A365 Setup

Agent 365 CLI Setup

> Trigger phrases — any of these will activate this skill automatically: > - "set up agent 365 for this agent" > - "run a365 setup" > - "onboard this agent to agent 365" > - "register this agent with agent 365" > - "provision this agent with agent 365" > - "add agent 365 to this agent" > - "connect this agent to agent 365" > - "make this agent an a365 agent" > - "make this agent discoverable in Agent 365" > - "create a365 blueprint" > - "start agent 365 setup"

---

> YOUR VERY FIRST ACTION: Output the intro message below to the user, then silently detect the agent stack. Do NOT create todos, run setup commands, or read further until all Phase 1 questions are answered.

MANDATORY INTRO MESSAGE — output this before doing anything else:

I'll help you set up Agent 365 for this agent. Here's what I'll do:

  1. Detect your agent type, stack, and language (silently, takes a few seconds)
  2. Ask you to confirm what I found — or correct anything I got wrong
  3. Ask how your agent authenticates (OBO / S2S)
  4. Ask which capabilities you want (Register, Observability, WorkIQ, AI Teammate)

After those answers, I'll install any missing prerequisites, validate your Azure
environment, and hand off to the right skill for the rest of setup.

Detecting your agent now…

RULE 1 — DETECT AGENT STACK AND CODE, ASK VALIDATION QUESTIONS, THEN CREATE ALL TODOS.

Phase 1A: Silent Detection

First: Check for detection cache. Read .a365-workspace-detection.local.json if it exists. If detectedAt is within the last 60 minutes, load agentStack, programmingLanguage, and usesTeamsOrCopilot from it and skip the detection steps below — go straight to Phase 1B.

Run all three detection steps in parallel (single tool call with multiple Glob/Grep):

Step 1: Detect Agent Stack → Store as agentStack

• Check for .csproj + Microsoft.Agents.* → Agent Framework
• Check for package.json + @langchain → LangChain
• Check for package.json + "openai" (no LangChain) → OpenAI
• Check for requirements.txt + langchain → LangChain
• Check for requirements.txt + openai → OpenAI

Step 2: Detect Programming Language → Store as programmingLanguage

• .csproj exists → DotNet
• package.json exists → NodeJS
• requirements.txt OR .py files → Python

Step 3: Detect Agent Type → Store as usesTeamsOrCopilot

Check the following signals in parallel (Glob + Grep).

Strong standalone signals — any one → CEA:

• Grep "copilotAgents" AND "customEngineAgents" in manifest.json / appPackage/manifest.json / manifest/manifest.json (definitive — Teams v1.22+ AI Teammate marker; see shared/agent-detection.md for the example block)
• teamsapp.yml or teamsapp.local.yml exists (Teams Toolkit project)
• @microsoft/teams-ai in package.json (Teams AI SDK — Node.js specific)
• Microsoft.Teams.AI in .csproj (.NET Teams AI SDK)
• teams-ai in requirements.txt or pyproject.toml (Python Teams AI SDK)

Paired signals — CEA only if also matched by a structural file signal above:

• "botbuilder" in package.json + structural marker → CEA (generic Bot Framework; standalone = channel bot risk)
• Microsoft.Bot.Builder in .csproj + structural marker → CEA
• botbuilder-core in requirements.txt or pyproject.toml + structural marker → CEA
• BOT_ID, MicrosoftAppId, or TEAMS_APP_ID in .env/appsettings.json + structural marker → CEA

If no strong standalone signal and no valid pairing → 0 (Agent (Non AI Teammate), no M365 integration detected — may be a non-M365 CEA or other Agent (Non AI Teammate) type)

Step 4: Detect Existing Blueprint → Store as hasBlueprintConfig

Check in parallel:

• a365.config.json exists in the project root
• a365.generated.config.json exists in the project root

If either file exists → hasBlueprintConfig = 1. Read the blueprint ID using the correct field name for each file:

• a365.config.json → read blueprintId
• a365.generated.config.json → read agentBlueprintId

Store whichever is present as existingBlueprintId (may be empty if not yet set). Otherwise → hasBlueprintConfig = 0

Step 5: Detect skill-state signals → store as has_aiteammate_structure, has_obs, has_workiq

Run all checks in parallel (Glob + Grep). These three primary flags are written to the detection cache. hasAITeammateChanges is no longer stored — it is derived inline as has_aiteammate_structure && has_obs wherever the legacy concept is needed.

