Scaling an agent flow with Graph API /me/ to 50 users — what's the best pattern?
Scaling an agent flow with Graph API /me/ to 50 users — what's the best pattern?
Scaling an agent flow with Graph API /me/ to 50 users — what's the best pattern?
Re: Scaling an agent flow with Graph API /me/ to 50 users — what's the best pattern?
I’ve been looking at something similar for scaling out user‑specific “daily briefings”.
From what I’ve seen, **Option 2 (app permissions +** \`/users/{id}\`**)** is the only thing that really scales beyond a handful of users, especially if you want one flow and centralized maintenance. The main trade‑off is the security conversation with IT, but that’s a one‑time hurdle.
A few things that seem to work well in practice:
• Store the client secret in Azure Key Vault (or at least an environment variable) and use a custom connector or HTTP with managed identity instead of hard‑coding it in the flow.
• Put your 50 users in a SharePoint list / Dataverse table with an “Active” flag so you can pause individuals without editing the flow.
• Throttle Graph calls with a delay in the loop or use concurrency control on the “Apply to each” to avoid hitting the limits.
• For AI Builder, either:
– consolidate emails/calendar into fewer prompts (e.g., one per user per day)
– or split into tiers so only some users get the AI summary every day and others less frequently, depending on your credit budget.
For Copilot Studio: if you wire Graph via the built‑in Graph connectors with delegated permissions, \`/me\` should resolve to the person using the bot in Teams, not the maker, because it’s using their Teams/AAD identity. If you’ve got it working differently, I’d love to hear how you wired the auth, because that’s super interesting.
From what I’ve seen, **Option 2 (app permissions +** \`/users/{id}\`**)** is the only thing that really scales beyond a handful of users, especially if you want one flow and centralized maintenance. The main trade‑off is the security conversation with IT, but that’s a one‑time hurdle.
A few things that seem to work well in practice:
• Store the client secret in Azure Key Vault (or at least an environment variable) and use a custom connector or HTTP with managed identity instead of hard‑coding it in the flow.
• Put your 50 users in a SharePoint list / Dataverse table with an “Active” flag so you can pause individuals without editing the flow.
• Throttle Graph calls with a delay in the loop or use concurrency control on the “Apply to each” to avoid hitting the limits.
• For AI Builder, either:
– consolidate emails/calendar into fewer prompts (e.g., one per user per day)
– or split into tiers so only some users get the AI summary every day and others less frequently, depending on your credit budget.
For Copilot Studio: if you wire Graph via the built‑in Graph connectors with delegated permissions, \`/me\` should resolve to the person using the bot in Teams, not the maker, because it’s using their Teams/AAD identity. If you’ve got it working differently, I’d love to hear how you wired the auth, because that’s super interesting.