What is entra-a2a-mcp-obo?

A guide to connecting Microsoft Entra ID, agent-to-agent communication, MCP, and agentgateway token exchange. Entra ID is Microsoft's identity service; MCP connects agents to tools, while A2A connects agents to one another.

Registering Entra applications, configuring Agent ID, setting up A2A or MCP authentication, and debugging on-behalf-of token exchange.

It helps diagnose authentication setups where several applications and delegated tokens must pass requests securely between agents and tools.

entra-a2a-mcp-obo — Skill for Claude Code and Codex by thangchung

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add thangchung/agent-engineering-experiment --skill entra-a2a-mcp-obo

Clone the repo

git clone --depth 1 https://github.com/thangchung/agent-engineering-experiment

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/thangchung/agent-engineering-experiment/entra-a2a-mcp-obo/github.svg)](https://agentmods.dev/skills/thangchung/agent-engineering-experiment/entra-a2a-mcp-obo)

Your own site

<a href="https://agentmods.dev/skills/thangchung/agent-engineering-experiment/entra-a2a-mcp-obo"><img src="https://agentmods.dev/badge/skills/thangchung/agent-engineering-experiment/entra-a2a-mcp-obo/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/thangchung/agent-engineering-experiment/entra-a2a-mcp-obo"><img src="https://agentmods.dev/badge/skills/thangchung/agent-engineering-experiment/entra-a2a-mcp-obo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 175 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,356 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00175	$0.03356
Opus 5.5	$0.00070	$0.01342
Sonnet 5.5	$0.00035	$0.00671
Haiku 4.5	$0.00017	$0.00336

Measured 1mo ago against content hash 0ff8c74f534e, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

entra-a2a-mcp-obo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

loop-runtime/.agents/skills/entra-a2a-mcp-obo/SKILL.md · 211 lines

How it starts

The opening of the file, as written. The whole thing — 211 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Entra + A2A + MCP + Agentgateway OBO — Best Practices

Distilled from real setup runs and source-code verification (agentgateway v1.4.0-alpha.1, MCP C# SDK, A2A .NET SDK). Prove, don't guess — every rule below traces to a verified source or a real error hit during setup.

0. Reminder rule — ALWAYS surface real inputs

These are per-tenant/per-app real values. Never invent, never leave silently blank. Whenever a task needs one, say so explicitly in chat before/while writing config, e.g. 👉 INPUT needed: <execAppId> — get from setup script output "ExecutorAgent Blueprint appId=...".

Placeholder	What	Typical source
`tenantId`	Entra tenant GUID	`az account show --query tenantId` / `Connect-MgGraph` output
`webAppId`	Web SPA app registration `appId`	setup script output `Web appId=...`
`execAppId`	ExecutorAgent Blueprint `appId`	setup script output `ExecutorAgent Blueprint appId=...`
`execAppSecret`	ExecutorAgent Blueprint client secret	`az ad app credential reset --id <execAppId>`
`checkAppId`	CheckerAgent Blueprint `appId`	setup script output `CheckerAgent Blueprint appId=...`
`checkAppSecret`	CheckerAgent Blueprint client secret	`az ad app credential reset --id <checkAppId>`
`mcpAppId`	McpServer app registration `appId`	setup script output `McpServer appId=...`
`executorAgentIdentityAppId`	Executor Agent Identity instance appId	setup script output `ExecutorAgent instance agentIdentityAppId=...`
`checkerAgentIdentityAppId`	Checker Agent Identity instance appId	setup script output `CheckerAgent instance agentIdentityAppId=...`

Never guess these. Never fill code/config with them silently — flag with 👉 INPUT inline and call it out in the chat response too.

1. Entra ID app registrations (entra-app-registration)

Web/SPA apps: use redirectUri = window.location.origin, never hardcode a port unless it's fixed.
Service/API apps (Mcp, Checker, Executor when acting as resource): expose an API scope named access_as_user, take note of its scope GUID — needed for OBO permission grants.
Always record appId (client ID) — everything downstream (jwtAuth audiences, MSAL config, appsettings AzureAd:ClientId) keys off it. Tenant ID is shared across all apps.
Secrets: never print/store in scripts or docs. Generate via az ad app credential reset, pipe straight into dotnet user-secrets set or Key Vault. Rotate on expiry.
preAuthorizedApplications PATCH payloads on api.oauth2PermissionScopes — Graph API is picky: permissionIds (not scopeIds), array of GUIDs, wrapped correctly. A 400 "An unexpected 'StartArray' node..." almost always means a naked array where an object with a value key on it or a wrapper property was expected — check Graph API docs for the exact schema, don't guess field names.

Read the full file on GitHub · 211 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 211 lines · 175 tokens per session scan A 0ff8c74f534e

Subscribe to this mod's changes

entra-a2a-mcp-obo is a skill published in the GitHub repository thangchung/agent-engineering-experiment (28 stars, last pushed 13d ago), licensed MIT. It adds 175 tokens to every session and 3,356 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Building agents Security ai-agents aiengineering foundry-local microsoft-agent-framework

phoenix-cli-development

Design and implementation guide for the Phoenix CLI (px). Covers the noun-verb command structure, dual-audience design (humans and coding agents), Commander.js patterns, configuration resolution, output formats, exit codes, and conventions for adding or modifying commands. Triggers when working on phoenix-cli commands…

Arize-ai/phoenix · 105 tokens

playground

Author, edit, or iterate on prompts in the Phoenix prompt playground, including running experiments over a dataset. Load before any playground ui. operation call, including single-shot prompt rewrites.

Arize-ai/phoenix · 42 tokens

phoenix-graphql

Write efficient GraphQL queries against the Phoenix API. Load this skill in two cases: (1) before composing any non-trivial GraphQL query yourself for data analysis (via the phoenix-gql bash command) — it contains schema entrypoints and patterns that eliminate the need for introspection; (2) when the user asks for…

Arize-ai/phoenix · 102 tokens

datasets

Understand what a Phoenix dataset is and reason well about its examples, outputs, splits, and how it feeds evaluators and experiments. Load this whenever a dataset is in view or the user asks what a dataset is, how splits work, what an output "means", or how datasets relate to experiments and evals. This skill governs…

Arize-ai/phoenix · 78 tokens

evaluators

Author or refine a Phoenix evaluator — code or LLM-as-a-judge — that scores a run's output. Trigger when the user wants to create a new evaluator, improve an existing one's logic or rubric, choose labels, or decide what to measure on a dataset or experiment. Do NOT trigger on: (1) manual prompt drafting (use…

Arize-ai/phoenix · 114 tokens

experiments

Run, read, and compare dataset-backed experiments to find evidence that a prompt or pipeline is improving. Trigger when the user wants to iterate over a dataset with experiments, compare experiment runs, read experiment quality/latency/cost, or decide whether a change actually helped. Running a prompt over a dataset…

Arize-ai/phoenix · 165 tokens