Explain a365 setup all and custom-agent identity binding

copilot-agent-strategy/agent-365-lifecycle-atlas/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to the Agent 365 Lifecycle Atlas are documented here.
 
+## 1.2.0 - 2026-09-16
+
+- Added an SDK-adjacent section and sequence diagram for the seven stages behind
+  `a365 setup all`.
+- Documented blueprint, child identity, credential, permission, grant, and
+  programmatic registration relationships.
+- Clarified application ID, object ID, and Agent 365 identity mappings,
+  including the current CLI's child service-principal object ID behavior.
+- Added representative Microsoft Graph operations, conditional project-path
+  synchronization behavior, production checks, and recovery guidance.
+- Clarified that setup neither deploys hosted agent code nor installs an SDK,
+  and that host deployment is separate from ZIP publishing and administrator
+  availability-instance creation.
+- Expanded the public bibliography from 31 to 36 sources, including pinned
+  public CLI implementation references reviewed on September 16, 2026, without
+  treating that source version as a universal installed-binary guarantee.
+
 ## 1.1.1 - 2026-09-16
 
 - Reconciled conflicting public documentation for connected-platform and

copilot-agent-strategy/agent-365-lifecycle-atlas/README.md

@@ -6,7 +6,7 @@ summary: >-
   Explore Agent 365 lifecycles, discovery, identity, tooling, telemetry, admin
   actions, and 18 public API endpoints in one atlas.
 author: Alejandro Lopez
-version: 1.1.1
+version: 1.2.0
 published: "2026-09-10"
 updated: "2026-09-16"
 tags:
@@ -24,7 +24,7 @@ whatItIs: >-
 whyUseIt:
   - Follow five agent classes through build, connection, identity, packaging, runtime, and governance.
   - Distinguish registry ingestion, Agent Map inventory, and Shadow AI discovery boundaries.
-  - Trace Agent 365 identity, token, SDK, CLI, MCP, telemetry, and administration relationships.
+  - Trace Agent 365 identity, token, SDK, CLI setup, MCP, telemetry, and administration relationships.
   - Search and filter 18 representative public API endpoints with linked Microsoft Learn sources.
 howToUse: >-
   Open `index.html` in a modern browser. Use the section navigation and linked
@@ -44,12 +44,13 @@ run, and which governance and observability interfaces apply at each stage.
 
 ## What the atlas covers
 
-- Eleven linked architecture and sequence diagrams
+- Twelve linked architecture and sequence diagrams
 - Five agent classes across six lifecycle stages
 - Native onboarding and connected-platform registry ingestion
 - Agent Map inventory and the separate Shadow AI discovery experience
 - Entra agent identity objects and token exchanges
 - Agent 365 SDK and CLI boundaries
+- The seven-stage `a365 setup all` flow and custom-agent identity binding
 - Governed MCP tooling and telemetry flows
 - Administration actions and documented deletion behavior
 - Eighteen representative API endpoints with public Microsoft Learn sources
@@ -58,6 +59,23 @@ The atlas keeps generally available, preview, and beta capabilities visibly
 separate. Preview and beta details must be checked against current Microsoft
 documentation for the target tenant, cloud, and scenario before implementation.
 
+## September 16, 2026 setup update
+
+This additive update explains the seven stages behind `a365 setup all`, including
+the blueprint application and service principal, credentials, inheritable
+permissions and grants, child identity, programmatic registration, and optional
+project-path synchronization. It distinguishes application IDs from object IDs,
+shows the current CLI's child service-principal object ID mapping, and links the
+setup flow to the Agent 365 SDK and representative Microsoft Graph operations.
+
+The atlas also makes the hosting boundary explicit: setup does not deploy agent
+code or install an SDK, and host deployment remains separate from publishing a
+ZIP package for administrator upload and availability-instance creation.
+Production guidance calls out token validation, exporter settings, source
+warnings, secret protection, read-only checks, and recovery steps. The CLI
+implementation references are pinned to public source reviewed on September 16,
+2026; that source version is not asserted to match every installed CLI binary.
+
 ## September 16, 2026 accuracy update
 
 This correction pass reconciles conflicting public descriptions of connected
@@ -66,7 +84,8 @@ release stage. It also corrects Entra blueprint deletion behavior, the Agentic
 User on-behalf-of token chain, custom MCP server publishing and approval,
 conversation and run terminology, Agent Map limits and licensing, and the
 documented scope of Shadow AI discovery. The bibliography now contains 31
-public sources, with unresolved documentation conflicts called out inline.
+public sources at that correction point, with unresolved documentation
+conflicts called out inline.
 
 ## September 15, 2026 update
 
@@ -97,9 +116,11 @@ Use the page to:
 ## Sources and scope
 
 The content is compiled from the public Microsoft Learn and Microsoft 365
-Roadmap sources linked inside the atlas. The full atlas was accuracy-reviewed on
-September 16, 2026. It is an architecture reference, not a deploy-ready
-configuration or an official product specification.
+Roadmap sources and pinned public Agent 365 CLI implementation references linked
+inside the atlas. The full atlas was accuracy-reviewed on September 16, 2026. It
+is an architecture reference, not a deploy-ready configuration or an official
+product specification. Validate details against the target tenant, cloud,
+scenario, and installed CLI version before implementation.
 
 ## Applies To