Use Activity helpers and ResolveAgentIdentity for agent telemetry

[fpfp100]

Summary

• Fix agent identity resolution: ScopeUtils.deriveAgentDetails now uses RuntimeUtility.ResolveAgentIdentity() for agentId (works for both app-based and blueprint-based agents) instead of recipient.agenticAppId which only worked for blueprint agents.
• Fix blueprint ID resolution: agentBlueprintId is now resolved from the JWT xms_par_app_azp claim via RuntimeUtility.getAgentIdFromToken() for agentic requests, instead of incorrectly using the instance ID.
• Replace direct ChannelAccount property access with Activity helpers (getAgenticInstanceId(), getAgenticUser(), getAgenticTenantId()) in ScopeUtils and TurnContextUtils.
• Remove channelData tenant ID fallback in getTenantIdPair() — now uses getAgenticTenantId().
• Upgrade @microsoft/agents-hosting and @microsoft/agents-activity from ^1.1.0-alpha.85 to ^1.3.1.

Breaking Changes

• ScopeUtils.deriveAgentDetails(turnContext, authToken) — new required authToken parameter.
• ScopeUtils.populateInferenceScopeFromTurnContext(details, turnContext, authToken, ...) — new required authToken parameter.
• ScopeUtils.populateInvokeAgentScopeFromTurnContext(details, turnContext, authToken, ...) — new required authToken parameter.
• ScopeUtils.populateExecuteToolScopeFromTurnContext(details, turnContext, authToken, ...) — new required authToken parameter.
• ScopeUtils.buildInvokeAgentDetails(details, turnContext, authToken) — new required authToken parameter.

Test plan

• All 53 test suites pass (1059 tests)
• Full pnpm build succeeds (including CJS + ESM for all packages)
• Verify deriveAgentDetails resolves agentId via ResolveAgentIdentity() and agentBlueprintId via getAgentIdFromToken()
• Verify deriveTenantDetails uses getAgenticTenantId() helper
• Verify getTargetAgentBaggagePairs uses getAgenticInstanceId()
• Verify getTenantIdPair uses getAgenticTenantId()

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This pull request refactors agent telemetry collection to use Activity class helper methods instead of direct ChannelAccount property access, adds authentication token-based agent identity resolution, and upgrades key dependencies. The changes aim to improve blueprint ID resolution for telemetry and standardize how agent identity information is extracted from TurnContext.

Changes:

• Replace direct ChannelAccount property access with Activity helper methods (getAgenticInstanceId(), getAgenticUser(), getAgenticTenantId())
• Add authToken parameter to telemetry scope population methods with TypeScript overloads for backward compatibility
• Upgrade @microsoft/agents-hosting and @microsoft/agents-activity from alpha to stable release (1.3.1)

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pnpm-workspace.yaml	Updates catalog versions for agents-hosting and agents-activity to 1.3.1
pnpm-lock.yaml	Reflects dependency upgrades including msal-node 5.0.4, axios 1.13.5, jwks-rsa 3.2.2, and @types/express 5.0.6
packages/agents-a365-observability-hosting/src/utils/ScopeUtils.ts	Adds authToken parameter with overloads to scope population methods; uses RuntimeUtility.ResolveAgentIdentity for blueprint resolution; switches to Activity helpers
packages/agents-a365-observability-hosting/src/utils/TurnContextUtils.ts	Replaces direct property access with getAgenticInstanceId() and getAgenticTenantId() helpers; removes channelData tenant ID fallback
tests/observability/extension/hosting/scope-utils.test.ts	Updates test fixtures to use Activity helper methods and removes agenticAppBlueprintId from recipient to test undefined fallback
tests/observability/extension/hosting/TurnContextUtils.test.ts	Updates test fixtures to use Activity helpers and adjusts assertions to expect undefined for aadObjectId and agenticAppBlueprintId
tests/observability/extension/hosting/BaggageBuilderUtils.test.ts	Updates test fixtures to use Activity helpers and adjusts baggage assertions to expect undefined values

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[Copilot]

RuntimeUtility.ResolveAgentIdentity returns the app ID, not the blueprint ID, so it should not be used to populate agentBlueprintId. According to the utility.ts documentation, ResolveAgentIdentity returns "Agent identity (App ID)" by calling either getAgenticInstanceId() or GetAppIdFromToken() (which uses appid or azp claims). To get the blueprint ID from the token, you should use RuntimeUtility.getAgentIdFromToken(authToken) instead, which checks the xms_par_app_azp claim (the actual blueprint ID claim). This bug will result in incorrect telemetry data being recorded for agent blueprint identification.

[Copilot]

The JSDoc comment states that ResolveAgentIdentity is used to "resolve the agent identity (Blueprint vs App)", but this is inaccurate. ResolveAgentIdentity only returns the App ID, not the Blueprint ID. The comment should be corrected to accurately reflect what the method does, or the implementation should be changed to use RuntimeUtility.getAgentIdFromToken if the Blueprint ID is actually needed (which is what the variable name agentBlueprintId suggests).

[MattB-msft]

Nit: its not aways a blueprintID.

[fpfp100]

changed to use getAgentIdFromToken

[MattB-msft]

You should not use this property ever.. this can and will be spoofed,
if you are trying to resolve an appID for an app that does not have user auth, then we should work this out based on the default connection or active connection to the upstream, or support Guid.empty here.

[fpfp100]

removed.

[MattB-msft]

Where are you getting the authtoken here? Im am worried about it becoming stale over time.

[fpfp100]

The developer needs to provide the agent uer token when calling the method.

[nikhilNava]

based on this

even in blueprint case it does not return the blueprintId, right?

[fpfp100]

no. Based on the implementation of method, if it is blueprint case, it will call getAgenticInstanceId() which returns recipient.agenticAppId not blueprintId.