Skip to content

Add m365-langgraph-mcs-tool sample (Agents SDK + LangGraph + Copilot Studio) - #535

Open
adilei wants to merge 2 commits into
microsoft:mainfrom
adilei:adilei-port-enterprise-procode-agent
Open

Add m365-langgraph-mcs-tool sample (Agents SDK + LangGraph + Copilot Studio)#535
adilei wants to merge 2 commits into
microsoft:mainfrom
adilei:adilei-port-enterprise-procode-agent

Conversation

@adilei

@adilei adilei commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

What this adds

A new pro-code sample under extensibility/agents-sdk/m365-langgraph-mcs-tool/: an M365 Agents SDK custom engine agent (publishable to Teams / M365 Copilot) that runs a LangGraph + Azure OpenAI ReAct orchestrator which calls a published Copilot Studio agent as a tool, with delegated SSO and streamed responses. The demo scenario is a hotel finder.

Highlights

  • One-command deployscripts/deploy.sh / deploy.ps1 check prerequisites, prompt for the few required values, write env files, build, and run atk provision + atk deploy. If the atk CLI isn't installed globally, the scripts run it via npx -y -p @microsoft/m365agentstoolkit-cli atk so there's no manual install step.
  • Post-deploy self-testnpm run smoke (scripts/smoke-test.mjs, zero-dep ESM) drives the deployed bot over Direct Line, surfaces the one-time sign-in URL, and prints the streamed Copilot Studio reply.
  • SSO wiring — two Azure Bot OAuth connections: SsoConnection (Teams SSO) and mcs (Power Platform, CopilotStudio.Copilots.Invoke). Cloud bot uses a user-assigned managed identity (no secret). Provisioning is fully in Bicep (infra/).
  • Docs — README with architecture (mermaid) + Jekyll front matter, plus docs/AZURE_DEPLOYMENT.md and docs/LOCAL_DEPLOYMENT.md. Registered in the Agents SDK category README.

Validation (static, no live creds)

  • npm run build clean; compiled entry loads all modules (expected config error only).
  • az bicep build on both azure.bicep and azure-local.bicep = 0 errors.
  • manifest + parameters JSON valid; bash -n / pwsh parse on scripts OK; npx atk --version resolves; smoke test fails gracefully when nothing is deployed; all doc links resolve.

Not yet run

Live end-to-end deploy (./scripts/deploy.sh + npm run smoke) requires an Azure subscription/RG, M365 tenant, a published Copilot Studio agent (environment id + schema), and an Azure OpenAI deployment/key — to be validated in a real environment.

adilei and others added 2 commits July 20, 2026 20:22
…Studio)

A pro-code custom engine agent for Teams / Microsoft 365 Copilot, built with the
M365 Agents SDK. It runs a LangGraph ReAct orchestrator on Azure OpenAI and exposes
a published Copilot Studio agent as a tool, called with the signed-in user's identity
(delegated SSO) with streamed responses.

- One-command deploy: scripts/deploy.sh / deploy.ps1 (provision + deploy via atk).
- Post-deploy smoke test: scripts/smoke-test.mjs (npm run smoke) over Direct Line.
- Bicep infra: App Service, Azure Bot, user-assigned managed identity, SsoConnection
  + mcs OAuth connections, Entra app registration granting Power Platform
  (CopilotStudio.Copilots.Invoke).
- Jekyll page + Azure/local deployment guides; registered in the Agents SDK category README.

Cleaned Foundry-era leftovers carried from the source: removed unused deps
(@azure/ai-agents, @azure/identity, @azure/core-auth, jsonwebtoken), the dead
app-update-sso.bicep module, and stale Foundry references in docs/config.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c64fb4df-84d5-4146-84c2-65ade1d34a7c
The sample uses m365agents.yml, which the newer M365 Agents Toolkit CLI (`atk`,
from @microsoft/m365agentstoolkit-cli) reads. The older `teamsapp` CLI reads
teamsapp.yml and can't drive this sample, so relying on a specific global install
was a rough edge for the one-command deploy.

deploy.sh / deploy.ps1 now prefer a global `atk` and otherwise invoke
`npx -y -p @microsoft/m365agentstoolkit-cli atk`, so provision/deploy work with no
manual global install. Docs updated to mark the global CLI install as optional.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c64fb4df-84d5-4146-84c2-65ade1d34a7c
@GiorgioUghini

Copy link
Copy Markdown
Collaborator

I've deployed this on Microsoft 365 Copilot. A few findings:

  1. appservice.bicep configures /health, but the Express host does not register that route, so it returns 404. Adding a beforeListen health route fixes App Service health monitoring.
  2. Provisioning declares the Power Platform delegated permissions but does not grant/administer consent. The first message then fails during /api/usertoken/exchange with [-120510] Failed to sign in (HTTP 400). Running az ad app permission admin-consent --id <SSO_APP_ID> fixed it. The deploy flow should automate this when possible or clearly present it as a required post-deploy step.
  3. agent.ts forwards output only when messageChunk.content is a string. A live turn completed server-side but returned structured text content, resulting in an empty stream and an M365 TIMEOUT You can try by triggering any non-text response, like RAI filter. Extracting text from content blocks and adding a no-content fallback fixed it.
  4. With the current atk CLI, atk install --file-path ... --env dev rejects --env; installation succeeds without that argument.

@GiorgioUghini

Giorgio Ughini (GiorgioUghini) commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

adilei I'm not sending a commit to address these because I wanted to confirm with you if you actually want to fix any of these or not?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants