How the broker gets an Entra token for an agent

The broker facilitates Entra token production for agents using RFC 8693 exchange requests and resource maps. Microsoft's Agent ID feature provides agents with identities via application objects and blueprints to manage Graph permissions. To verify directory entries without active sync, an emulation was built to bypass Windows server requirements for Entra Connect. Testing confirmed that signed-in user refresh tokens enable OBO exchanges, resulting in Graph tokens where azp represents the agent identity and oid represents the user.