An orchestrator agent in Microsoft Foundry accepts an end-user chat session and must call a downstream specialist agent that then invokes Microsoft Graph using the signed-in user’s permissions. The specialist must never use application-only permissions for mailbox data. Which authentication flow should you implement between the user, orchestrator, and specialist tools?
Select an answer to reveal the explanation.
Short Explanation
Correct answer: B. OBO is the handoff that says “this agent is acting as this signed-in user, not as a god-mode app.” The orchestrator takes the user’s delegated token, exchanges it for Graph scopes, and the specialist works under the user’s real permissions—no shared service account, no ROPC, no app-only mailbox read across the tenant.
Full Explanation
When a multi-agent chain must act as the interactive user against Microsoft Graph (or similar APIs), the standard Azure AD / Entra ID pattern is the OAuth 2.0 On-Behalf-Of flow. Option B is correct: the user authenticates to the front-end agent, the orchestrator receives a delegated access token, and that token is exchanged (OBO) for a token audience-scoped to Graph with the minimum delegated permissions required. Downstream specialist agents and tools reuse that delegated context so mailbox operations are attributed to the user and limited by the user’s own rights.
Option A is incorrect because long-lived PATs in agent memory are hard to rotate, easy to exfiltrate via prompt injection, and do not follow modern Entra best practices for interactive Graph access.
Option C is incorrect because client-credentials with Mail.Read application permission is app-only access across many mailboxes—exactly what the scenario forbids.
Option D is incorrect and insecure: ROPC is deprecated for most scenarios, storing passwords in session state is a critical vulnerability, and it fails MFA and Conditional Access expectations.
Exam tip: Phrases like “on behalf of the signed-in user” and “no application-only permissions” point to delegated OAuth/OBO, not client credentials or shared secrets in memory.