[BUG] Foundry Hosted Agent cannot use Agent 365 MCP tools through UserEntraToken

[therealjohn]

• Package Name: azure-ai-agentserver-activity, azure-ai-agentserver-core
• Package Version: azure-ai-agentserver-activity==1.0.0b1, azure-ai-agentserver-core==2.0.0b8
• Operating System: Linux container in Microsoft Foundry Hosted Agent
• Python Version: 3.13

Describe the bug

A Python Foundry Hosted Agent configured as an Agent 365 digital worker cannot initialize a versioned Foundry Toolbox when the toolbox contains Agent 365 MCP connections that use UserEntraToken / OAuth identity passthrough.

The hosted agent and agentic user can authenticate to the toolbox endpoint, but tools/list fails for the Agent 365 MCP connections with JSON-RPC error -32007 / CONNECTION_FAILED. Toolbox enumeration is all-or-nothing, so unrelated tools in the same toolbox also become unavailable.

The Agent 365 agentic identity itself is valid. From the same hosted runtime, obtaining a downstream token through get_agentic_user_token for a scope such as ea9ffc3e-8a23-4a7d-836d-234d7c7565c1/McpServers.Mail.All and calling the Agent 365 MCP server directly succeeds.

To Reproduce

1. Use a Frontier tenant and create an Agent 365 digital worker hosted in Microsoft Foundry with ActivityAgentServerHost(digital_worker=True).
2. Grant the agent registration an Agent 365 Tools delegated permission such as McpServers.Mail.All, then grant tenant admin consent.
3. Create a versioned Foundry Toolbox containing:
   • One tool that does not require user identity passthrough.
   • An Agent 365 MCP connection, such as the Outlook Mail MCP server, configured with UserEntraToken / OAuth identity passthrough.
4. Deploy the Python Hosted Agent and authenticate the toolbox request as its Agent 365 agentic user.
5. Initialize the toolbox or invoke tools/list.
6. Observe -32007 / CONNECTION_FAILED for the Agent 365 connection and failure to load every tool in the toolbox.
7. As a control, remove the Agent 365 connection from the toolbox. The remaining toolbox tools load successfully.
8. As a second control, obtain the scoped token with the Agent 365 connection's get_agentic_user_token method and call https://agent365.svc.cloud.microsoft/agents/servers/mcp_MailTools directly. tools/list succeeds.

Expected behavior

Foundry Toolbox should support Agent 365 agentic-user token acquisition for Agent 365 MCP connections, or surface the OAuth consent/authentication flow required to complete it. A valid agentic identity with the required delegated scope and admin consent should be able to discover and invoke the MCP tools from a Hosted Agent.

Additional context

The current workaround is to keep Agent 365 MCP connections out of the Foundry Toolbox and register each MCP server directly in the hosted application, using get_agentic_user_token for its required McpServers.*.All scope.

This appears specific to the Hosted Agent and Toolbox identity-passthrough path rather than the Agent 365 MCP servers or agentic identity, because the direct scoped-token path works from the same runtime.

Relevant documentation: https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/mcp-authentication

[github-actions]

Thank you for your feedback. Tagging and routing to the team member(s) best able to assist.

//cc: @Shivakishore14 @ankitbko @vangarp @RaviPidaparthi

[github-actions]

🎯 Agentic Issue Triage

Summary: A Python Foundry Hosted Agent configured as an Agent 365 digital worker cannot use Agent 365 MCP tools through a versioned Foundry Toolbox when those connections use UserEntraToken / OAuth identity passthrough, resulting in a -32007 CONNECTION_FAILED error that prevents all tools in the toolbox from loading.

📋 Issue Details

Package: azure-ai-agentserver-activity==1.0.0b1, azure-ai-agentserver-core==2.0.0b8
Affected API: ActivityAgentServerHost, Foundry Toolbox initialization / tools/list
Scenarios:

• Agent 365 digital worker initializes a versioned Foundry Toolbox containing an Agent 365 MCP connection configured with UserEntraToken
• tools/list fails with JSON-RPC error -32007 / CONNECTION_FAILED for the Agent 365 MCP connection
• All other tools in the same toolbox also become unavailable (all-or-nothing enumeration)

Root ask: Foundry Toolbox should support agentic-user token acquisition for Agent 365 MCP connections using UserEntraToken, or surface the OAuth flow required to complete it. A valid agentic identity with the required delegated scope and admin consent should be able to load MCP tools.

🔎 Debugging / Reproduction Notes

The author has already isolated the issue well:

• Direct scoped-token path via get_agentic_user_token succeeds when calling the Agent 365 MCP server directly.
• Removing the Agent 365 connection from the Toolbox allows remaining tools to load.
• Failure is specific to the Toolbox identity-passthrough path, not the agentic identity itself or the Agent 365 MCP servers.

Suggested investigation steps:

1. Examine how Foundry Toolbox performs tools/list for MCP connections configured with UserEntraToken — does it attempt to acquire a token on behalf of the agent, or does it expect a pre-existing user token?
2. Compare the token acquisition flow used by get_agentic_user_token (which works) with the path taken by the Toolbox during connection initialization.
3. Check whether the -32007 CONNECTION_FAILED error originates server-side (Agent 365 rejecting the token) or client-side (Toolbox failing to obtain/forward the token before calling the MCP endpoint).
4. Investigate whether ActivityAgentServerHost(digital_worker=True) exposes a hook or configuration for providing scoped tokens per MCP connection in the Toolbox.

🏷️ Label Confidence

• Category: Client — The issue is in the data-plane SDK (azure-ai-agentserver-activity, azure-ai-agentserver-core), not a management-plane package.
• Service: Hosted Agents — Both packages live under /sdk/agentserver/, which maps to the "Hosted Agents" service label (color #e99695, description: sdk/agentserver/*).
• Confidence: High — Package names and SDK directory unambiguously map to Client + Hosted Agents.

👥 Owner Routing

• Matched CODEOWNERS entry: # ServiceLabel: %Hosted Agents (line 272) — matched because the predicted service label is "Hosted Agents".
• AzureSdkOwners: none listed
• ServiceOwners: @Shivakishore14 @ankitbko @vangarp @RaviPidaparthi
• Routing action: Added "Service Attention" and "needs-team-attention" labels; left unassigned; ServiceOwners mentioned in routing comment.
• Scan notes: Scanned bottom-to-top; entries for %Image Analysis, %Health Deidentification, %HDInsight were encountered but did not match. The first matching entry was # ServiceLabel: %Hosted Agents at line 272.

Generated by Agentic Triage for issue #48264 · 32 AIC · ⌖ 5.95 AIC · ⊞ 9.6K · ◷