Teams Bot calling Foundry Prompt Agent

The bot identity and the end user's identity are separate. If the agent only needs access to its Foundry project, have the bot's backend call Foundry with its managed identity or service principal and grant that identity the required Foundry role. If the agent needs to call another API using the user's permissions, authenticate the user in the bot and use an on-behalf-of (OBO) flow in your backend for that specific downstream API; the backend still authenticates to Foundry separately. The Foundry hosted-agent OBO guide describes this separation and token handling.

The exact integration depends on whether “Prompt Foundry Agent” means a Prompt Flow deployment or a hosted Foundry agent, and which API the user needs to access. Could you share the agent type/API and whether the user identity is needed for Foundry itself or for a downstream tool such as Microsoft Graph? Please don't include access tokens, keys, or other secrets.

If you find this answer helpful, please upvote it. If this resolves your issue, please mark it as the accepted answer so that it can help others in the community.