Microsoft 365 Agents SDK and Copilot Extensions

Who is this course for

• Solution architects and AI engineers

• Microsoft 365 developers extending Copilot

• Technology consultants designing enterprise AI integrations

• Platform engineers ensuring safe AI deployment

Prerequisites

• Fundamentals of JavaScript (JS_PROG1) and TypeScript (JS_TS1) — primary course language

• REST and JSON

• Fundamentals of Azure and Microsoft 365

• Experience with Microsoft Graph — preferred

• Experience with prompt engineering — preferred

• Fundamentals of C# (GOC2125 level) — preferred, only for mentions of Agent Framework

Course outline

Day 1 — Stack map and no-code/low-code journey

• Onboarding, environment & toolchain — VS Code, Microsoft 365 Agents Toolkit, Node.js, Agents Playground; three billing models (Copilot license, Copilot Credits, inference).
• Agent Creation Roadmap & Decision Axis — Copilot Architecture; Declarative vs. Custom Engine Agent; Agent Builder, SharePoint Agents, Declarative Agent from Toolkit, Copilot Studio, Agents SDK and Foundry Agent Service — when what and how to justify the choice.
• No-code and low-code paths — showcase — Agent Builder and Copilot Studio live on the same assignment; for each path: who hosts, who pays the model, who governs and what is not allowed.

Day 2 — Copilot in SharePoint and the declarative ceiling

• Skills — Copilot in SharePoint extension — SKILL.md anatomy, creation in chat, review and run; governance without admin switch (controlled by file rights).
• SharePoint Agents — agent over the library with one click, its ceiling and sharing to Teams.
• Declarative Agents & Agents Toolkit — scaffold and provisioning, instructions like no-code orchestration, manifest capabilities, ALM and repo-as-code; precisely named ceiling declarative paths as motivation for custom engines.
• Data hygiene in SharePoint Online and Exchange Online — oversharing and permission sprawl, SharePoint Advanced Management, Restricted Content Discovery, sensitivity labels; hygiene checklist before deploying an agent.
• Agents in Microsoft Marketplace — org catalog vs. Marketplace, Partner Center, validation process and most common rejection reasons; case study of a real published agent.

Day 3 — First agent in code and knowledge

• Agents SDK — core — AgentApplication, activities and turns, TurnState, channels; first running agent locally including handling of error branches; Microsoft Foundry in a nutshell.
• Application Identity — app registration, delegated vs. application permissions, single/multi-tenant, Enterprise applications, tokens and scopes; the boundary that no prompt can talk you down.
• Grounding over corporate content — Copilot connectors (synced vs. federated), semantic index and permission enforcement, MCP; connecting knowledge to an agent live over the corporate library — and when not to do retrieval yourself.

Day 4 — Actions, prompts and security

• Action handlers & Microsoft Graph integration — routing actions, parameter validation before writing, writing to SharePoint, requesting from caller identity; delegated vs. app-only and what each boundary means for auditing.
• Prompt & system orchestration — system prompt as a contract, few-shot on format, tool-call loop and rounds within a turn, measured baseline for the rest of the week.
• Security & middleware — attack and defense as code — prompt injection and X