Python: add agent-framework-hosting-entra identity-link helpers

python/packages/hosting-entra/LICENSE

@@ -0,0 +1,21 @@
+    MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE

python/packages/hosting-entra/README.md

@@ -0,0 +1,39 @@
+# agent-framework-hosting-entra
+
+Microsoft Entra (Azure AD) identity-linking sidecar channel for
+[agent-framework-hosting](../hosting). Owns the OAuth 2.0 Authorization Code
+flow that binds a per-channel id (e.g. a Telegram chat id) to the user's
+Entra object id, so multiple non-Entra channels can share a single
+`entra:<oid>` isolation key.
+
+## Usage
+
+```python
+from pathlib import Path
+from agent_framework_hosting import AgentFrameworkHost
+from agent_framework_hosting_entra import (
+    EntraIdentityLinkChannel,
+    EntraIdentityStore,
+)
+
+store = EntraIdentityStore(Path("./identity_links.json"))
+
+host = AgentFrameworkHost(
+    target=my_agent,
+    channels=[
+        EntraIdentityLinkChannel(
+            store=store,
+            tenant_id="<tenant id>",
+            client_id="<entra app id>",
+            client_secret="<entra app secret>",
+            public_base_url="https://your.host",
+        ),
+        # ... other channels whose run hooks call store.lookup(...)
+    ],
+)
+host.serve()
+```
+
+For tenants that disallow client secrets, pass `certificate_path=` (and
+optionally `certificate_password=`) instead of `client_secret`. The PEM
+layout matches the one used by `agent-framework-hosting-teams`.

python/packages/hosting-entra/agent_framework_hosting_entra/__init__.py

@@ -0,0 +1,15 @@
+# Copyright (c) Microsoft. All rights reserved.
+
+"""Microsoft Entra (Azure AD) identity channel for :mod:`agent_framework_hosting`."""
+
+from ._channel import (
+    EntraIdentityLinkChannel,
+    EntraIdentityStore,
+    entra_isolation_key,
+)
+
+__all__ = [
+    "EntraIdentityLinkChannel",
+    "EntraIdentityStore",
+    "entra_isolation_key",
+]