Skip to main content

Agent Registry — Microsoft Agent Framework

Connect a LumoAuth agent identity to the Microsoft Agent Framework (Python or .NET). The agent's identity is its registered AGENT_CLIENT_ID in LumoAuth. It authenticates via OAuth 2.0 client credentials (LumoAuthAgent in Python, LumoAgent in .NET). Tools check capabilities before executing. MCP tools swap the base access token for one bound to the MCP server using token exchange. (MCP is the Model Context Protocol, the standard way for agents to call tool servers.)

Prerequisites

Set the environment variables LUMOAUTH_URL, LUMOAUTH_ORG_ID, AGENT_CLIENT_ID, and AGENT_CLIENT_SECRET from your LumoAuth organization portal. See Agent Registry for registration and credential setup.

AGENT_CLIENT_ID and AGENT_CLIENT_SECRET are shown once on the Agent created page. That page appears right after you register an agent with the Client ID and secret identity under AI Agents → Agents → Register agent:

The Agent created page showing the client ID and the one-time client secret

Install​

pip install agent-framework lumoauth

Python 3.10+ required.

Example​

import asyncio
from typing import Annotated
from pydantic import Field
from agent_framework import Agent
from agent_framework.openai import OpenAIChatClient
from lumoauth import LumoAuthAgent

# 1. Authenticate the LumoAuth agent (client-credentials flow)
lumo = LumoAuthAgent()
lumo.authenticate()

# 2. Define tools guarded by LumoAuth capability checks
def search_company_documents(
    query: Annotated[str, Field(description="The search query for company documents")],
) -> str:
    """Search internal company documents for the given query."""
    if not lumo.has_capability("read:documents"):
        return "Error: agent lacks 'read:documents' capability."
    return f"Found 3 documents matching '{query}'"

def query_financial_mcp(
    metric: Annotated[str, Field(description="The financial metric to retrieve")],
) -> str:
    """Query the secured financial metrics MCP server."""
    if not lumo.has_capability("mcp:financial"):
        return "Error: agent lacks 'mcp:financial' capability."
    mcp_token = lumo.get_mcp_token("urn:mcp:financial-data")
    if not mcp_token:
        return "Error: failed to obtain MCP token."
    return f"Retrieved {metric}: $1.2M (authenticated via MCP token exchange)"

# 3. Abort early if the agent's daily budget is exhausted
if lumo.is_budget_exhausted():
    raise RuntimeError("Agent budget exhausted for today.")

# 4. Create the Microsoft Agent Framework agent with LumoAuth-guarded tools
agent = Agent(
    client=OpenAIChatClient(),
    name="Research Analyst",
    instructions="You are a senior analyst. Use tools to search documents and query financial metrics.",
    tools=[search_company_documents, query_financial_mcp],
)

# 5. Run the agent
async def main():
    response = await agent.run(
        "Search documents for Q3 performance, then query the financial MCP for EBITDA."
    )
    print(response)

if __name__ == "__main__":
    asyncio.run(main())

How it works​

Both samples follow the same flow; only the framework glue differs.

StepPython.NET
Authenticate (client-credentials)lumo.authenticate()LumoAgent.FromEnvironment() (token fetched on first use)
Guard a toollumo.has_capability(...)lumo.HasCapabilityAsync(...)
Budget checklumo.is_budget_exhausted()lumo.CheckBudgetAsync()
MCP token (token exchange)lumo.get_mcp_token(...)lumo.McpTokenAsync(...)
Register toolsannotated functions in tools=[]AIFunctionFactory.Create(...)
Build + run the agentAgent(...) + await agent.run(...).AsAIAgent(...) (from Microsoft.Agents.AI) + agent.RunAsync(...)

Next steps​

  • Agent Registry overview — manage registrations, budgets, and capabilities
  • AAuth Quickstart — add cryptographic agent identity (AAuth: the agent signs each request with its own key)
  • JIT Permissions — just-in-time permissions: request human-in-the-loop approval for sensitive operations
  • Workload Federation — authenticate with the identity that Azure Managed Identity already gives the workload, instead of client secrets

Standards used on this page​

Plain nameStandard
Token exchange (delegation)RFC 8693

See the standards reference for what each one covers and how LumoAuth uses it.