Provisions a non-AI Teammate agent with Agent 365 — use this skill for Register and Observability paths. Runs a365 setup all to create the Blueprint and Entra ID permissions. After setup, always offers instrument-observability (optional) and add-workiq-tools (optional, skipped automatically when authMode = s2s) as add-ons. Supports .NET AgentFramework, Node.js, and Python agents. Normally delegated to from a365-setup after CLI and Azure prerequisites are confirmed. Can also be invoked directly when those steps are already done.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Provisions a non-AI Teammate agent with Agent 365 — use this skill for Register and Observability paths. Runs a365 setup all to create the Blueprint and Entra ID permissions. After setup, always offers instrument-observability (optional) and add-workiq-tools (optional, skipped automatically when authMode = s2s) as add-ons. Supports .NET AgentFramework, Node.js, and Python agents. Normally delegated to from a365-setup after CLI and Azure prerequisites are confirmed. Can also be invoked directly when those steps are already done.
{"preToolUse":[{"type":"command","command":"node ${CLAUDE_PLUGIN_ROOT}/hooks/preToolUse/path-guard.js","timeout":5000}],"stop":[{"type":"command","command":"node ${CLAUDE_PLUGIN_ROOT}/hooks/stop/validate-make-a365-agent.js","timeout":15000},{"type":"prompt","prompt":"Before ending, verify ALL of the following:\n1. a365 setup all completed without fatal errors.\n2. a365.generated.config.json exists with a valid agentBlueprintId.\n3. Setup Summary table was shown to the user verbatim.\n4. instrument-observability was offered and either invoked or explicitly skipped by user.\n5. add-workiq-tools was offered and either invoked or explicitly skipped by user — OR authMode = s2s (WorkIQ is not available for S2S agents and must not be offered).\nIf any item is incomplete, return {\"ok\": false, \"reason\": \"<specific item>\"}.\nIf all items completed (or were explicitly skipped by the user), return {\"ok\": true}.\n","timeout":30000}]}
Make A365 Agent
Trigger phrases — any of these will activate this skill:
"provision this agent with agent 365"
"register this agent"
"make this agent findable in the Agent 365 catalog"
"Registration setup for this agent"
"make this a custom engine agent"
"run a365 setup all"
"create a365 blueprint for this agent"
"set up this agent for observability only"
What this skill does: Provisions your agent with Agent 365 — creates the Blueprint
and Entra ID permissions. After setup, always offers observability
(instrument-observability) and WorkIQ tools (add-workiq-tools) as optional add-ons.
This skill is normally called from a365-setup after CLI verification and Azure
prerequisites are confirmed. It can also be invoked directly when those steps are done.
YOUR FIRST ACTION: Load context (Phase 0), then create all todos before running anything.
Phase 0 — Load Context
Show the user a visible task checklist BEFORE Phase 1 work begins. This skill has no per-phase TaskCreate calls in the body — derive the checklist from the phase headers (## Phase 0 — Load Context, ## Phase 1 — Collect Provisioning Inputs, ## Phase 2 — Register with Agent 365, etc.). Exactly one item in_progress at a time; complete before moving on.
Claude Code: call TaskCreate once per phase header (already in allowed-tools); the list renders natively. Use TaskUpdate to flip statuses.
VS Code Copilot Chat / GitHub Copilot CLI:allowed-tools is ignored — emit a markdown checklist directly in chat (- [ ] Load context…, - [ ] Collect provisioning inputs…, etc.) and edit items to - [x] as each phase completes.
Check for context passed from a365-setup. If this skill was invoked by a365-setup,
the session already has capabilities, agentStack, programmingLanguage, and
usesTeamsOrCopilot set. Load those values directly.
If invoked directly (no session context):
Read.a365-workspace-detection.local.json if it exists and detectedAt is within 60 minutes.
Load agentStack, programmingLanguage, and usesTeamsOrCopilot from it.
If no fresh cache, ask the user in a single message:
What capabilities would you like to enable? (options can be combined)
1. Register — make the agent findable in the Agent 365 catalog
2. Observability — end-to-end activity tracing for every message, LLM call,
and tool use, visible in the Agent 365 portal and Microsoft Defender
3. WorkIQ — add WorkIQ MCP servers (M365 data: email, calendar, Teams, SharePoint, OneDrive)
(only show this option when authMode ≠ s2s — WorkIQ requires a user token)
4. AI Teammate — the agent needs a first-class M365 identity
(Agentic User with UPN, mailbox, presence). Handled by a different skill.
