Microsoft 365 Agents SDK for .NET
Build ASP.NET Core agents that connect across Teams, Microsoft 365, and Copilot Studio.
The document explicitly recommends production TokenValidation, authorization, secure secret providers, and persistent storage instead of MemoryStorage. However, the examples still show ClientSecret configuration, a wildcard ServiceUrl mapping, and an error handler that deletes conversation state and sends exception.Message to the user. Least-privilege scope, confirmation, sensitive-data flow, and recovery boundaries are incomplete, so points are deducted.
The installation, ASP.NET Core host, routing, authentication, and Copilot Studio client paths are internally coherent, and CancellationToken is propagated. However, the document delegates API/version verification to MCP and NuGet, provides no pinned compatibility matrix, compile evidence, abnormal-input coverage, or skill-specific key-path tests. Static evidence therefore supports only a cautious score below the static ceiling.
The audience and trigger phrases are explicit, covering .NET, Teams/M365, Copilot Studio, and ASP.NET Core scenarios. Non-fit cases, input/output boundaries, deployment prerequisites, and precise trigger conditions are under-specified; reachability of core Microsoft documentation and services for mainland-China users is also not addressed, so points are deducted.
The skill has a useful structure with overview, prerequisites, installation, configuration, workflows, best practices, references, MIT licensing, author metadata, and version 1.0.0. It lacks an FAQ, troubleshooting guidance, known limitations, changelog, stable SDK version matrix, and explicit maintenance/update responsibility; the repository is also marked work in progress, so points are deducted.
The snippets are directly useful starting points for an ASP.NET Core agent host, AgentApplication routing, and a Copilot Studio client, with development and production guidance. Nevertheless, package/API correctness is not verified in-file, authentication and production persistence require project-specific rework, and no executed result or alternative comparison is supplied. Static calibration therefore limits the score.
The skill cites primary Microsoft Learn pages and GitHub samples, and the repository includes general CI/evaluation and test materials. Those materials do not demonstrate compilation or end-to-end execution of this skill's key examples, and no skill-specific acceptance suite or independent corroboration is provided, so the score remains below the static maximum.
- Do not commit the example ClientSecret; use managed identity, Key Vault, or controlled environment variables and narrow the configuration mapping scope.
- Verify current Microsoft.Agents package versions and APIs before production use; this review did not execute or compile the examples.
- Avoid returning exception.Message verbatim to external users, and confirm that deleting conversation state meets recovery and audit requirements.
- The skill does not document Chinese-language support, regional network reachability, or fallback procedures when Microsoft documentation/MCP is unavailable.
What does this skill do, and when should you use it?
This skill supports .NET developers using the Microsoft 365 Agents SDK to build agents for Microsoft 365, Teams, and Copilot Studio. It covers ASP.NET Core hosting, AgentApplication routing, MSAL-based authentication, storage registration, and protected message endpoints. It also shows an interactive token-acquisition flow and CopilotClient usage for direct Copilot Studio conversations. Before implementation, it directs the coding agent to verify current APIs through microsoft-docs MCP and confirm NuGet package versions.
Provides dotnet add package commands; defines token validation, service connection, and Copilot Studio settings; registers agent options, an agent, storage, controllers, and ASP.NET authentication; maps /api/messages to IAgentHttpAdapter.ProcessAsync; demonstrates AgentApplication handlers for conversation updates, messages, and turn errors; implements an MSAL-backed DelegatingHandler; and shows how to start a Copilot Studio conversation and ask a question with CopilotClient.
- A .NET developer building a Teams or Microsoft 365 agent needs an ASP.NET Core host and message endpoint.
- An enterprise team needs AgentApplication routing with welcome, message, and centralized error handlers.
- A service must protect `/api/messages` with token validation and authorization using MSAL-based configuration.
- A .NET console application needs to connect directly to Copilot Studio with interactive authentication.
What are this skill's strengths and limitations?
- Covers ASP.NET Core hosting, AgentApplication routing, MSAL authentication, storage registration, and Copilot Studio access.
- Includes copyable C#, configuration, and NuGet installation examples.
- Includes production-oriented guidance for token validation, persistent storage, secret handling, HttpClient reuse, and cancellation tokens.
- The examples use MemoryStorage, so production deployments require a persisted storage implementation.
- Package versions are not pinned; the skill requires checking current NuGet versions and APIs.
- The source provides no independent test coverage or platform validation specific to this skill.
How do you install this skill?
Install the collection with npx skills add microsoft/skills, then select m365-agents-dotnet in the wizard. For manual installation, clone https://github.com/microsoft/skills and copy .github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet/ into the target agent's skills directory. The source does not provide a separate installer for this skill.
How do you use this skill?
Give the coding agent a request such as “Build a .NET Teams agent with the Microsoft 365 Agents SDK” or “Configure AddAgentAspNetAuthentication and a Copilot Studio client.” Apply the supplied package commands, appsettings.json configuration, and ASP.NET Core or CopilotClient examples. Before coding, use microsoft-docs MCP to verify the current AddAgent, AgentApplication, and authentication APIs.