Merging changes synced from https://github.com/MicrosoftDocs/entra-docs-pr (branch live)

Author: Learn Build Service GitHub App

docs/agent-id/autonomous-agent-authentication-authorization-flow.md

@@ -3,10 +3,12 @@ title: Authenticate and acquire tokens for autonomous agents
 description: Learn how to authenticate autonomous agents with Microsoft Entra ID, grant application permissions, and optionally create and authenticate as an agent's user account.
 titleSuffix: Microsoft Entra Agent ID
 ms.topic: how-to
-ms.date: 03/30/2026
+ms.date: 06/15/2026
 ms.reviewer: jomondi, dastrock
 
 #customer-intent: As a developer building autonomous agents, I want to authenticate my agent, grant it application permissions, and optionally create an agent's user account, so that my agent can operate independently and access Microsoft Graph and other resources.
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1013
 ---
 
 # Authenticate and acquire tokens for autonomous agents
@@ -55,7 +57,7 @@ Gather the credential you configured on your agent identity blueprint. You need
 
 ### [Microsoft.Identity.Web](#tab/microsoft-identity-web)
 
-For production, use a managed identity as a federated identity credential:
+Configure *Microsoft.Identity.Web* to authenticate your agent identity blueprint using a federated identity credential. For production, use a managed identity as the federated identity credential:
 
 ```json
 {
@@ -101,6 +103,8 @@ When using a client secret during local development, provide the `client_secret`
 
 ### [Microsoft Graph API](#tab/Microsoft-graph-api)
 
+Use the following token request to obtain a token for the agent identity blueprint:
+
 ```http
 POST https://login.microsoftonline.com/<my-test-tenant>/oauth2/v2.0/token
 Content-Type: application/x-www-form-urlencoded
@@ -197,15 +201,15 @@ There are two ways to grant application permissions to an autonomous agent:
 
 Use the following steps to get an app role assignment.
 
-1. [Obtain an access token](#request-an-agent-identity-token) with the application permissions `Application.Read.All` and `AppRoleAssignment.ReadWrite.All`.
+1. [Request an agent identity token](#request-an-agent-identity-token) with the application permissions `Application.Read.All` and `AppRoleAssignment.ReadWrite.All`.
 
 1. Get the object ID of the resource service principal that you're trying to access. For example, to find the Microsoft Graph service principal object ID:
     1. Go to the [Microsoft Entra admin center](https://entra.microsoft.com/).
     1. Navigate to **Entra ID** --> **Enterprise Applications**
     1. Filter by Application type == Microsoft Applications
     1. Search for **Microsoft Graph**.
 
-1. Get the unique ID of the [app role you want to assign](/graph/permissions-reference).
+1. Get the unique ID of the app role you want to assign from the [Microsoft Graph permissions reference](/graph/permissions-reference).
 
 1. Create the app role assignment:
 
@@ -267,7 +271,7 @@ Agent implementations might redirect the admin to this URL in various ways, such
 > [!NOTE]
 > Configure a redirect URI on your blueprint and include a `state` parameter in the consent request. When consent is granted, the user is sent to the redirect URI where you can display confirmation. Your endpoint can use the `state` parameter to track that permission was granted. For single-tenant agents, you can alternatively retry token requests until consent is granted because the tenant ID is already known.
 
-After you grant your application the required permissions, request a new agent access token for the permissions to take effect.
+After you grant your agent identity blueprint the required permissions, request a new agent access token for the permissions to take effect.
 
 ## Authenticate as an agent's user account
 
@@ -279,14 +283,14 @@ Each agent identity can only have a single associated agent's user account, and
 
 To create agents' user accounts, your agent identity blueprint must be granted the application permission `AgentIdUser.ReadWrite.IdentityParentedBy` in the tenant. You can obtain authorization in one of two ways:
 
-- [Request agent authorization](#request-authorization-from-a-tenant-administrator). Be sure to use your agent identity blueprint as the `client_id`, not the agent identity.
-- [Manually create an appRoleAssignment](#create-an-app-role-assignment-via-apis) in the tenant. Use the service principal object ID of the agent identity blueprint as the `principalId` value, not its application (client) ID.
+- [Request authorization from a tenant administrator](#request-authorization-from-a-tenant-administrator). Be sure to use your agent identity blueprint as the `client_id`, not the agent identity.
+- [Create an app role assignment via APIs](#create-an-app-role-assignment-via-apis) in the tenant. Use the service principal object ID of the agent identity blueprint as the `principalId` value, not its application (client) ID.
 
 If you wish to use a different client, not the agent identity blueprint, to create agents' user accounts, that client needs to obtain the `AgentIdUser.ReadWrite.All` delegated or application permission instead.
 
 ### Create an agent's user account
 
-Create an agent's user account using your agent identity blueprint or other approved client. The recommended way to create an agent's user account is using your agent identity blueprint. You [require an access token](create-delete-agent-identities.md#get-an-access-token-using-agent-identity-blueprint) to create an agent's user account.
+Create an agent's user account using your agent identity blueprint or other approved client. The recommended way to create an agent's user account is using your agent identity blueprint. You need to [get an access token using the agent identity blueprint](create-delete-agent-identities.md#get-an-access-token-using-agent-identity-blueprint) to create an agent's user account.
 