If the user selects option 4 (AI Teammate) — stop here and tell them:
"AI Teammate setup is handled by the make-ai-teammate skill. Run /agent365:a365-setup and select the AI Teammate path, or invoke make-ai-teammate directly."
Otherwise store the answer as capabilities and continue.
Create all todos for this session:
Todo 1: Register agent with Agent 365 (a365 setup all)
Todo 2: Add Observability (optional)
Todo 3: Add WorkIQ Tools (optional)
Mark Todo 1 in-progress.
Phase 1 — Collect Provisioning Inputs
1.0 — Check for Existing Blueprint
Before asking for any inputs, check whether a blueprint config already exists:
ls a365.config.json a365.generated.config.json 2>/dev/null
If either file exists, read it and extract the blueprint ID — the field name differs by file:
Store whichever is present as existingBlueprintId. Then ask:
I found an existing Agent 365 config in this project.
• File: {filename found}
• Blueprint ID: {existingBlueprintId if found, otherwise "not yet set"}
What would you like to do?
1. Reuse the existing blueprint — I'll skip `a365 setup all` and use this blueprint directly
(use this if setup already ran successfully and you just want to add capabilities)
2. Create a fresh blueprint — runs `a365 setup all` and overwrites the existing config
(use this if you want to start over or the existing config is stale)
Wait for the answer:
If 1 (reuse): if agentBlueprintId is empty, ask "Please provide your blueprint ID." Store as existingBlueprintId. Set reuseBlueprint = true. Write both values back to .a365-workspace-detection.local.json (merge, preserve all other fields) so the stop-hook validator and follow-on skills can read them. Skip Phase 2 (setup all) entirely — proceed directly to Phase 3.
If 2 (fresh): set reuseBlueprint = false. WritereuseBlueprint: false to .a365-workspace-detection.local.json. Continue with Phase 1 inputs and Phase 2 as normal.
If no existing config is found: set reuseBlueprint = false and continue.
Ask both questions in a single message:
To provision your agent with Agent 365, I need two things:
1. Agent Name — short, unique identifier for your tenant (e.g. "contoso-hr-agent" or "FabrikamHelpdesk")
Rules: letters, numbers, hyphens only. Start with a letter. 3–20 chars (the CLI appends " Blueprint" to derive the Teams manifest `name.short`, capped at 30).
This derives the Blueprint name. Pass the name exactly as you type it — do NOT normalize case.
Type "default" to use the name "developer".
2. Project directory — full path to your agent code, or "current" for this directory.
Store as agent_name and project_dir. If the user replies current, use CWD.
If the user types default, set agent_name = "developer".
1.1 — Determine Messaging Endpoint
Ask the user where their agent is (or will be) hosted:
Where will your agent run?
1. Azure / Cloud — the agent has (or will have) a public HTTPS endpoint already
2. Local / Dev Tunnel — the agent runs on localhost and needs a dev tunnel for a public URL
3. Skip - I just want to set up the Blueprint and Entra ID permissions for now, without registering an endpoint yet
If Cloud (option 1): Ask for the full HTTPS endpoint URL (e.g. https://myagent.azurewebsites.net/api/messages). Store as messagingEndpoint.
If Local / Dev Tunnel (option 2):auto-start the tunnel — do NOT ask the user to paste a URL.
Dev Tunnel Setup (auto-start)
Verify CLI is installed:devtunnel --version. If it fails, install it and stop until the user confirms:
Verify login:devtunnel user show. If it exits non-zero or prints "not logged in", run devtunnel user login (or devtunnel user login --device-code on headless machines), wait for the user to complete sign-in, then retry devtunnel user show.
Create the tunnel + port (idempotent — treat "already exists" as success). The port is the agent's listening port — 3978 for Node.js / Python, the .NET project's launch port for .NET (default 5000):
devtunnel create <agent-name>-tunnel --allow-anonymous
devtunnel port create <agent-name>-tunnel -p <port>
Parse the Tunnel ID from the create output — format is <id>.<cluster> (e.g. abc123xy.usw3).
