Nitin Kumar Singh/
Tags/
On-Behalf-Of/

On-Behalf-Of

The Auth Chapter Every MCP Tutorial Skips: Real SSO for Microsoft Graph

Deep Dive AI Engineering · Aug 19, 2026 · 16 min read

Production auth for an MCP server on Microsoft Graph: browser SSO with a public client and PKCE, delegated tokens, the On-Behalf-Of exchange, and the engineering that keeps an 85-tool surface safe.

An identity badge passing through a validation seam into a wall of Microsoft Graph tool tiles, most dimmed, a few lit

The OBO Chain Through MCP: Passing User Identity from an Agent to Microsoft Graph

Deep Dive Azure · Jul 14, 2026 · 16 min read

How an AI agent reaches Microsoft Graph as the signed-in user through MCP — why token passthrough fails, and how on-behalf-of, Conditional Access, and RBAC secure the chain.

A user's identity badge relayed through an agent to an MCP server, which exchanges it for a new Microsoft Graph token — with a discarded 'forwarded token' path marked as a confused deputy

Choosing the Right Agent Identity: Managed Identity, Entra Agent ID, OBO, or Service Principal

Deep Dive Azure · Jul 10, 2026 · 14 min read

The first design decision for any Azure AI agent is which identity it uses. A decision matrix across managed identity, Entra Agent ID, on-behalf-of, and service principals.

Four identity badges on a decision fork — managed identity, Entra Agent ID, on-behalf-of, and service principal — with an agent choosing a path

↑