Add support for custom scopes in agentic instance tokens

[MattB-msft]

The GetAgenticInstanceTokenAsync method now accepts an optional scopes parameter, allowing callers to specify custom scopes when acquiring an agentic instance token. If no scopes are provided, the default "api://AzureAdTokenExchange/.default" is used. All interface definitions and call sites have been updated for compatibility.

This pull request updates the agentic authentication flow to allow specifying custom scopes when acquiring instance tokens. The changes add an optional scopes parameter to the relevant methods and ensure backward compatibility by defaulting to the original scope if none is provided.

Authentication API changes:

• Added an optional IList<string> scopes parameter to GetAgenticInstanceTokenAsync in the IAgenticTokenProvider interface and its implementations, allowing callers to specify custom scopes for token acquisition. [1] [2] [3]
• Updated the implementation in MsalAuth.cs to use the provided scopes or fall back to the default "api://AzureAdTokenExchange/.default" scope if none are specified.

Call site updates:

• Modified all call sites of GetAgenticInstanceTokenAsync to pass the new scopes parameter, using null where custom scopes are not needed, ensuring backward compatibility. [1] [2] [3] [4]

[Copilot]

Pull request overview

This PR updates the agentic authentication surface to allow callers to request agentic instance tokens with custom OAuth scopes, while preserving a default scope (api://AzureAdTokenExchange/.default) when none are provided.

Changes:

• Extended the agentic instance-token acquisition API to accept a scopes list and updated internal call sites accordingly.
• Updated MsalAuth to resolve scopes (caller-provided vs default) before calling MSAL AcquireTokenForClient.
• Propagated the new parameter through builder-layer helpers that wrap/consume IAgenticTokenProvider.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/libraries/Core/Microsoft.Agents.Authentication/IAgenticTokenProvider.cs	Updates the public token-provider interface to accept scopes for instance-token acquisition.
src/libraries/Builder/Microsoft.Agents.Builder/UserAuth/AgenticAuth/AgenticUserAuthorization.cs	Updates the agentic auth flow to pass the new scopes argument (currently null) when requesting instance tokens.
src/libraries/Builder/Microsoft.Agents.Builder/RestChannelServiceClientFactory.cs	Updates agentic connector-client token acquisition call to include the new scopes argument (currently null).
src/libraries/Builder/Microsoft.Agents.Builder/App/AgenticAuthorization.cs	Adds an optional scopes parameter to the builder-facing helper and forwards it to the token provider.
src/libraries/Authentication/Authentication.Msal/MsalAuth.cs	Implements scope resolution for instance tokens (custom scopes or default) before acquiring the token via MSAL.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.