Start hosting in the background — this is a long-running process. Run with run_in_background=true so the tunnel keeps running while the skill continues; the user does NOT need a separate terminal:
devtunnel host <agent-name>-tunnel
Resolve the public URL deterministically — it is https://<id-without-cluster>-<port>.<cluster>.devtunnels.ms. Example: tunnel ID abc123xy.usw3 + port 3978 → https://abc123xy-3978.usw3.devtunnels.ms. Sanity-check with devtunnel show <agent-name>-tunnel and confirm the printed Access URL matches.
Store tunnelUrl and set messagingEndpoint = "${tunnelUrl}/api/messages". Tell the user verbatim: "Dev tunnel started at <URL>. Hosting in the background — leave this session open. Using this endpoint for a365 setup all."
Tunnel not reachable: confirm --allow-anonymous flag was used and the agent process is listening on the configured port.
Phase 2 — Register with Agent 365
2.0 — Guardrail: route AI Teammate agents away
This skill is for Agent (Non AI Teammate) registration only. Re-read .a365-workspace-detection.local.json:
If agentType = "ai-teammate" (stale cache from a prior session, or user picked the wrong skill): abort this skill and tell the user verbatim: "This agent is registered as an AI Teammate. The make-a365-agent skill handles non-AI-Teammate agents only — appending --authmode obo|s2s to a365 setup all would conflict with --aiteammate. Switch to /agent365:make-ai-teammate instead, which uses a365 setup all --aiteammate --m365 and never passes --authmode." Do NOT proceed to 2.1.
If agentType = "system-agent" (or unset): proceed to 2.1.
2.1 — Dry-run preview (REQUIRED before applying anything)
cd"<project_dir>" && a365 setup all --agent-name <agent_name> --dry-run
--authmode flag: If the user's auth mode is known from .a365-workspace-detection.local.json, append --authmode obo or --authmode s2s to all setup all commands. This controls how the agent identity SP receives permissions (OBO = principal-scoped delegated grants, S2S = application app-role assignments requiring GA).
Show the full dry-run output to the user, then ask:
"Here's what a365 setup all will create. Does this look correct? Type yes to proceed or no to abort."
no: Stop. Tell the user "Setup cancelled. Run the make-a365-agent skill again when ready."
yes: Proceed to 2.2.
2.2 — Apply setup
⚠️ a365 setup all is long-running and block-buffers under chat-tool execution. If output stalls, see AGENTS.md § CLI output buffering under chat-tool execution — preferred remediation is run_in_background: true (Claude Code Bash tool); fallback is hand-off to a separate terminal.
Choose the right flags based on the detected agent type:
# Agent (Non AI Teammate) — defaultcd"<project_dir>" && a365 setup all --agent-name <agent_name>
# With explicit auth mode (append based on .a365-workspace-detection.local.json authMode)cd"<project_dir>" && a365 setup all --agent-name <agent_name> --authmode obo
cd"<project_dir>" && a365 setup all --agent-name <agent_name> --authmode s2s
# Custom Engine Agent (CEA) with Teams/Copilot integration — add --m365cd"<project_dir>" && a365 setup all --agent-name <agent_name> --m365
For CEA agents (usesTeamsOrCopilot = 1): after setup all, also run the bot permission step:
a365 setup permissions bot
This is required for Messaging Bot API grants and must follow setup all (which handles permissions mcp).
This command:
Creates the Agent 365 Blueprint in Entra ID (agent identity + app registration)
Grants required Entra ID permissions
For registration: makes the agent findable in the Agent 365 catalog
For Custom Engine Agents (--m365): registers the endpoint via MCP Platform
Monitor output carefully:
The CLI logs progress in numbered steps (e.g. [1/5]). Watch for errors or warnings.
Existing resources from a previous run are skipped — this is expected behavior.
If the command fails or prints any error/warning block: show the full CLI output verbatim before consulting the error table below.
Windows Account Manager (WAM): If you see "Authenticating via Windows Account Manager..." in the output, a native Windows sign-in dialog has appeared. Do NOT kill the process. Tell the user: "A Windows sign-in dialog has appeared — please complete it. Setup will continue automatically after you sign in."
If no dialog appears on a headless machine: Ctrl+C, run az login --allow-no-subscriptions to populate the token cache, then retry.
Conditional Access Policy (CAP): If WAM/browser auth is blocked by CAP (AADSTS53003, AADSTS53000), the CLI automatically falls back to device code flow — no user action needed.
