# A365 Setup

> >

- **Type:** Skill
- **Install:** `agentstack add skill-microsoft-agent365-skills-a365-setup`
- **Verified:** Pending review
- **Seller:** [microsoft](https://agentstack.voostack.com/s/microsoft)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [microsoft](https://github.com/microsoft)
- **Source:** https://github.com/microsoft/agent365-skills/tree/main/plugins/agent365/skills/a365-setup

## Install

```sh
agentstack add skill-microsoft-agent365-skills-a365-setup
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Agent 365 CLI Setup

> **Trigger phrases** — any of these will activate this skill automatically:
> - "set up agent 365 for this agent"
> - "run a365 setup"
> - "onboard this agent to agent 365"
> - "register this agent with agent 365"
> - "provision this agent with agent 365"
> - "add agent 365 to this agent"
> - "connect this agent to agent 365"
> - "make this agent an a365 agent"
> - "make this agent discoverable in Agent 365"
> - "create a365 blueprint"
> - "start agent 365 setup"

---

> **YOUR VERY FIRST ACTION:** Output the intro message below to the user, then silently detect the agent stack. Do NOT create todos, run setup commands, or read further until all Phase 1 questions are answered.

**MANDATORY INTRO MESSAGE — output this before doing anything else:**

```
I'll help you set up Agent 365 for this agent. Here's what I'll do:

  1. Detect your agent type, stack, and language (silently, takes a few seconds)
  2. Ask you to confirm what I found — or correct anything I got wrong
  3. Ask how your agent authenticates (OBO / S2S)
  4. Ask which capabilities you want (Register, Observability, WorkIQ, AI Teammate)

After those answers, I'll install any missing prerequisites, validate your Azure
environment, and hand off to the right skill for the rest of setup.

