The agent action gate
The fictional bank records the exact action and approver.
Coming
See every demonstrationFOUNDRY AGENT PRODUCTION READINESS
Decide whether a Foundry workload is ready for production, with evidence.
A release date is approaching for a Microsoft Foundry workload and nobody can say, with evidence, whether its identity, networking, data, content safety, evaluation and rollback are production-grade. In four weeks we inventory the workloads, review each control area, validate a representative workload in a lab you approve, and hand over a graded readiness report, a reference architecture and a 30-60-90 day remediation roadmap.
01 Source02 Boundary03 Human decision04 Evidence
HOW IT WORKS
The control path in practice.
- Week one: intake, workload inventory, target outcomes, architecture and dependency discovery.
- Week two: identity, networking, data, content safety, model lifecycle, quota and cost review.
- Week three: evaluation, tracing, observability, incident response, deployment and rollback.
- Week four: target architecture, remediation backlog, executive readout and implementation handoff.
THE PROBLEM
What does a demo not prove?
That the workload survives production: an identity that is its own and not a developer's, a network that is private where it should be, data handling that someone reviewed, content safety that was tested, an evaluation that is repeatable, and a rollback that has been run. The assessment grades each of those with evidence references.
For in-scope Copilot Studio workflows the review separates information requests, model-triggered review and enforced approval, and the lab tests cover rejection, timeout and service failure. Untested behavior and preview limits stay explicit in the report; findings separate what was observed from what was not tested.
THE MICROSOFT INSIGHT
What identity does a Foundry agent run under?
Its own: Microsoft Entra Agent ID is generally available and gives each agent its own identity with owners and sponsors, Conditional Access templates for autonomous and on-behalf-of agents, and sponsor lifecycle workflows; the agent security features are licensed through Microsoft Agent 365, and the register of which agent has which identity is week one's first output.
Microsoft Entra Agent ID is generally available to every Microsoft Entra customer and gives each AI agent its own identity with owners and sponsors, Conditional Access templates for high-risk, autonomous and on-behalf-of agents, and sponsor lifecycle workflows; extending Entra security features to agents needs a Microsoft Agent 365 license, and the admin center creation wizard and agent user accounts remain in preview. (Microsoft Learn, checked Nov 4, 2026)
Give each agent its own identity before release and revocation is a switch. Ship on a shared principal and revocation is a redeploy.
THE METHOD
What happens in the four weeks?
Discovery, control review, validation and handoff, with production read-only throughout.
- Week 1: intake, workload inventory, target outcomes, architecture and dependency discovery.
- Week 2: identity, networking, data, content safety, model lifecycle, quota and cost review.
- Week 3: evaluation, tracing, observability, incident response, deployment and rollback, with active validation on a representative non-production workload in a lab you approve.
- Week 4: target architecture, remediation backlog, a sixty-minute executive readout and the implementation handoff.
THE JOIN
How does the workload join the governance you already have?
Agents built with Microsoft Foundry, Copilot Studio and Agent Builder are integrated with Microsoft Agent 365 automatically, so the readiness report maps each agent to its Agent 365 registration, its owner and its permitted actions rather than inventing a parallel register.
Agents built with Microsoft Foundry, Copilot Studio and Agent Builder are integrated with Microsoft Agent 365 automatically; agents built elsewhere join through registry sync or the Agent 365 SDK. (Microsoft Learn, checked Oct 31, 2026)
Map the agents to the control plane and the operations team inherits them with an owner. Skip it and they run as resources nobody in Microsoft 365 can see.
WHAT IT IS NOT
Does the assessment change production?
No. Production changes, model deployment, quota purchase and application cutover are excluded, as is any guarantee that a preview feature meets production service levels, and source-code remediation beyond the findings. Scope is one Azure tenant, up to three Foundry projects, up to five production or pilot agents and one representative non-production workload.
Access is read-only to the in-scope Foundry projects, the Azure resource inventory, monitoring and architecture documentation, with named AI platform, security and application owners for interviews. Azure Lighthouse may be used for approved least-privilege access and you remove the delegation at closure; Microsoft 365 permissions and application data need separate authorization.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold the Production Readiness Report with graded findings and evidence references, observed separated from untested.
- You hold the Microsoft Foundry reference architecture: projects, model endpoints, identity, network, data, evaluation, logging and deployment boundaries.
- You hold the model and SDK lifecycle register with retirement exposure, replacement paths and owners, and the evaluation and red-team test plan with quality, safety, latency and cost thresholds.
- You hold the 30-60-90 day remediation roadmap, each entry with an owner, acceptance evidence and an escalation path.
The work is delivered remotely inside your own Microsoft tenant, wherever your business is, and on site only when the work needs it.
HONEST ABOUT LIMITS
What this does not do yet
It does not detect every attack on an agent with a generally available control today. Microsoft Defender threat detection for Agent 365 managed agents, in public preview, raises near real time alerts for jailbreak attempts, indirect prompt injection, credential leakage and suspicious access. (Microsoft Learn, checked Nov 4, 2026, preview) Microsoft Defender threat detection for Agent 365 managed agents is in public preview and covers published Foundry agents; the report labels it as preview and the architecture relies on identity, the approval seam and the real-time tool-call gate that are released.
It does not deploy a model, buy quota or cut an application over; those follow the roadmap under their own scope.
It does not promise that a preview feature meets production service levels; preview limits stay explicit.
THE ONE THING TO REMEMBER
Production ready is a graded finding with evidence, not a demo that went well.
Said another way: inventory, review, validate in a lab, then a roadmap with owners.
Said a third way: every entry in the backlog names who fixes it, what proves it fixed, and who hears if it is not.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
What does the assessment cover?
Foundry projects, model deployments, Microsoft Agent Framework applications, Azure AI Search and Foundry IQ where used, Entra workload identity, private networking, Key Vault, Azure Monitor, Application Insights, content safety and the approved runtime, with the human approval seam recorded per workflow.
How much is in scope?
One Azure tenant, up to three Foundry projects, up to five production or pilot agents, and one representative non-production workload for active validation. Production stays read-only.
How is it bought?
Through a private offer on Azure Marketplace after a scoping call, or the call first. Microsoft licenses, Azure consumption and excluded work are separate; delivery is virtual. No price appears on this site.
What comes after a go?
The accepted findings are reused: building a Foundry IQ knowledge base or a production agent workload is scoped separately, and the Managed Private AI service runs the result if you want an operator.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.
View the Microsoft Marketplace listing It is bought by private offer after the scoping call, on your Microsoft agreement.