Azure Foundry Hosted Agents¶
Microsoft Foundry Hosted Agents is a compute platform purpose-built for running AI agents at enterprise scale. Announced in public preview in April 2026 as part of the Microsoft Foundry platform, it provides every agent session with its own dedicated, hypervisor-isolated sandbox — not process isolation or a code-execution-only container, but full VM-level isolation — with a persistent file system that survives scale-to-zero events. The central insight driving the product is that traditional web-service infrastructure (containers, web apps, serverless functions) was designed to share one instance across many concurrent users, which is incompatible with how agents work: agents write files, execute arbitrary code, hold sensitive credentials, and accumulate session-specific state that cannot be safely shared.
The Problem with Traditional Compute¶
When a standard container hosts two simultaneous agent sessions, those sessions share a file system, a process space, and potentially cached credentials. In a chat application this is survivable; in an agent that browses the web, writes code, and accesses OAuth tokens it is a security and isolation failure. The hard part of deploying agents at scale is not writing the agent — it is providing real isolation, real identity, and real governance at the scale of thousands of concurrent sessions.
Hosted Agents addresses each of these gaps directly.
Core Capabilities¶
Per-session hypervisor isolation. Every invocation of a hosted agent gets its own VM-level sandbox. Customer A and Customer B cannot observe or interfere with each other's sessions even if they share the same agent deployment. Isolation is enforced at the hypervisor layer, not just at the process or container layer.
Persistent file system across scale-to-zero. The sandbox scales to zero when idle — meaning you pay nothing for idle time — and when it resumes, the working directory, disk state, and session identity are exactly where they were left. This enables agents to pick up long-running work across multiple invocations without rebuilding context. A meeting-prep agent that runs every Monday morning can accumulate weeks of learned preferences instead of starting fresh each time.
Predictable cold starts. Spin-up time is measured in seconds with low variance, unlike traditional serverless cold starts that can run into the minute range. This matters for user-facing agent interactions where a slow start degrades the experience.
BYO VNet. Agents can route outbound traffic through a customer-managed Virtual Network, enabling access to internal resources and compliance with data-residency requirements.
Multiple invocation protocols out of the box: OpenResponses (with automatic mapping to/from Activity Protocol for one-click publish to Microsoft 365), a Flexible Invocations protocol for custom integrations, and AG-UI support.
Agent versioning. Built-in versioning with stable endpoints and weighted rollouts across versions enables blue-green deployments and canary releases of agent logic without disrupting callers.
Comparison with Traditional Compute¶
| Dimension | Traditional Compute | Foundry Hosted Agents |
|---|---|---|
| Isolation | Multiple sessions share a container | Every session gets a dedicated VM sandbox |
| Cold starts | Seconds–minutes (high variance) | Seconds (low variance, predictable) |
| Idle cost | Always-on billing or slow scale-from-zero | Scale to zero; filesystem preserved on resume |
| State persistence | Build yourself (databases, external storage) | Built in — files and disk survive scale-to-zero |
| Identity | Shared service account | Per-agent Entra Agent ID + per-user OBO context |
| Observability | Build yourself | Built in via OpenTelemetry |
Identity and Governance¶
Every hosted agent receives its own Entra Agent ID — a dedicated, auditable Microsoft Entra identity for the agent itself, not shared with the service account of the deployment. This means every action taken by the agent is traceable to that specific agent in audit logs.
For user-facing entry points (such as Teams or Microsoft 365), the Toolbox component supports OAuth 2.0 On-Behalf-Of (OBO) flows, propagating the authenticated user's context to downstream services. Background or autonomous workloads where no user token is present authenticate using the agent's Managed Identity. Data Loss Prevention (DLP) policies, Responsible AI guardrails, and VNet integration complete the enterprise governance layer.
Framework Flexibility¶
Foundry Hosted Agents is multi-model and multi-harness by design. Bring any orchestration framework — LangGraph, Microsoft Agent Framework, Claude Agent SDK, OpenAI Agents SDK, GitHub Copilot SDK, or a custom harness — and define the runtime environment with a standard Dockerfile. The platform deploys with a single command (azd deploy) and handles scaling, isolation, and observability regardless of which framework runs inside.
This is explicitly designed to avoid lock-in: if a team changes their model provider from OpenAI to Anthropic to Meta, or their orchestration layer from LangGraph to a custom system, the hosting platform is unchanged.
Platform Integration¶
Hosted Agents integrates with the broader Microsoft Foundry platform through several co-announced services:
- Toolbox (public preview): unified tool and MCP server management across frameworks. Build once, connect any MCP client to the same endpoint. Handles auth, OAuth identity passthrough, and per-tool-call observability.
- Memory (preview): managed long-term memory built into Foundry Agent Service, eliminating the need to provision external vector or graph databases for session persistence. Natively integrated with Microsoft Agent Framework and LangGraph.
- Context connections: agents can connect to Work IQ (Microsoft 365 data graph), Fabric IQ (business intelligence data), and Foundry IQ (curated knowledge and search).
- Distribution: publish agents directly to Teams and M365 Copilot via the OpenResponses → Activity Protocol bridge.
- Observability: end-to-end OpenTelemetry tracing, AI Red Teaming Agent for adversarial safety testing, and continuous evaluation.
Status and Availability¶
Hosted Agents entered public preview in April 2026. Microsoft Agent Framework v1.0 (the stable, production-ready successor that unifies Semantic Kernel and AutoGen foundations) is available alongside it. General Availability is targeted but not yet dated as of the public preview announcement.
Getting Started¶
The Foundry documentation provides a quickstart using the Azure Developer CLI:
# After configuring your agent code in a supported framework:
azd deploy
The deploy command provisions the sandbox environment, assigns an Entra Agent ID, and wires up the agent versioning and endpoint routing.
Changelog¶
2026-05-18 — Page created from https://devblogs.microsoft.com/foundry/introducing-the-new-hosted-agents-in-foundry-agent-service-secure-scalable-compute-built-for-agents/ (Type B, confidence 75, moderate-confidence). Single source — second source verification pending.