Project: Enterprise Agents (M365 Agents Toolkit) - IC Incident Commander

Track

Enterprise Agents (M365 Agents Toolkit)

Project Name

IC Incident Commander

GitHub Username

@ejazhussain

Repository URL

https://github.com/ejazhussain/o365c-incident-commander

Project Description

🚨 IC Incident Commander

A multi-agent incident response system built in M365 Copilot Chat that acts as an automated Incident Commander — orchestrating 4 specialist Declarative Agents through a Commander orchestrator to cover the full incident lifecycle from detection to post-mortem.

Agents

Agent	Role
🎖️ IC Commander	Orchestrator — routes user intent to the right specialist
🚨 IC Triage	Classifies severity, identifies affected services
🔍 IC Investigation	Root cause analysis via deployments, change logs & known issues
📢 IC Communication	Identifies stakeholders, posts structured status updates
📝 IC Post-Mortem	Generates blameless post-mortem reports on demand

MCP Server

OAuth-secured Node.js + TypeScript server with 12 tools (8 read + 4 write), protected by Microsoft Entra ID JWT validation.

Key tool: investigate_incident aggregates 4 data sources in a single MCP call — critical for keeping Copilot relay payloads within limits.

Impact

Reduces Mean Time To Resolve (MTTR) by eliminating manual coordination — a single natural language prompt in Copilot Chat triggers the full incident response workflow across all agents.

Demo Video or Screenshots

Demo Video: https://github.com/ejazhussain/o365c-incident-commander/raw/main/assets/demo/Incident_Commander_Demo.mp4
Screenshots: https://github.com/ejazhussain/o365c-incident-commander/tree/main/assets/screenshots

Primary Programming Language

TypeScript/JavaScript

Key Technologies Used

• M365 Agents Toolkit (Declarative Agents)
• Model Context Protocol (MCP) — @modelcontextprotocol/sdk
• Microsoft Entra ID (OAuth 2.0 / JWT validation)
• Express.js + TypeScript
• Microsoft 365 Copilot Chat (orchestrator + worker_agents)
• Adaptive Cards
• ngrok (HTTPS tunnel for local MCP server)

Submission Type

Individual

Team Members

No response

Submission Requirements

• My project meets the track-specific challenge requirements
• My repository includes a comprehensive README.md with setup instructions
• My code does not contain hardcoded API keys or secrets
• I have included demo materials (video or screenshots)
• My project is my own work with proper attribution for any third-party code
• I agree to the Code of Conduct
• I have read and agree to the Disclaimer
• My submission does NOT contain any confidential, proprietary, or sensitive information
• I confirm I have the rights to submit this content and grant the necessary licenses

Quick Setup Summary

1. Clone: git clone https://github.com/ejazhussain/o365c-incident-commander.git
2. cd mcp-server && npm install
3. cp env/.env.example env/.env — fill in Entra ID credentials (or set AUTH_ENABLED=false for demo)
4. npm start — starts MCP server on http://localhost:3001
5. In a separate terminal: ngrok http 3001 --domain=
6. Open each agent folder in VS Code with M365 Agents Toolkit
7. Run "Provision" for each agent to deploy to your M365 tenant

Technical Highlights

• investigate_incident combined tool aggregates 4 data sources in a single MCP call, keeping orchestrator relay payloads small enough for Copilot to forward
• Commander orchestrator uses worker_agents declarative routing — no custom code, pure instruction-driven delegation to 4 specialist agents
• Full OAuth 2.0 flow with Entra ID JWKS validation on every MCP request (set AUTH_ENABLED=false in env/.env to disable for demo/local testing)
• Context-aware agent instructions prevent redundant tool calls — each agent makes exactly 1 MCP call per request
• In-memory data store with seed data is fully swappable with Azure Cosmos DB

Challenges & Learnings

Biggest challenge: M365 Copilot silently drops worker agent responses when the combined MCP tool output exceeds ~3-4KB. Fixed by consolidating multi-tool calls into a single investigate_incident tool and capping all agent responses to 150-200 words. Key learning: declarative agent orchestration requires strict payload discipline — less is more.

Contact Information

https://www.linkedin.com/in/hussaine/

Country/Region

United Kingdom

The submission points to the external repository https://github.com/ejazhussain/o365c-incident-commander; start with its README.md and the mcp-server directory. The issue describes a completed project rather than a specific change, test, or acceptance criterion, so the expected definition of done is not provided here.