On-Behalf-Of (OBO) with Microsoft Entra ID

Local webinar UI · AgentCore Runtime + MCP · loopback only

1 · Sign in

Sign in with Microsoft to obtain a user JWT (audience = Agent app). Tokens stay on the server; your browser holds only a random session ID.

Transcript

In-memory only. Questions and responses; never tokens, session IDs, or CSRF. Reloading the page clears it.

    End-to-end sequence

    Entra ID to Microsoft Graph: complete OBO flow

    The user token enters the Agent Runtime, while the Graph OBO token and MCP M2M token are acquired and carried only by managed services. No raw token is exposed to this browser.

    Checking current session state…

    Microsoft Entra ID to Microsoft Graph OBO sequence A dynamic sequence diagram showing the user, OBO UI, Microsoft Entra ID, Agent Runtime, AgentCore Identity, Entra token endpoint, MCP Runtime, and Microsoft Graph across thirteen events. 1. Sign in with Microsoft idle 2. /authorize · Agent app scope idle 3. Authorization code idle 4. Redeem code /token Entra user JWT → server session idle 5. Profile, question, or email operation idle 6. Invoke Runtime · user JWT + session header idle 7. Get workload access token (WAT) idle 8. GetResourceOauth2Token · OBO Graph OBO token · User.Read / Mail.Send idle 9. M2M client_credentials for MCP MCP transport token (managed) idle 10. MCP call · M2M authorization + OBO custom header idle 11. /me or /me/sendMail · OBO bearer idle 12. Profile result or HTTP 202 Accepted idle 13. Sanitized result through Agent Runtime and OBO UI idle

    Scroll horizontally on smaller screens to follow every actor and message.

    Token boundary: the browser never receives the WAT, M2M token, or Graph OBO token. The Agent Runtime, AgentCore Identity, and MCP Runtime manage those credentials and pass only the operation result back to the OBO UI.

    OBO token flow

    Node state reflects this browser session. Internal AgentCore token nodes are managed/conceptual — documented but never exposed to the browser.

    Token and claims summary

    The user JWT fields are derived server-side from the token held in this session. WAT and Graph OBO fields describe managed claim semantics only; their token values and exact claims never reach the browser.

    User JWT claims observed summary

    Present
    —
    Type
    —
    Issuer (iss)
    —
    Audience (aud)
    —
    Scopes (scp / roles)
    —
    Expires (exp)
    —
    Fingerprint
    —

    Workload Access Token (WAT) managed

    AgentCore Runtime supplies the WAT to the Agent Runtime context. This UI does not receive or decode it.

    State
    not requested
    Purpose
    Authenticate the Agent Runtime to AgentCore Identity
    Issuer (iss)
    AgentCore-managed; exact value unavailable
    Subject (sub)
    Agent Runtime workload identity; value hidden
    Audience (aud)
    AgentCore token exchange; exact value unavailable
    Expiry (exp)
    Short-lived and service-managed
    Fingerprint
    unavailable by design

    Microsoft Graph OBO token claims managed

    act is the standard actor concept; Microsoft Entra represents the acting middle tier with xms_act.sub in the issued Graph OBO token. The actor claim belongs to this Graph token, not to the WAT.

    State
    not issued
    Audience (aud)
    Microsoft Graph
    Scopes (scp)
    User.Read, Mail.Send
    User subject (sub)
    Signed-in user; value hidden
    Actor (act / xms_act.sub)
    not issued; value unavailable
    Fingerprint
    unavailable by design

    Security artifacts

    Presence/state only — never values. Tokens, headers, CSRF, session, and authorization URL are shown as present/managed/validated/hidden. Only allowed header names are listed. Model reasoning is private; the observable tool selection and result appear in the transcript.

    Entra JWT
    —
    Workload access token (WAT)
    —
    M2M token
    —
    Graph OBO token
    —
    Tool header names
    —
    Agent payload prompt
    —
    Confirmed recipient
    —
    Authorization header fingerprint
    —
    Runtime session fingerprint
    —
    CSRF fingerprint
    —
    Session fingerprint
    —
    CSRF
    —
    Server session
    —
    Authorization URL
    —
    Model reasoning
    —