Skip to content

Guided tour

FabrCore 2.0 · Release and package availability

These guides track the current 2.0 source. Stable 2.0.0 publication is pending; package commands show the release target. Until it is published, follow the source quick start or use a matching available prerelease set. Release migration · Runtime modes

MODULE 10 · LESSON 10.8

Add SSO, streaming, and proactive Microsoft delivery

Add Microsoft SSO and proactive delivery without confusing channel identity.

Lesson 60 of 86 · FabrCore 2.0

Overview

The addon stamps channel metadata and maps the caller to an agent. OBO forwards a validated user's delegated identity to an authorized resource; it is not a universal replacement for application credentials. Proactive delivery requires its own conversation binding and opt-in configuration.

OBO carries a user's delegated authority

On-behalf-of exchange uses a validated user assertion to obtain an authorized downstream token. It is not an application-wide service credential. Preserve which user initiated the activity and which resource is requested; a successful channel message does not imply every downstream scope was consented.

Proactive replies need a retained conversation binding

An out-of-turn result needs to know where and under whose authority to send after the original activity has ended. The addon has explicit opt-in delivery settings and channel metadata for that purpose. Streaming and proactive delivery are also different: streaming presents a current response, while proactive delivery starts a later outbound update.

Add delegated and proactive behavior

  1. Complete the documented Entra SSO/OBO setup and choose per-user or shared-agent ownership intentionally.
  2. Inspect Channel and addon Args on an incoming turn. Adapt response formatting to the channel; do not assume Surface card action routing works unchanged.
  3. Enable proactive delivery and verify registered relay, allowed conversation types and target binding. Test streamed responses separately from out-of-turn delivery.
Proactive / out-of-turn delivery (opt in) · reference snippet 
await SendToUserAsync("Your report is ready");

await SendToUserAsync(
    "Your report is ready",
    target: new PrincipalDeliveryTarget("m365copilot"));

await SendToUserAsync(
    "Send this to a specific conversation",
    target: new PrincipalDeliveryTarget("m365copilot", endpointId));

Verify current-turn and later delivery

  1. First confirm ordinary replies work through lesson 10.7. Then exercise one consented downstream read and inspect its user/resource attribution.
  2. Enable the documented proactive option and complete a controlled investigation after the original turn has ended. Confirm the result reaches the original eligible conversation with the correct request context.
  3. Test a missing/expired binding or revoked downstream consent. Expect a recorded delivery/auth failure rather than sending through another conversation or operator identity.

This verifies the additional identity and conversation state required beyond a basic channel reply. Availability depends on the actual Microsoft channel and tenant setup.

If the result is different

A shared agent can share history by design. Confirm that this is intended before using a fixed/shared mapping across users.

Go deeper

Explore the related documentation.