Detecting your agent now…
```

**RULE 1 — DETECT AGENT STACK AND CODE, ASK VALIDATION QUESTIONS, THEN CREATE ALL TODOS.**

### Phase 1A: Silent Detection

**First: Check for detection cache.** Read `.a365-workspace-detection.local.json` if it exists. If `detectedAt` is within the last 60 minutes, load `agentStack`, `programmingLanguage`, and `usesTeamsOrCopilot` from it and skip the detection steps below — go straight to Phase 1B.

Run all three detection steps **in parallel** (single tool call with multiple Glob/Grep):

**Step 1: Detect Agent Stack** → Store as `agentStack`
- Check for .csproj + Microsoft.Agents.* → `Agent Framework`
- Check for package.json + @langchain → `LangChain`  
- Check for package.json + "openai" (no LangChain) → `OpenAI`
- Check for requirements.txt + langchain → `LangChain`
- Check for requirements.txt + openai → `OpenAI`

**Step 2: Detect Programming Language** → Store as `programmingLanguage`
- .csproj exists → `DotNet`
- package.json exists → `NodeJS`
- requirements.txt OR .py files → `Python`

**Step 3: Detect Agent Type** → Store as `usesTeamsOrCopilot`

Check the following signals **in parallel** (Glob + Grep).

*Strong standalone signals — any one → CEA:*
- Grep `"copilotAgents"` AND `"customEngineAgents"` in `manifest.json` / `appPackage/manifest.json` / `manifest/manifest.json` (definitive — Teams v1.22+ AI Teammate marker; see `shared/agent-detection.md` for the example block)
- `teamsapp.yml` or `teamsapp.local.yml` exists (Teams Toolkit project)
- `@microsoft/teams-ai` in package.json (Teams AI SDK — Node.js specific)
- `Microsoft.Teams.AI` in .csproj (.NET Teams AI SDK)
- `teams-ai` in requirements.txt or pyproject.toml (Python Teams AI SDK)

*Paired signals — CEA only if also matched by a structural file signal above:*
- `"botbuilder"` in package.json + structural marker → CEA (generic Bot Framework; standalone = channel bot risk)
- `Microsoft.Bot.Builder` in .csproj + structural marker → CEA
- `botbuilder-core` in requirements.txt or pyproject.toml + structural marker → CEA
- `BOT_ID`, `MicrosoftAppId`, or `TEAMS_APP_ID` in .env/appsettings.json + structural marker → CEA

If no strong standalone signal and no valid pairing → `0` (Agent (Non AI Teammate), no M365 integration detected — may be a non-M365 CEA or other Agent (Non AI Teammate) type)

**Step 4: Detect Existing Blueprint** → Store as `hasBlueprintConfig`

Check **in parallel**:
- `a365.config.json` exists in the project root
- `a365.generated.config.json` exists in the project root

If either file exists → `hasBlueprintConfig = 1`. Read the blueprint ID using the correct field name for each file:
- `a365.config.json` → read `blueprintId`
- `a365.generated.config.json` → read `agentBlueprintId`

Store whichever is present as `existingBlueprintId` (may be empty if not yet set).
Otherwise → `hasBlueprintConfig = 0`

**Step 5: Detect skill-state signals** → store as `has_aiteammate_structure`, `has_obs`, `has_workiq`

Run all checks **in parallel** (Glob + Grep). These three primary flags are written to the detection cache. `hasAITeammateChanges` is no longer stored — it is **derived inline** as `has_aiteammate_structure && has_obs` wherever the legacy concept is needed.

*AI Teammate structure signals (from `make-ai-teammate`) — `has_aiteammate_structure = 1` if any one matches:*
- `AgentApplication` in `src/**/*.ts`, `**/*.cs`, or `**/*.py`
- `CloudAdapter` in `src/**/*.ts` or `CloudAdapterAiohttp` in `**/*.py`
- `@microsoft/agents-a365-notifications` in `package.json`
- `Microsoft.Agents.A365.Notifications` in `**/*.csproj`
- `ToolingManifest.json` exists

*Observability signals (from `instrument-observability`) — `has_obs = 1` ONLY when the new **Microsoft.OpenTelemetry distro API call** is present in source. Package presence alone is NOT enough — legacy `Microsoft.Agents.A365.Observability.*` / `@microsoft/agents-a365-observability` / `microsoft-agents-a365-observability-*` packages might exist without the distro being wired (or the package was added but never called). The source-call check ensures `instrument-observability` re-runs and upgrades partial / legacy wiring onto the current distro. `has_obs = 1` if any one matches:*

- `UseMicrosoftOpenTelemetry` in any `**/*.cs` (.NET)
- `useMicrosoftOpenTelemetry` in any `src/**/*.ts` (Node.js)
- `use_microsoft_opentelemetry` in any `**/*.py` (Python)

Do NOT count: package-name-only matches (the legacy or new distro package could be installed without the API being called); `A365 Observability` source comments (they outlive the code they reference). If only those weak signals match, treat `has_obs = 0` and let `instrument-observability` run to bring the agent onto the current distro.

*WorkIQ signal — `has_workiq = 1` if:*
- `ToolingManifest.json` exists AND its top-level `mcpServers` (or `servers` in legacy v1 schema) array is non-empty. Parse the JSON; at least one entry → `has_workiq = 1`.

These three flags drive the 8-row state matrix used by `make-ai-teammate` Phase 0C and by the `a365-setup` capabilities menu / auth-mode question below.

**Derived (computed inline, not stored):**

```
hasAITeammateChanges = has_aiteammate_structure && has_obs
```

This is the legacy flag that controlled "auto-detect already-an-AI-Teammate" routing. Compute it on demand wherever needed.

### Phase 1B: User Validation Questions

Present **all detections in a single message** and wait for ONE response:

```
Here's what we detected about your agent:
  • Stack:             {agentStack}
  • Language:          {programmingLanguage}
  • Agent type:        {usesTeamsOrCopilot == 1
                         ? "M365 Custom Engine Agent (CEA) — has Teams/Copilot integration"
                         : "Agent (Non AI Teammate) — no Teams/Copilot markers detected"}
  • AI Teammate setup: {(has_aiteammate_structure && has_obs)
                         ? "already configured (make-ai-teammate + observability detected)"
                         : "not yet configured"}
  • Observability:     {has_obs ? "already wired" : "not yet wired"}
  • WorkIQ tools:      {has_workiq ? "already wired" : "not yet wired"}
  • Blueprint:         {hasBlueprintConfig == 1
                         ? "existing config found" + (existingBlueprintId ? " (ID: " + existingBlueprintId + ")" : "")
                         : "none found — will create new"}

Reply **yes** to confirm, or describe any corrections.
Examples: "language is NodeJS", "it's a Custom Engine Agent", "it's not Teams".
```

- If the user replies **yes / y**: accept all values and proceed to the blueprint question (if applicable), then the capabilities question.
- If the user says it's a CEA / Custom Engine Agent: set `usesTeamsOrCopilot = 1` and proceed.
- If the user says it's Non-M365 / no Teams integration: set `usesTeamsOrCopilot = 0` and proceed.
- If the user describes other corrections: update the relevant variable(s) and proceed.

**Blueprint question (ask only when `hasBlueprintConfig = 1`):**

```
I found an existing Agent 365 config in this project. What would you like to do?

