "s2s"`. +Present only the options that apply to the user's `agentType` **and** `authMode`. - **If `agentType = 1`**: - - `authMode = "obo"` or `"both"`: - 1. Observability - 2. Work IQ - 3. AI Teammate - - `authMode = "s2s"`: + - `authMode = "obo"` or `"both"` or `"s2s"`: 1. Observability 2. AI Teammate - **If `agentType = 2`** (All other agents): - - `authMode = "obo"` or `"both"`: - 1. Register - 2. Observability - 3. Work IQ - 4. AI Teammate - - `authMode = "s2s"`: + - `authMode = "obo"` or `"both"` or `"s2s"`: 1. Register 2. Observability 3. AI Teammate -> **Note:** Work IQ requires delegated (OBO) permissions and is not available for S2S-only agents. When `authMode = "both"`, Work IQ is available but applies only to the OBO (delegated) portion of your agent — it does not apply to S2S calls. - Wait for the answer. Store as `capabilities`. > **Note:** The setup automatically includes all prerequisite capabilities for your selection. @@ -440,7 +429,7 @@ After `a365 setup all` completes, show the user exactly this — nothing more, n Mark all todos as completed, then check `capabilities`: -> **If `capabilities` includes "Observability"** (`agentType = 1` with Observability or Work IQ, or `agentType = 2` with Observability or Work IQ): immediately start following `#file:a365-observability-instructions.md`. The user already selected observability — do NOT ask again, just proceed. +> **If `capabilities` includes "Observability"** (`agentType = 1` with Observability, or `agentType = 2` with Observability): immediately start following `#file:a365-observability-instructions.md`. The user already selected observability — do NOT ask again, just proceed. > > **Otherwise**: say to the user verbatim: > "Your agent is provisioned. Would you like to add observability so you can trace LLM calls, tool dispatches, and agent-to-agent calls?"