Copilot Pro Dev Samples
Back to samples

Declarative Agent

Declarative Agent with OAuth-secured API Plugin (C#)

This sample demonstrates how to build a declarative agent for Microsoft 365 Copilot that answers questions about repairs. The agent uses an API plugin to connect to an API secured with OAuth. The project contains a C# Azure Function that validates Entra ID tokens.

Yugal Pradhan
Open source folder Download sample
Declarative agent answering questions about repairs using the information from an API secured with Entra ID
Sample type
Declarative Agent
Last updated
Contributors
1
License
MIT

About this sample

This sample demonstrates how to build a declarative agent for Microsoft 365 Copilot that answers questions about repairs. The agent uses an API plugin to connect to an API secured with OAuth. The project contains a C# Azure Function (.NET 10 isolated worker) that serves as the API and uses Microsoft.IdentityModel to validate Entra ID tokens to secure access to APIs.

PLATFORM
.NET
LANGUAGE
C#
API-PLUGIN
Yes
GRAPH-CONNECTOR
No

Setup and usage

Sample documentation

Summary

This sample demonstrates how to build a declarative agent for Microsoft 365 Copilot that answers questions about repairs. The agent uses an API plugin to connect to an API that is secured with Entra ID.

picture of the app in action

Key aspects of the sample:

  • Shows how to configure Microsoft 365 Agents Toolkit to make a declarative agent with an API plugin that is secured with Entra ID.

  • Shows how to validate an Entra ID access token in C# using Microsoft.IdentityModel libraries rather than rely on an external service. This differs from the Teams Toolkit scaffolding, which doesn't authenticate users locally but instead relies on Azure App Services authentication (EasyAuth) for security in Azure only.

Here are some advantages of validating the token in your code instead of using Easy Auth:

  • Since Easy Auth doesn't work locally, local requests are not authenticated. By handling in code, local requests are authenticated and the packaging source files are the same for all environments.

  • If the code is deployed outside of Azure App Services, and if the included Bicep files aren't used, the code will appear to work but will do no token validation at all.

  • With the Easy Auth scenario, if something goes wrong there is no way to inspect the OAuth token. In this sample you can set a breakpoint to inspect the token and walk through the validation.

  • Easy Auth does not check the scope, or check to see if the token is an app token.

Features

This sample illustrates the following concepts:

  • Building a declarative agent for Microsoft 365 Copilot with an API plugin
  • Connecting an API plugin to an API secured with OAuth
  • Using C# Azure Functions (.NET 10 isolated worker) as the API backend
  • Validating Entra ID tokens in code using Microsoft.IdentityModel (without Easy Auth)
  • Using dev tunnels to test the API plugin locally

Contributors

Version history

Version Date Comments
1.0 May 15, 2026 Initial release

Prerequisites

Minimal Path to Awesome

  • Clone this repository
  • Open RepairsApi.slnx in Visual Studio 2022
  • In the debug dropdown menu, select Dev Tunnels > Create a Tunnel (set authentication type to Public) or select an existing public dev tunnel
  • Right-click the M365Agent project in Solution Explorer and select Microsoft 365 Agents Toolkit > Select Microsoft 365 Account
  • Sign in to Microsoft 365 Agents Toolkit with a Microsoft 365 work or school account
  • Press F5, or select Debug > Start Debugging in Visual Studio to start your app

Note: Please make sure to switch to New Teams when Teams web client has launched.

Disclaimer

THIS CODE IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR NON-INFRINGEMENT.

Further reading