 #### [REST](#tab/rest)
 
@@ -409,7 +413,7 @@ Once you have your agent's user account created, you don't need to configure any
 
 ### Grant consent to agent identity
 
-Agents' user accounts behave like any other user account. Before you can request tokens using your agent's user account, you need to authorize the agent identity to act on its behalf. You can authorize the agent identity using [admin authorization](#request-authorization-from-a-tenant-administrator) or manually create an `oAuth2PermissionGrant` using Microsoft Graph or Microsoft Graph PowerShell.
+Agents' user accounts behave like any other user account. Before you can request tokens using your agent's user account, you need to authorize the agent identity to act on its behalf. You can authorize the agent identity by [requesting authorization from a tenant administrator](#request-authorization-from-a-tenant-administrator) or manually create an `oAuth2PermissionGrant` using Microsoft Graph or Microsoft Graph PowerShell.
 
 For Microsoft Graph, your request is as shown in the following snippet:
 
@@ -458,7 +462,7 @@ To authenticate an agent's user account, you need to follow a three-step process
 
 #### [REST](#tab/rest)
 
-First, request a token as the agent identity blueprint, as described in [Request a token for the agent identity blueprint](#request-a-token-for-the-agent-identity-blueprint). Once you have your agent app token, use it to request a Federated Identity Credential (FIC) for your agent identity:
+First, request a token as the agent identity blueprint, as described in [Request a token for the agent identity blueprint](#request-a-token-for-the-agent-identity-blueprint). Once you have the agent identity blueprint token, use the agent identity blueprint token to request a Federated Identity Credential (FIC) for your agent identity:
 
 ```http
 POST https://login.microsoftonline.com/<my-test-tenant>/oauth2/v2.0/token

docs/agent-id/integrate-n8n-agent.md

@@ -4,9 +4,12 @@ titleSuffix: Microsoft Entra Agent ID
 description: Deploy n8n on Azure Container Apps and secure AI agent workflows with Microsoft Entra Agent ID and Microsoft Graph MCP Server for Enterprise.
 ms.service: entra
 ms.topic: how-to
-ms.date: 04/30/2026
+ms.date: 06/15/2026
+author: Dickson-Mwendia
+ms.author: dmwendia
 ms.reviewer: astaykov
-ms.custom: agent-id, msecd-doc-authoring-1012
+ms.custom: agent-id, msecd-doc-authoring-1013
+ai-usage: ai-assisted
 
 #customer intent: As a developer or IT admin, I want to secure n8n workflows with Microsoft Entra Agent ID so that my n8n agents can access Microsoft Graph and MCP Server for Enterprise using agent identities.
 
@@ -16,7 +19,7 @@ ms.custom: agent-id, msecd-doc-authoring-1012
 
 This guide shows how to deploy [n8n](https://n8n.io/) on Azure Container Apps with Microsoft Entra Agent ID integration. The deployment uses the Azure Developer CLI (`azd`) to provision infrastructure, create Microsoft Entra identity objects, and configure n8n workflows automatically.
 
-Unlike the [sidecar pattern](authentication-with-auth-sdk-sidecar.md) used for custom agents, this integration uses the [n8n-nodes-entraagentid](https://www.npmjs.com/package/@astaykov/n8n-nodes-entraagentid) community node to manage token acquisition directly within n8n workflows. The deployed workflows demonstrate both autonomous (app-only) and on-behalf-of (OBO) token flows, with access to Microsoft Graph and the Microsoft Graph MCP Server for Enterprise, `https://mcp.svc.cloud.microsoft/enterprise`.
+Unlike the [Authentication with Microsoft Entra Auth SDK sidecar](authentication-with-auth-sdk-sidecar.md) pattern used for custom agents, the n8n integration uses the [n8n-nodes-entraagentid](https://www.npmjs.com/package/@astaykov/n8n-nodes-entraagentid) community node to manage token acquisition directly within n8n workflows. The deployed workflows demonstrate both autonomous (app-only) and on-behalf-of (OBO) token flows, with access to Microsoft Graph and the Microsoft Graph MCP Server for Enterprise, `https://mcp.svc.cloud.microsoft/enterprise`.
 
 > [!NOTE]
 > This sample demonstrates the use of the `n8n-nodes-entraagentid` community node within n8n. It isn't guidance for deploying n8n on Azure in production.
@@ -38,7 +41,7 @@ If you're running locally instead of Cloud Shell, install these tools before pro
 - [Microsoft.Entra PowerShell module](/powershell/entra-powershell/) v1.2 or later.
 - Git.
 
-Sign in to Azure CLI and Azure Developer CLI before running the deployment:
+Authenticate both the Azure CLI and Azure Developer CLI so that the deployment commands can create and manage resources in your subscription:
 
 ```bash
 az login
@@ -67,7 +70,7 @@ The entire deployment runs through a single `azd up` command that provisions Azu
    - **n8n admin email:** Email for the n8n owner account.
    - **n8n admin password:** Password for the n8n owner account (minimum 8 characters, mixed case, number).
 
