Enable native SSO identity propagation for external channels in watsonx Orchestrate on-premises

watsonx Orchestrate on-premises currently does not support native propagation of the authenticated user identity from external channels to agent tools through OBO or IdP Token Exchange.

As a result, users interacting with an agent from Microsoft Teams, Slack, or another external channel cannot transparently execute actions using their own identity and delegated permissions. Customers must implement and maintain an external authentication broker or proxy to handle this flow.

We request native support for:

External channel → watsonx Orchestrate agent → user identity propagation → tool or downstream API

This capability should not be limited to Microsoft Teams or Microsoft Graph. It should support compatible identity providers, external channels, connectors, and APIs.

Business value

Native SSO identity propagation would:

• avoid an additional user login;
• allow tools to execute actions with the user’s actual permissions;
• improve auditability and least-privilege enforcement;
• remove the need for customer-managed authentication proxies;
• simplify enterprise deployment and support;
• improve feature parity between SaaS and on-premises environments.

This is particularly important for customers choosing on-premises deployments because of data sovereignty, security, or regulatory requirements.

Expected behavior

watsonx Orchestrate should be able to:

• receive and validate the authenticated identity from an external channel;
• propagate that identity securely to agent tools;
• support OBO and IdP Token Exchange flows;
• manage token renewal and expiration;
• prevent tokens from being exposed to the LLM or agent prompt;
• preserve the user identity in audit logs.