docs(w365): document MCP server authentication + minimal request example

[Bertrand Desmarest (desmarest)]

What

Adds an Authentication section to the W365 Computer Use sample README documenting how a third-party agent authenticates to the W365 Computer Use MCP server, plus a minimal request example. Fills a gap flagged by the W365 team (their authentication.md was vague on this).

Contents

• Endpoint — production gateway URL and local-dev (McpServer:Url).
• Token — the agent-identity ("agentic") bearer token: resource/audience app ID, scope string, and the Tools.ListInvoke.All delegated scope; how it's acquired in production (A365 SDK w365 handler) vs. local dev (Get-CuaAgentUserToken.ps1 → BEARER_TOKEN).
• Headers — Authorization: Bearer <token> is the only required header; optional x-ms-* correlation headers noted inline. Agent identity is carried by the token (no separate identity header).
• Minimal request example — JSON-RPC tools/call for StartSession → GetSessionDetails, plus the equivalent .NET SseClientTransportOptions snippet.
• Adds the missing w365 handler scope row to the Configuration Reference table.

Notes

Docs-only change. Content verified against the sample source (ComputerUseOrchestrator, W365McpSessionClient) and scoped to the consumer-facing contract — no server-side implementation details.

[Copilot]

Pull request overview

This PR updates the W365 Computer Use sample documentation to explain how third-party agents authenticate to the W365 Computer Use MCP server, including endpoint details, required OAuth bearer token audience/scope, and a minimal JSON-RPC request flow.

Changes:

• Adds a new “Authentication to the W365 Computer Use MCP server” section covering endpoint, token acquisition, and headers.
• Documents a minimal JSON-RPC tools/call example for StartSession → GetSessionDetails.
• Adds the missing w365 handler scopes row to the Configuration Reference table.

Suppressed comments (2)

dotnet/w365-computer-use/sample-agent/README.md:199

• The “Headers” section lists optional x-ms-* headers but omits x-ms-agentid, which the sample sends on every W365 connection (see ComputerUseOrchestrator.CreateW365TransportOptions). This makes the guidance incomplete and also conflicts with the earlier “no separate identity header” statement.

Only one header is required: `Authorization: Bearer <token>` for the resource above. The sample also sends a few optional `x-ms-*` correlation headers (`x-ms-conversation-id`, `x-ms-channel-id`, `x-ms-user-message-id`, `x-ms-user-agent`) for telemetry — none are required.

> **Note:** the calling agent's identity is taken from the bearer token itself — you don't send a separate identity header.

dotnet/w365-computer-use/sample-agent/README.md:237

• This section points readers to ComputerUse/W365McpSessionClient.cs for where headers are attached, but that file doesn’t create the SSE transport / headers. The transport options (including x-ms-agentid and other x-ms-* headers) are built in ComputerUseOrchestrator.CreateW365TransportOptions, so the reference and code snippet should be updated to match the real implementation.

In .NET, the sample uses the MCP SDK rather than hand-rolling JSON-RPC — it attaches the headers via `SseClientTransportOptions.AdditionalHeaders` and calls `IMcpClient.CallToolAsync(...)` (see `ComputerUse/W365McpSessionClient.cs`):