Handle these conditions:
Condition
Action
Graph API Forbidden / Authorization_RequestDenied
Stop. Resolve permission issue (return to a365-setup Step 2 or grant the role). Then re-run.
Interactive browser auth required
If headless, instruct user to use az login --device-code first.
managerApplications error / blueprint rejected
Blueprint was created before May 2025 and lacks managerApplications. Delete and re-run a365 setup all, or patch via Graph API.
AADSTS700016 / Authorization_IdentityNotFound immediately after blueprint creation
Entra replication lag — the CLI retries automatically with exponential back-off (up to 5× for identity, 12× for blueprint token, 60-second cap). No manual retry needed; wait for the CLI to complete.
a365 setup all is idempotent — safe to re-run after fixing an issue.
2.3 — Show setup output
After a365 setup all completes, show the user:
The Setup Summary table from CLI output — verbatim.
Agent365.Observability.OtelWrite is automatically granted to the agent identity by a365 setup all — no GA consent step required for newly provisioned agents. If the CLI output includes a "Permission Grants" action item (upgrade scenario for pre-1.1 agents), display the PowerShell script verbatim so the user can hand it to a Global Admin.
Skip the client secret action item entirely. Do not show or mention it.
Mark Todo 1 as completed.
Phase 3 — Add Observability (Optional)
Mark Todo 2 in-progress.
Ask the user:
Your agent is provisioned. Observability lets you track every message, LLM call, and tool
invocation in the Agent 365 portal and Microsoft Defender.
Would you like to add observability now?
• yes — I'll run the instrument-observability skill now
• skip — you can add it later by running the instrument-observability skill
If yes:Read${CLAUDE_PLUGIN_ROOT}/skills/instrument-observability/SKILL.md and follow it.
The skill will detect the project language and wire up OTel + A365 tracing exporter.
If skip: Note that the user can run the instrument-observability skill at any time.
Mark Todo 2 as completed when done (or skipped by user).
Phase 4 — Add WorkIQ Tools (Optional)
Mark Todo 3 in-progress.
If authMode = s2s: Skip this phase entirely — WorkIQ is not available for S2S agents (requires a user token). Mark Todo 3 as completed and proceed to Phase 5.
Ask the user:
Would you like to add WorkIQ tools? These give your agent access to Microsoft 365 data —
email, calendar, Teams messages, SharePoint files, OneDrive, and more.
Note: WorkIQ MCP calls use OAuth On-Behalf-Of (OBO) tokens. Users will be prompted to
consent the first time the agent accesses their data.
• yes — I'll run the add-workiq-tools skill now
• skip — you can add it later by running the add-workiq-tools skill
If yes:Read${CLAUDE_PLUGIN_ROOT}/skills/add-workiq-tools/SKILL.md and follow it.
If skip: Note that the user can run the add-workiq-tools skill at any time.
Mark Todo 3 as completed when done (or skipped by user).
Phase 5 — Final Summary
Show the user a summary:
✅ Agent provisioned with Agent 365!
Your agent now has:
• Blueprint: Created in Entra ID (Blueprint ID in `a365.generated.config.json`)
• Register: Agent appears in the Agent 365 catalog
[• Observability: OpenTelemetry + A365 tracing exporter wired] (if added)
[• WorkIQ tools: M365 data access via MCP] (if added)
Next steps:
1. If admin consent was required, ensure a Global Admin has run the PowerShell script.
2. Test discovery: search for your agent in Microsoft 365 apps.
3. Add observability: run the instrument-observability skill (if not done)
4. Add WorkIQ tools: run the add-workiq-tools skill (if not done)
Error Handling
CLI error surfacing: When any CLI command exits non-zero or prints a warning or error line, show the complete output verbatim in a fenced code block before suggesting a fix. Do not abstract, paraphrase, or discard CLI output — the exact error message is always more useful than a summary. If the error is not in the table below, display it and ask the user how to proceed.
Run failing commands with -v / --verbose for detailed logs.
Manage and locate CLI diagnostic logs via a365 logs --help. Log files live at Windows %APPDATA%/a365/logs/, Linux/Mac ~/.config/a365/logs/.
Most a365 commands are idempotent — safe to re-run after fixing an issue.
For a full cleanup of a config-free agent: a365 cleanup --agent-name <name>. For granular cleanup: a365 cleanup blueprint, a365 cleanup azure, or a365 cleanup instance. Use only as a last resort.