-1. During the postprovision phase, the automation performs a second sign-in. A device code is displayed. Open the URL and enter the code. This step requires the Global Administrator or Application Administrator role. The postprovision hook then:
+1. During the postprovision phase, the automation performs a second sign-in. A device code is displayed. Open the URL and enter the code. This step requires the Global Administrator or Application Administrator role. The `azd up` postprovision hook then:
 
    - Creates Microsoft Entra Agent ID objects (Blueprint, Agent Identity, Agent User).
    - Enables the Microsoft Graph MCP Server for Enterprise.
@@ -82,7 +85,10 @@ When the deployment completes, the script prints your n8n URL and a summary of w
 
 ## Explore the deployed resources
 
-### Azure infrastructure
+The deployment creates Azure resources, Microsoft Entra identity objects, and n8n configuration assets that work together to support the sample workflows.
+
+<a name="azure-infrastructure"></a>
+### Review the Azure infrastructure resources
 
 The deployment creates the following Azure resources:
 
@@ -94,7 +100,8 @@ The deployment creates the following Azure resources:
 - **Azure OpenAI:** GPT model deployment used by the AI agent workflows.
 - **Log Analytics Workspace:** Diagnostics and monitoring.
 
-### Microsoft Entra identity objects
+<a name="microsoft-entra-identity-objects"></a>
+### Review the Microsoft Entra identity objects
 
 The automation creates these objects once and reuses them on subsequent runs:
 
@@ -103,7 +110,8 @@ The automation creates these objects once and reuses them on subsequent runs:
 - **Agent user account:** A cloud-only user identity that enables delegated (OBO) token flows.
 - **Single page app (SPA) app registration:** Client app for the webhook demo, preconfigured with redirect URIs and Blueprint API permissions.
 
-### n8n credentials and workflows
+<a name="n8n-credentials-and-workflows"></a>
+### Review the n8n credentials and workflows
 
 The postprovision hook automatically configures n8n:
 
@@ -129,7 +137,7 @@ The n8n deployment supports two token flow patterns:
 
 - **On-behalf-of (OBO) with MCP:** A browser-based SPA sends a bearer token to an n8n webhook. The webhook calls the Auth Manager workflow, which uses the Blueprint credentials to acquire a delegated token on behalf of the Agent User. The Auth Manager forwards the token to a subworkflow that calls the Microsoft Graph MCP Server for Enterprise, which translates MCP tool calls into Microsoft Graph API requests using the delegated token.
 
-In both patterns, the Agent Identity Blueprint acts as a token factory. It issues tokens for Agent Identities without storing credentials on the agent itself. The Auth Manager community node handles token acquisition and AES-256-GCM caching within each workflow run.
+In both patterns, the Agent Identity Blueprint acts as a token factory. The Agent Identity Blueprint issues tokens for Agent Identities without storing credentials on the agent itself. The Auth Manager community node handles token acquisition and AES-256-GCM caching within each workflow run.
 
 ## Deploy the test SPA (optional)
 
@@ -169,7 +177,7 @@ The deployment is fully idempotent:
 - The `azd` environment saves Microsoft Entra object IDs (Blueprint, Agent Identity, Agent User, Blueprint secret) after the first run and reuses them on subsequent runs.
 - n8n configuration (credentials, workflows) is applied fresh each run, which allows repairing a broken state.
 
-To rerun just the postprovision scripts without modifying infrastructure:
+To rerun just the postprovision scripts without modifying infrastructure, run provisioning again. The Bicep templates detect no infrastructure changes and only execute the deployment hooks:
 
 ```bash
 azd provision   # Bicep detects no changes, runs hooks only
@@ -206,7 +214,7 @@ You can run the configuration scripts independently if needed:
 
 ## Clean up resources
 
-Remove all Azure resources that the deployment created:
+Remove all Azure resources that the deployment created and purge any retained deployment state:
 
 ```bash
 azd down --purge

docs/agent-id/interactive-agent-authentication-authorization-flow.md

@@ -5,11 +5,12 @@ titleSuffix: Microsoft Entra Agent ID
 
 
 ms.topic: how-to
-ms.date: 06/03/2026
+ms.date: 06/15/2026
 ms.reviewer: dastrock, jomondi
 ai-usage: ai-assisted
 
 #customer-intent: As a developer building interactive agents, I want to authenticate users, configure authorization, and acquire tokens through the On-Behalf-Of flow, so that my agent can securely act on behalf of users to access protected resources.
+ms.custom: msecd-doc-authoring-1013
 ---
 
 # Authenticate users and acquire tokens for interactive agents
@@ -76,6 +77,8 @@ Authorization: Bearer <token>
 
 ##### [Microsoft Graph PowerShell](#tab/microsoft-graph-powershell)
 
+Use Microsoft Graph PowerShell to update the agent identity blueprint with the redirect URI.
+
 ```powershell
 Connect-MgGraph -Scopes "AgentIdentityBlueprint.ReadWrite.All" -TenantId <your-test-tenant>