Tag
On-Behalf-Of
3 posts filed under On-Behalf-Of.
The Auth Chapter Every MCP Tutorial Skips: Real SSO for Microsoft Graph
How a production MCP server signs into Microsoft 365 with real SSO: public client + PKCE, delegated permissions, On-Behalf-Of, and 85 Graph tools kept safe.
The OBO Chain Through MCP: Passing User Identity from an Agent to Microsoft Graph
How an AI agent reaches Microsoft Graph as the signed-in user through MCP — why token passthrough fails, and how OBO and RBAC secure the chain.
Choosing the Right Agent Identity: Managed Identity, Entra Agent ID, OBO, or Service Principal
The first design decision for any Azure AI agent is which identity it uses — a decision matrix across managed identity, Entra Agent ID, and OBO.