  1. Reuse the existing blueprint — provide your blueprint ID and I'll skip setup all
  2. Create a fresh blueprint — runs a365 setup all and overwrites the existing config
```

Wait for the answer:
- If **1 (reuse)**: ask "What is your blueprint ID?" if `existingBlueprintId` is empty. Store as `existingBlueprintId`. Set `reuseBlueprint = true`. Downstream skills will skip `a365 setup all` and use this ID directly.
  > **Compatibility check:** Blueprints created before May 2025 may lack the required `managerApplications` field — the platform now rejects them. If any downstream call (`a365 query-entra`, `a365 publish`, instance provisioning) reports a `managerApplications` error, fall back to fresh provisioning by re-running `a365 setup all` (or patch the blueprint via the Graph API).
- If **2 (fresh)**: set `reuseBlueprint = false`. Proceed normally — `a365 setup all` will run as usual.

---

**Capabilities question — ask first, before auth mode:**

If `usesTeamsOrCopilot = 1` (CEA), **do not ask** — automatically set `capabilities = [Register, Observability, WorkIQ, AI Teammate]` and tell the user:

> "Custom Engine Agents can only be configured as AI Teammates. **Register**, **Observability**, **WorkIQ**, and **AI Teammate** have been selected automatically."

Otherwise, compute `hasAITeammateChanges = has_aiteammate_structure && has_obs` and filter the menu:

- **If `hasAITeammateChanges = true`** (already an AI Teammate): only present these options (Observability and AI Teammate are already configured):

  1. Register — make the agent findable in the Agent 365 catalog
  2. WorkIQ — add WorkIQ MCP servers (M365 data: email, calendar, Teams, SharePoint, OneDrive) — **hide this row if `has_workiq = true`**

- **Otherwise**, present all options:

  1. Register — make the agent findable in the Agent 365 catalog
  2. Observability — end-to-end activity tracing for every message, LLM call, and tool use, visible in the Agent 365 portal and Microsoft Defender — **hide this row if `has_obs = true`**
  3. WorkIQ — add WorkIQ MCP servers (M365 data: email, calendar, Teams, SharePoint, OneDrive) — **hide this row if `has_workiq = true`**
  4. AI Teammate — agent gets a first-class M365 identity (Agentic User with UPN). AI Teammates interact with productivity workflows using their own identity

Wait for the answer. Store as `capabilities`.

**Auth mode question — ask only if AI Teammate is NOT in capabilities AND `hasAITeammateChanges` (derived) is false:**

- If `hasAITeammateChanges = true` (derived = `has_aiteammate_structure && has_obs`): set `authMode = "agentic-user"` — the agent is already an AI Teammate (existing structure detected); skip the auth mode question.

- If `capabilities` includes **AI Teammate**: set `authMode = "agentic-user"` — AI Teammate uses the Agentic User identity (the agent's own M365 identity, not the caller's token). `--authmode` is not used with `--aiteammate`.

- Otherwise (no AI Teammate in capabilities AND `hasAITeammateChanges` derived = false), ask:

```
How will your agent authenticate when calling downstream APIs?

  1. On-behalf-of (OBO) — agent acts as the signed-in user (delegated permissions)
     e.g. reading a user's calendar, sending mail on their behalf

