From dev asset to managed resource
Publishing creates an Agent Application — a routing-layer Azure resource with a dedicated invocation URL (stable across version updates), its own Microsoft Entra identity, per-user data isolation, and automatic traffic routing to new deployments. There are two main paths to Microsoft 365, plus other channels.
| Approach | Best for |
|---|---|
| Direct portal publish | Quick Teams/Copilot integration with logic entirely in Foundry — creates an Azure Bot Service, registers an Entra app, and generates the M365 package. |
| Microsoft 365 Agents Toolkit | Complex needs — custom SSO, middleware, multi-environment pipelines, or a proxy app. |
| Other channels | Reaching users beyond M365 — web preview, a stable REST API, or Bot Service channels (Slack, Telegram, SMS). |
Key concept · Identity doesn't transfer automatically
The published agent authenticates with its own Entra identity — development-time permissions on the project identity do not carry over. Tools that reach Azure services (like Azure AI Search) must be reconfigured to grant the published agent's identity access.
Who can use it, and what gets created
Publishing to Microsoft 365 comes in two scopes, and creates a set of supporting resources.
| Scope | Availability | Approval |
|---|---|---|
| Shared | Immediate — personal testing, small pilots | No admin approval |
| Organization | All tenant users, under "Built by your org" | Requires admin approval |
Publishing creates an Azure Bot Service resource (routes messages between M365 and the agent), a Microsoft Entra ID application (auth), a Microsoft 365 publishing package, and makes the agent discoverable in the Teams store. Prerequisites include the Azure AI Project Manager and Azure AI User roles, an Azure subscription, Entra app-registration permission, and a tenant that allows custom apps.
Accessing Microsoft 365 data safely
Work IQ is a CLI and MCP server that connects agents to Microsoft 365 Copilot data — emails, meetings, documents, Teams messages, and people — so they can answer with real workplace context using natural language.
Key concept · Permission-based, MCP-based, no storage
Work IQ is built on the Model Context Protocol and enforces a strict security model: it only accesses data the user already has permission to view, queries run through Microsoft Graph under the authenticated user's identity, it doesn't cache M365 data (retrieves on demand), and all queries are auditable. It runs in CLI mode (ad-hoc terminal queries) or MCP server mode (the agent queries automatically when the conversation calls for it). Org-wide access needs administrative consent in Entra.
Chapter 11 quiz
Fourteen questions on publishing options, scopes and artifacts, and Work IQ. Answer first, then expand Show answer.
Part A · Multiple choice
What resource does publishing an agent create?
- A A vector index
- B An Agent Application (routing-layer resource with a stable URL and its own identity)
- C A fine-tuned model
- D A content filter
Show answer
B. It transitions the agent to a managed Azure resource with a dedicated endpoint and Entra identity.
Which publishing approach best fits custom SSO and multi-environment pipelines?
- A Direct portal publish
- B Microsoft 365 Agents Toolkit
- C Web preview
- D A REST API
Show answer
B. Direct portal publish suits quick, Foundry-only logic; the Toolkit handles complex scenarios.
Which publishing scope requires admin approval?
- A Shared
- B Organization
- C Neither
- D Both
Show answer
B — Organization. Shared is immediate for testing/pilots; org rollout needs approval.
What routes messages between Microsoft 365 and a published agent?
- A Azure Bot Service resource
- B Azure AI Search
- C A content filter
- D The Foundry portal
Show answer
A — Azure Bot Service. Created during publishing along with an Entra app and the M365 package.
What protocol is Work IQ built on?
- A SMTP
- B The Model Context Protocol (MCP)
- C A2A
- D REST only
Show answer
B — MCP. It exposes M365 data as tools/resources an agent can query.
How does Work IQ enforce data security?
- A It gives agents full admin access
- B It only accesses data the user already has permission to view, via Microsoft Graph
- C It caches all M365 data
- D It disables auditing
Show answer
B. Permission-based, Graph-authenticated, no caching, fully auditable.
Part B · True or false
A published agent's invocation URL stays stable across version updates.
Show answer
True. Traffic auto-routes to updated deployments without changing the public endpoint.
Development-time permissions transfer automatically to the published agent's identity.
Show answer
False. The published agent has its own identity; tool permissions must be reconfigured.
Work IQ caches Microsoft 365 data for faster responses.
Show answer
False. It retrieves on demand and doesn't store M365 data.
Publishing can make an agent discoverable in the Teams agent store.
Show answer
True. Along with creating the Bot Service, Entra app, and publishing package.
Part C · Short answer
Name the two publishing scopes for Microsoft 365.
Show answer
Shared (immediate, no approval) and Organization (all users, admin approval).
Name three resources publishing to M365 creates.
Show answer
Any three: Azure Bot Service resource, Microsoft Entra ID application, M365 publishing package, and Teams-store discoverability.
Name three Microsoft 365 data types Work IQ can access.
Show answer
Any three: emails, meetings, documents, Teams messages, and people.
Name Work IQ's two operating modes.
Show answer
CLI mode (ad-hoc terminal queries) and MCP server mode (agent queries automatically by context).