Observability and governance

Agent 365 observability has three layers:

1. Teams SDK telemetry records normal activity processing, handler, authentication, API, and state operations.
2. Agent 365 baggage adds identity and correlation context to child spans.
3. Application telemetry setup creates Agent 365 scopes and configures the Microsoft OpenTelemetry distribution and exporters.

The SDK establishes correlation context for reactive operations. For proactive work, open a scope with the selected AgenticIdentity before creating the span that represents the operation.

important

Baggage alone does not create Agent 365 governance records. Your app must configure the supported Agent 365 scopes, processors, authentication, and exporter.

Configure the SDK bridge

The Microsoft OpenTelemetry distribution and Agent 365 exporter are optional for Teams SDK telemetry. We recommend configuring them when you want agent activity to appear in Microsoft Defender and Microsoft Purview for governance. See Microsoft OpenTelemetry Distro for setup guidance.

Teams SDK doesn't depend on a specific exporter. It provides the token and baggage integration points.

For reactive turns, configure the Agent 365 baggage bridge when you create the app. The SDK establishes the baggage before its root turn span starts.

Teams SDK adds Agent 365 baggage before each reactive turn.

Acquire an Agent 365 exporter token through the same identity setup used by Teams SDK:

using Microsoft.Identity.Abstractions;
using Microsoft.Identity.Web;

const string observabilityScope =
    "api://9b975845-388f-4429-889e-eab1ef63949c/.default";
var provider =
    webApp.Services.GetRequiredService<IAuthorizationHeaderProvider>();
var tokenOptions = new AuthorizationHeaderProviderOptions
{
    AcquireTokenOptions = new()
    {
        AuthenticationOptionsName = "AzureAd",
        Tenant = agenticIdentity.TenantId
    }
};

tokenOptions.WithAgentUserIdentity(
    agenticIdentity.AgenticAppId!,
    new Guid(agenticIdentity.AgenticUserId!));

string authorization = await provider.CreateAuthorizationHeaderAsync(
    [observabilityScope],
    tokenOptions);
string token = authorization["Bearer ".Length..];

For proactive work, establish identity baggage before creating the Agent 365 operation span and before calling Teams APIs.

var agentDetails = new AgentDetails(
    agentId: agenticIdentity.AgenticAppId,
    agenticUserId: agenticIdentity.AgenticUserId,
    agentBlueprintId: agenticIdentity.AgenticAppBlueprintId,
    tenantId: agenticIdentity.TenantId);

using var scope = InvokeAgentScope.Start(
    new Request(conversationId: conversationId),
    new InvokeAgentScopeDetails(serviceUrl),
    agentDetails);

await teamsApp.SendAsync(
    conversationId,
    "Digest ready.",
    serviceUrl,
    agenticIdentity,
    cancellationToken);

Use the app's token provider when the Agent 365 exporter requires authentication. Short-lived processes must flush the tracer provider or shut down the Microsoft OpenTelemetry distribution before they exit.

For telemetry data guidance, see Handling sensitive data in OpenTelemetry.

Governance

When the app and tenant are configured for Agent 365 governance, identity-aware telemetry can support:

• attribution of actions to an Agentic User or app instance;
• audit and investigation in Microsoft security and compliance tools;
• administrator controls for enablement, disablement, ownership, and deletion;
• monitoring of agent, model, and tool activity.

Use the Agent 365 documentation for current governance, Microsoft Defender, and Microsoft Purview setup. The SDK does not grant access to those products or replace their tenant configuration.