  2. Service-to-service (S2S) — agent acts as its own identity (application permissions)
     e.g. unattended background processing, tenant-wide access without a signed-in user
```

  Wait for the answer:
  - If 1 → `authMode = "obo"`
  - If 2 → `authMode = "s2s"`. If `capabilities` includes WorkIQ, warn the user and remove it:
    > "⚠️ WorkIQ requires a delegated user token (OBO) and is not available for S2S agents. WorkIQ has been removed from your selected capabilities."

> **Note:** Options can be combined — e.g. a user can say "1 and 2" for Register + Observability.

> **AI Teammate auto-select:** If the user selects option 4 (AI Teammate), automatically include options 1 (Register) and 2 (Observability) — set `capabilities = [Register, Observability, AI Teammate]` and inform the user: "AI Teammate includes Register and Observability automatically. WorkIQ tools are optional and will be offered during make-ai-teammate."

### Phase 1C: Determine Path and Create Todos

After the capabilities question is answered (and the detection/confirmation above is complete):

1. Set `isAITeammate = true` if **AI Teammate** is in `capabilities` (whether auto-set or user-selected) **OR** `(has_aiteammate_structure && has_obs)` (existing AI Teammate structure detected — already configured). Else `isAITeammate = false`.

2. **Write `.a365-workspace-detection.local.json`** now (see `agent-detection.md` cache format). Include `agentType` derived from `isAITeammate` and `authMode` collected above:
   - `isAITeammate = true` → `agentType: "ai-teammate"`
   - `isAITeammate = false` → `agentType: "system-agent"`
   - Write `authMode` as collected (`"obo"` or `"s2s"` for non-AI Teammate; `"agentic-user"` for AI Teammate).
   - Write the three primary state flags from Phase 1A Step 5: `has_aiteammate_structure` (`1`/`0`), `has_obs` (`1`/`0`), `has_workiq` (`1`/`0`). **Do NOT write `hasAITeammateChanges`** — it is derived inline (`has_aiteammate_structure && has_obs`) at read sites.
   - Write `hasBlueprintConfig`, `existingBlueprintId`, and `reuseBlueprint` as determined above. **These are point-in-time snapshots from this skill's run** — downstream skills (make-ai-teammate, instrument-observability) re-derive `disk_blueprint_present` from `a365.generated.config.json` at read-time, and require session-level verification (Step 9.7.1a in make-ai-teammate's three-way prompt) before treating the blueprint claim as authoritative. The cached values exist for debugging and this skill's own end-of-run summary — they will go stale if the user runs `a365 setup all` or `a365 cleanup` between skill invocations.

3. Derive `registrationType` from Phase 1A signals (do not ask the user):
   - `registrationType = 1` if `usesTeamsOrCopilot = 1` (CEA — Entra app ID path)
   - `registrationType = 3` if `usesTeamsOrCopilot = 0` (Agent (Non AI Teammate) / no M365 integration path)
   - (`registrationType = 2` — Blueprint already exists — is set by make-ai-teammate, not here)

Then create all todos for the path and mark Todo 1 in-progress:

**AI Teammate path** — `isAITeammate = true` (3 todos total):
- Todo 1: `Step 1: Install and Verify All Prerequisites`
- Todo 2: `Step 2: Ensure Prerequisites and Environment Configuration`
- Todo 3: `Step 3: Run the make-ai-teammate skill`

**Agent (Non AI Teammate) path** — `registrationType = 3, isAITeammate = false` (3 todos total):
- Todo 1: `Step 1: Install and Verify All Prerequisites`
- Todo 2: `Step 2: Ensure Prerequisites and Environment Configuration`
- Todo 3: `Step 3: Run the make-a365-agent skill`

**Entra app ID path** — `registrationType = 1, isAITeammate = false` (3 todos total):
- Todo 1: `Step 1: Install and Verify All Prerequisites`
- Todo 2: `Step 2: Ensure Prerequisites and Environment Configuration`
- Todo 3: `Step 3: Run the make-a365-agent skill`

**RULE 2 — ALWAYS BEGIN FROM STEP 1.** Run the quick scan version checks in every session. After the quick scan, **only process sections for tools marked ❌ (missing or outdated)** — skip every section whose tool shows ✅ and meets the minimum version. Do NOT re-prompt or reinstall tools that are already present. Step 3 is always the final step — it delegates to the appropriate skill based on `isAITeammate`.

**RULE 3 — SUB-SECTIONS ARE NOT SEPARATE TODOS.** Each `## Step` has internal sub-sections — these are tasks WITHIN that ste

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [microsoft](https://github.com/microsoft)
- **Source:** [microsoft/agent365-skills](https://github.com/microsoft/agent365-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-microsoft-agent365-skills-a365-setup
- Seller: https://agentstack.voostack.com/s/microsoft
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.