Oauth

How an AI agent reaches Microsoft Graph as the signed-in user through MCP — why token passthrough fails, and how on-behalf-of, Conditional Access, and RBAC secure the chain.

Every Microsoft integration I have shipped starts at the same gate. Call the Graph API, wire up SharePoint, add “Sign in with Microsoft” to an app, and none of it works until you have an App Registration. Get it wrong and nothing downstream authenticates, which is why this is the one setup step I slow down for instead of clicking through.