
A data agent with real identity: end-to-end OAuth On-Behalf-Of over Microsoft Fabric
Almost no "chat with your data" demo answers the key question: whose permissions does the agent query with? How we built a production data agent for a Spanish energy company where every question travels with the user's identity all the way to the lakehouse — one MCP server, three clients (M365 Copilot, Claude, VSCode), and OAuth 2.0 On-Behalf-Of preserving RLS end to end.





