Agent-to-Agent connections

Agent-to-Agent (A2A) lets an SRE Agent send requests to a supported remote agent and receive requests from approved callers. Open Agent to Agent to manage connections and review their conversations.

Preview

A2A is available only when it is enabled for the current agent. If the page is unavailable, contact your administrator.

Choose the direction

Incoming and outgoing are relative to the agent whose page you have open.

Your goal	Page	What you configure
This agent calls another agent	Outgoing Connections	The destination's Agent Card URL and the calling identity
Another agent calls this agent	Incoming Connections	The approved calling identity, enabled connection, and receiving handler
Review requests sent and received	Conversations	Filters and read-only conversation history

Use How agents connect at the top of the page for a visual overview and shortcuts to the existing connection pages. Choose Delegate work to another agent or Receive requests from approved callers. A full-width strip below the two direction cards shows this agent's complete, copyable Agent Card URL. Share it with the agent or client that will send requests; outgoing setup needs the remote agent's URL instead.

The two directions are configured independently. Saving an outgoing connection does not approve the caller on the receiving agent. Normal replies to an outgoing request do not require a separate reverse connection.

Before you start

You need permission to manage outgoing connections on the calling agent or incoming approvals on the receiving agent, depending on your role. Viewing conversations requires thread-read permission; managing incoming approvals requires thread-approve permission.

Agree with the receiver administrator on the destination, the calling identity, and the work the receiving agent should handle. Supported destinations must satisfy the provider, authentication, trusted-host, and protocol requirements enforced by the connection setup. A public Agent Card alone does not make an arbitrary A2A endpoint compatible or authorize access.

Never share access tokens or credentials as part of a setup handoff.

Delegate work to another agent

1. Open Outgoing Connections and add a connection.
2. Enter the remote agent's Agent Card URL, a useful connection name and description, and select the managed identity this agent will use to call it.
3. Review the connection and save it. Setup checks the destination's published Agent Card and displays the result.
4. If access is denied, use the setup handoff to contact the receiver administrator. It includes the selected calling identity and, when available for an SRE Agent receiver, a link to its incoming setup. Complete the receiver's requirements and retry the check.
5. After setup, make a first request through the remote-agent tools and review its result in Conversations.

For an SRE Agent receiver, Azure resource access and an enabled incoming approval are separate requirements. The caller needs the required Azure RBAC access, such as SRE Agent Standard User, on the receiving SRE Agent resource, as well as approval of its calling principal. Other destination providers use their own access requirements; do not apply SRE Agent's incoming-approval model to every provider.

What the connection check proves

Saving or checking a connection fetches and validates the Agent Card, including a supported HTTP+JSON 1.0 interface and trusted host/audience. It does not run an investigation, make a trial invocation, or guarantee future connectivity or permissions.

The remote-agent List operation lists enabled, valid configuration; it is not a health check. Describe shows the saved published Agent Card and its fetch time. It does not refresh the remote Card or verify current access.

Receive requests from approved callers

1. Open How agents connect and copy This agent's Agent Card URL below the direction cards. Share it with the caller administrator.
2. Open Incoming Connections and add the calling identity.
3. Enter or select the caller's principal object ID in the receiving tenant, choose the receiving handler, and enable the connection.
4. Save the connection and complete the existing caller-access setup. Review Azure resource access and incoming approval separately.
5. Ask the caller to retry its connection check and send an authenticated A2A request as the approved identity.

For an application, use the Enterprise application service principal object ID, not the application (client) ID. A group ID is not a calling principal. Use the exact identity selected in the caller's outgoing setup.

Choose a custom handler scoped to the intended work when possible. The default agent can have broader tools and connectors; an incoming approval is not a per-tool or per-resource permission list.

Agent Card URL

The deployed address normally follows this shape:

https://<deployed-agent-host>/.well-known/agent-card.json

Callers use this URL to discover the A2A endpoint. Azure access and an enabled incoming connection are required to send requests to this SRE Agent.

The guide derives the address from the configured endpoint; displaying or copying it does not verify reachability or connection health. Local or relative endpoints receive an actionable warning to use the deployed agent's Card URL for external callers. Invalid endpoints show an error message without a fabricated URL or Copy action. Do not forward a local development URL to external callers.

Review conversations

Conversations distinguishes incoming and outgoing requests. Remote agent identifies the other participant; Direction tells you whether this agent called or received the request.

Status in this list describes the local outgoing call, not the remote agent's complete task lifecycle:

Direction or local state	Status shown
Incoming	N/A
Outgoing running	Waiting for agent
Outgoing completed	Local call completed
Outgoing failed	Local call failed
Outgoing cancelled	Stopped locally
Outgoing paused	Paused locally
Outgoing without a recorded local status	Unknown

Incoming status is N/A because this list does not track its execution status. It is not a health or failure assessment. Individual remote-agent tool results retain their separate local and recorded remote-status information: local completion or cancellation is not proof that remote work completed or stopped.

A2A conversation history is read-only from the human-facing UI. Clarification and cancellation use the approved caller's supported A2A operations, not a human composer or Stop action in the receiving conversation.

Troubleshoot setup

Symptom	What to check
The Card URL cannot be fetched or validated	Use the deployed HTTPS endpoint; review the provider's supported protocol, host/audience requirements, and selected identity
SRE Agent access is denied	Confirm the exact calling principal in the receiving tenant, required Azure resource access, and an enabled incoming approval
The outgoing connection was saved but requests fail	A saved Card is not an invocation test; review the actual request error and the receiver's access requirements
A newly granted permission is not recognized	Review the setup result, allow for permission propagation, and retry explicitly rather than assuming access is ready
Incoming conversation status shows N/A	This is expected; outgoing-call status does not apply to incoming rows
You cannot manage incoming connections	Ask an administrator with thread-approve permission; the guide does not grant or bypass it
A local endpoint appears in the guide	Replace it with the deployed endpoint before sharing it with external callers

Security and lifecycle considerations

Incoming tasks run in Autonomous mode with a read-only instruction and limited platform guards. The instruction is not an enforced security boundary. Review the selected handler, its tools and connectors, and the surviving platform restrictions before approving callers.

Incoming approval and Azure RBAC are separate. Removing an outgoing connection does not revoke roles or incoming approval on the receiver. Disabling or removing incoming approval does not delete conversation history, revoke Azure roles, or stop already admitted work.

Subsequent protocol requests, including task reads and cancellation, can lose access after incoming approval is disabled or removed. When cancellation is needed, use the caller's supported A2A cancellation operation before revoking approval. Do not assume a local stopped call means that the remote task was cancelled.