MCP, A2A, and What 'Agentic-First' Actually Means on the Microsoft AB-100 Exam

The Microsoft AB-100 (Agentic AI Business Solutions Architect) audience profile calls out three things by name that you will not find on any other Microsoft certification yet: agentic-first design, Model Context Protocol (MCP), and Agent2Agent (A2A). If those three terms feel fuzzy, the exam will expose it. This post unpacks them.

What "agentic-first" actually means#

Agentic-first is the design assumption that the unit of computation is an agent, not a single LLM call. An agent has a goal, a planning loop, tools it can call, memory across turns, and the ability to hand off to another agent.

Traditional AI integrations look like this: a user asks a question, a single LLM call produces an answer, the application returns it. Stateless. One-shot. The application code orchestrates everything.

Agentic-first looks different. The user states a goal. An agent decides how to break it down, picks tools, calls them, observes results, calls more tools, possibly hands off to a specialist agent, and returns when the goal is met or it cannot proceed. The application code provisions the agent, gives it boundaries, and watches what it does.

The AB-100 exam will ask you to identify which of these two shapes fits a scenario. A "summarize this email" task is not agentic-first. A "research this customer's history across three systems and draft a renewal proposal" task is. If you cannot tell the difference quickly, you will lose points.

What changes when you go agentic-first#

Five things change for the architect:

1. The runtime is non-deterministic. The agent picks tools at runtime. You cannot enumerate every possible execution path.
2. Telemetry is conversation-shaped. You log turns, tool calls, decisions, and outcomes, not just request/response pairs.
3. Security shifts to capabilities. What matters is what the agent can do (tools allowlisted, scopes per request), not which lines of code execute.
4. Evaluation is multi-turn. A single-prompt evaluation harness will not catch the failure modes that matter.
5. ALM versions models, prompts, and grounding data alongside code. Promotion across environments has to handle all four.

The exam tests every one of these shifts.

Model Context Protocol (MCP)#

MCP is an open protocol that standardizes how an agent discovers and uses tools, resources, and prompts that live outside its host process. Microsoft adopted it across Copilot Studio and Microsoft Foundry, and the AB-100 exam expects you to understand it at the architecture level.

What MCP exposes#

An MCP server can expose three kinds of things:

• Tools. Functions the agent can call. The server declares the tool name, its input schema, and its description. The agent decides when to call it.
• Resources. Read-only context the agent can pull on demand: a document, a database row, a knowledge-base entry. The server says what is available and how to address it.
• Prompts. Reusable prompt templates the host application or agent can fetch by name and fill in. Useful for sharing prompts across teams.

Why an architect cares#

MCP matters in three architectural decisions on the exam:

1. Reuse across agents. Once a tool is exposed via MCP, any MCP-aware agent can use it. You write the integration once.
2. Vendor and model portability. An MCP server is not tied to a specific LLM. Switch from Gemini to GPT-5 to a Microsoft Foundry model and the tool still works.
3. Security boundary. The MCP server enforces what the agent can do. The agent cannot bypass the server's authorization.

When AB-100 asks "the team needs Tool X available to three different agents, including a third-party Copilot Studio agent and a custom Microsoft Foundry agent," the answer is "expose Tool X as an MCP server." Not "duplicate the integration in each agent."

Agent2Agent (A2A)#

A2A is the sibling protocol for agents talking to other agents. MCP is agent-to-tool. A2A is agent-to-agent.

The classic A2A scenario: a generalist agent receives a complex request, recognizes that part of it requires a specialist (a finance agent, a legal agent, a customer-history agent), hands off the relevant context, gets a result back, and continues. Each agent might be authored by a different team or vendor.

What A2A standardizes#

• A common envelope for agent-to-agent messages: who is asking, what context is shared, what outcome is expected.
• Discovery: how an agent finds another agent that can help.
• Authentication and authorization: which agent is allowed to call which.
• Streaming and async patterns for long-running specialist work.

Why this matters on AB-100#

The exam will give you scenarios where one team owns a sales agent, another owns a contracts agent, and a third owns a customer service agent. The right answer is rarely "have the sales agent embed all the contract logic." It is "have the sales agent hand off to the contracts agent via A2A when needed."

If you walk in thinking single-agent monoliths, you will pick the wrong design.

How the three concepts compose#

A real AB-100-grade scenario stitches all three together. Imagine:

A regulated bank wants a sales-and-onboarding agent that can: pull customer history from three internal systems, draft a personalized offer, route legal review when the offer exceeds a threshold, and capture the entire conversation for audit.

The agentic-first design has four moving parts:

• Sales agent (primary). Authored in Copilot Studio. Owns the conversation and the goal.
• MCP server for customer data. Wraps the three internal systems with authenticated, role-scoped read tools. Exposes resources for compliance documents.
• Legal review agent (specialist). Authored in Microsoft Foundry. Reachable via A2A when the offer exceeds the threshold.
• Telemetry and audit pipeline. Captures conversation transcripts, tool calls, and agent handoffs to a Microsoft Purview audit sink.

The exam will dress this up with detail and ask which combination of components fits, or which is missing, or which violates a policy. If you can hold all three concepts (agentic-first, MCP, A2A) in your head simultaneously, the questions become much easier.

Three traps to avoid#

1. Treating MCP as a Microsoft-only concept. It is an open protocol. Pretending it is proprietary will make you misread vendor-mix scenarios.
2. Designing single mega-agents. A2A exists because multi-agent systems are easier to govern, evolve, and reuse than monoliths. The exam reflects that.
3. Skipping the security implications. MCP servers and A2A connections are new attack surfaces. The Deploy domain (40 to 45% of the exam) tests scoped credentials, prompt-injection defense at the tool boundary, and audit coverage of agent decisions.

Where to read more before the exam#

The official AB-100 study guide on Microsoft Learn lists the skills measured in detail. Beyond that, read the Microsoft Foundry agent documentation, the Copilot Studio MCP integration docs, and the Cloud Adoption Framework's AI adoption process. The exam pulls vocabulary from all three.

Ready to put this into practice? Start a free practice test on ExamCoachAI.