Explain a365 setup all and custom-agent identity binding

[Alejandro Lopez (soyalejolopez)]

Summary

• Adds an SDK-adjacent section and sequence diagram that explains the seven stages behind a365 setup all.
• Maps the blueprint application and service principal, credentials, inheritable permissions and grants, child identity, Agent 365 registration, optional Microsoft 365 callback, and conditional project-path synchronization.
• Distinguishes application IDs from object IDs and documents that the pinned current CLI source stores the child service-principal object ID as agenticAppId.
• Adds representative Microsoft Graph operations for each source-backed setup stage without changing the existing 18-row API catalog.

Setup, hosting, and production boundaries

• Explains the .NET appsettings.json and Node/Python .env synchronization paths, including the config-free --agent-name path that skips project synchronization.
• Clarifies that setup does not deploy or host agent code and does not install an SDK.
• Keeps runtime deployment separate from a365 publish, ZIP creation, administrator upload, availability/approval, and instance creation.
• Adds production guidance for token validation, exporter settings, source warnings, secret protection, read-only administrator checks, and recovery.
• Keeps AI teammate creation as a separate frontier path rather than a default mailbox outcome.

Version and sourcing

• Bumps the resource from 1.1.1 to 1.2.0, dated 2026-09-16.
• Expands the public bibliography from 31 to 36 sources.
• Uses public Microsoft Learn content reviewed on 2026-09-16 and public microsoft/Agent365-devTools source pinned to commit 08e48a963dd879c6938d032e97e87ccbb03613de (reviewed 2026-09-16; source updated 2026-09-11).
• Does not claim that the pinned source maps universally to every installed CLI binary or to NuGet version 1.1.221.
• Contains no customer, tenant, credential, local-path, or internal-review data.

Validation

• npm run check --prefix tools\catalog-build: passed; metadata valid for 33 resources and all catalog workflow tests passed.
• Frozen HTML copied byte-for-byte: 199,819 bytes; SHA-256 3289578637FC1F66352532B6FD241185317596E582A97E3A42B918CB2C4879FA.
• Inline JavaScript syntax: 2 of 2 scripts passed node --check.
• Atlas invariants: 12 SVG diagrams, 18 API rows, 36 bibliography sources, 88 IDs, 88 unique IDs, zero duplicate IDs, and zero missing internal fragment targets.
• Diff boundary: exactly 3 files changed: index.html, README.md, and CHANGELOG.md in copilot-agent-strategy/agent-365-lifecycle-atlas.
• Public GitHub compare API: 1 commit ahead, 0 behind, 3 modified files, based on microsoft/FastTrack@23918cb23fe1066f40496db5d1602c94ae4b22d2.
• Cross-model review: Claude Opus 4.8 found no blocking issues; its one historical bibliography wording ambiguity was corrected before commit.