AI Teammate structure signals (from make-ai-teammate) — has_aiteammate_structure = 1 if any one matches:

• AgentApplication in src/**/*.ts, **/*.cs, or **/*.py
• CloudAdapter in src/**/*.ts or CloudAdapterAiohttp in **/*.py
• @microsoft/agents-a365-notifications in package.json
• Microsoft.Agents.A365.Notifications in **/*.csproj
• ToolingManifest.json exists

Observability signals (from instrument-observability) — has_obs = 1 ONLY when the new Microsoft.OpenTelemetry distro API call is present in source. Package presence alone is NOT enough — legacy Microsoft.Agents.A365.Observability.* / @microsoft/agents-a365-observability / microsoft-agents-a365-observability-* packages might exist without the distro being wired (or the package was added but never called). The source-call check ensures instrument-observability re-runs and upgrades partial / legacy wiring onto the current distro. has_obs = 1 if any one matches:

• UseMicrosoftOpenTelemetry in any **/*.cs (.NET)
• useMicrosoftOpenTelemetry in any src/**/*.ts (Node.js)
• use_microsoft_opentelemetry in any **/*.py (Python)

Do NOT count: package-name-only matches (the legacy or new distro package could be installed without the API being called); A365 Observability source comments (they outlive the code they reference). If only those weak signals match, treat has_obs = 0 and let instrument-observability run to bring the agent onto the current distro.

WorkIQ signal — has_workiq = 1 if:

• ToolingManifest.json exists AND its top-level mcpServers (or servers in legacy v1 schema) array is non-empty. Parse the JSON; at least one entry → has_workiq = 1.

These three flags drive the 8-row state matrix used by make-ai-teammate Phase 0C and by the a365-setup capabilities menu / auth-mode question below.

Derived (computed inline, not stored):

hasAITeammateChanges = has_aiteammate_structure && has_obs

This is the legacy flag that controlled "auto-detect already-an-AI-Teammate" routing. Compute it on demand wherever needed.

Phase 1B: User Validation Questions

Present all detections in a single message and wait for ONE response:

Here's what we detected about your agent:
  • Stack:             {agentStack}
  • Language:          {programmingLanguage}
  • Agent type:        {usesTeamsOrCopilot == 1
                         ? "M365 Custom Engine Agent (CEA) — has Teams/Copilot integration"
                         : "Agent (Non AI Teammate) — no Teams/Copilot markers detected"}
  • AI Teammate setup: {(has_aiteammate_structure && has_obs)
                         ? "already configured (make-ai-teammate + observability detected)"
                         : "not yet configured"}
  • Observability:     {has_obs ? "already wired" : "not yet wired"}
  • WorkIQ tools:      {has_workiq ? "already wired" : "not yet wired"}
  • Blueprint:         {hasBlueprintConfig == 1
                         ? "existing config found" + (existingBlueprintId ? " (ID: " + existingBlueprintId + ")" : "")
                         : "none found — will create new"}

Reply **yes** to confirm, or describe any corrections.
Examples: "language is NodeJS", "it's a Custom Engine Agent", "it's not Teams".

• If the user replies yes / y: accept all values and proceed to the blueprint question (if applicable), then the capabilities question.
• If the user says it's a CEA / Custom Engine Agent: set usesTeamsOrCopilot = 1 and proceed.
• If the user says it's Non-M365 / no Teams integration: set usesTeamsOrCopilot = 0 and proceed.
• If the user describes other corrections: update the relevant variable(s) and proceed.

Blueprint question (ask only when hasBlueprintConfig = 1):

I found an existing Agent 365 config in this project. What would you like to do?

  1. Reuse the existing blueprint — provide your blueprint ID and I'll skip setup all
  2. Create a fresh blueprint — runs a365 setup all and overwrites the existing config

Wait for the answer:

• If 1 (reuse): ask "What is your blueprint ID?" if existingBlueprintId is empty. Store as existingBlueprintId. Set reuseBlueprint = true. Downstream skills will skip a365 setup all and use this ID directly.

> Compatibility check: Blueprints created before May 2025 may lack the required managerApplications field — the platform now rejects them. If any downstream call (a365 query-entra, a365 publish, instance provisioning) reports a managerApplications error, fall back to fresh provisioning by re-running a365 setup all (or patch the blueprint via the Graph API).

• If 2 (fresh): set reuseBlueprint = false. Proceed normally — a365 setup all will run as usual.

---

Capabilities question — ask first, before auth mode:

If usesTeamsOrCopilot = 1 (CEA), do not ask — automatically set capabilities = [Register, Observability, WorkIQ, AI Teammate] and tell the user:

> "Custom Engine Agents can only be configured as AI Teammates. Register, Observability, WorkIQ, and AI Teammate have been selected automatically."

Otherwise, compute hasAITeammateChanges = has_aiteammate_structure && has_obs and filter the menu:

• If hasAITeammateChanges = true (already an AI Teammate): only present these options (Observability and AI Teammate are already configured):

1. Register — make the agent findable in the Agent 365 catalog
2. WorkIQ — add WorkIQ MCP servers (M365 data: email, calendar, Teams, SharePoint, OneDrive) — hide this row if has_workiq = true

• Otherwise, present all options:

1. Register — make the agent findable in the Agent 365 catalog
2. Observability — end-to-end activity tracing for every message, LLM call, and tool use, visible in the Agent 365 portal and Microsoft Defender — hide this row if has_obs = true
3. WorkIQ — add WorkIQ MCP servers (M365 data: email, calendar, Teams, SharePoint, OneDrive) — hide this row if has_workiq = true
4. AI Teammate — agent gets a first-class M365 identity (Agentic User with UPN). AI Teammates interact with productivity workflows using their own identity

Wait for the answer. Store as capabilities.

Auth mode question — ask only if AI Teammate is NOT in capabilities AND hasAITeammateChanges (derived) is false:

• If hasAITeammateChanges = true (derived = has_aiteammate_structure && has_obs): set authMode = "agentic-user" — the agent is already an AI Teammate (existing structure detected); skip the auth mode question.

• If capabilities includes AI Teammate: set authMode = "agentic-user" — AI Teammate uses the Agentic User identity (the agent's own M365 identity, not the caller's token). --authmode is not used with --aiteammate.

• Otherwise (no AI Teammate in capabilities AND hasAITeammateChanges derived = false), ask:

How will your agent authenticate when calling downstream APIs?

  1. On-behalf-of (OBO) — agent acts as the signed-in user (delegated permissions)
     e.g. reading a user's calendar, sending mail on their behalf

  2. Service-to-service (S2S) — agent acts as its own identity (application permissions)
     e.g. unattended background processing, tenant-wide access without a signed-in user

Wait for the answer:

• If 1 → authMode = "obo"
• If 2 → authMode = "s2s". If capabilities includes WorkIQ, warn the user and remove it:

> "⚠️ WorkIQ requires a delegated user token (OBO) and is not available for S2S agents. WorkIQ has been removed from your selected capabilities."

> Note: Options can be combined — e.g. a user can say "1 and 2" for Register + Observability.

> AI Teammate auto-select: If the user selects option 4 (AI Teammate), automatically include options 1 (Register) and 2 (Observability) — set capabilities = [Register, Observability, AI Teammate] and inform the user: "AI Teammate includes Register and Observability automatically. WorkIQ tools are optional and will be offered during make-ai-teammate."

Phase 1C: Determine Path and Create Todos

After the capabilities question is answered (and the detection/confirmation above is complete):

1. Set isAITeammate = true if AI Teammate is in capabilities (whether auto-set or user-selected) OR (has_aiteammate_structure && has_obs) (existing AI Teammate structure detected — already configured). Else isAITeammate = false.

1. Write .a365-workspace-detection.local.json now (see agent-detection.md cache format). Include agentType derived from isAITeammate and authMode collected above:

• isAITeammate = true → agentType: "ai-teammate"
• isAITeammate = false → agentType: "system-agent"
• Write authMode as collected ("obo" or "s2s" for non-AI Teammate; "agentic-user" for AI Teammate).
• Write the three primary state flags from Phase 1A Step 5: has_aiteammate_structure (1/0), has_obs (1/0), has_workiq (1/0). Do NOT write hasAITeammateChanges — it is derived inline (has_aiteammate_structure && has_obs) at read sites.
• Write hasBlueprintConfig, existingBlueprintId, and reuseBlueprint as determined above. These are point-in-time snapshots from this skill's run — downstream skills (make-ai-teammate, instrument-observability) re-derive disk_blueprint_present from a365.generated.config.json at read-time, and require session-level verification (Step 9.7.1a in make-ai-teammate's three-way prompt) before treating the blueprint claim as authoritative. The cached values exist for debugging and this skill's own end-of-run summary — they will go stale if the user runs a365 setup all or a365 cleanup between skill invocations.

1. Derive registrationType from Phase 1A signals (do not ask the user):

• registrationType = 1 if usesTeamsOrCopilot = 1 (CEA — Entra app ID path)
• registrationType = 3 if usesTeamsOrCopilot = 0 (Agent (Non AI Teammate) / no M365 integration path)
• (registrationType = 2 — Blueprint already exists — is set by make-ai-teammate, not here)

Then create all todos for the path and mark Todo 1 in-progress:

AI Teammate path — isAITeammate = true (3 todos total):

• Todo 1: Step 1: Install and Verify All Prerequisites
• Todo 2: Step 2: Ensure Prerequisites and Environment Configuration
• Todo 3: Step 3: Run the make-ai-teammate skill

Agent (Non AI Teammate) path — registrationType = 3, isAITeammate = false (3 todos total):

• Todo 1: Step 1: Install and Verify All Prerequisites
• Todo 2: Step 2: Ensure Prerequisites and Environment Configuration
• Todo 3: Step 3: Run the make-a365-agent skill

Entra app ID path — registrationType = 1, isAITeammate = false (3 todos total):

• Todo 1: Step 1: Install and Verify All Prerequisites
• Todo 2: Step 2: Ensure Prerequisites and Environment Configuration
• Todo 3: Step 3: Run the make-a365-agent skill

RULE 2 — ALWAYS BEGIN FROM STEP 1. Run the quick scan version checks in every session. After the quick scan, only process sections for tools marked ❌ (missing or outdated) — skip every section whose tool shows ✅ and meets the minimum version. Do NOT re-prompt or reinstall tools that are already present. Step 3 is always the final step — it delegates to the appropriate skill based on isAITeammate.

RULE 3 — SUB-SECTIONS ARE NOT SEPARATE TODOS. Each ## Step has internal sub-sections — these are tasks WITHIN that ste

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: microsoft
• Source: microsoft/agent365-skills
• License: MIT

Install and usage instructions live in the source repository linked above.